[SRU] Please provide openjdk-21 for focal, jammy and lunar

The attachment "adjust-bootjdk.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

Jtreg test results:
Jammy

FAILED: sun/security/pkcs11/KeyStore/CertChainRemoval.java
https://bugs.openjdk.org/browse/JDK-8309214 (needs backport to 21 - requested)

Armhf: FAILED: java/io/File/GetXSpace.java
Runner issue (needs quarantine)
ARMHF: FAILED: serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java
https://bugs.openjdk.org/browse/JDK-8303168
Bad test, need to update quarantine patch
ARMF: FAILED: compiler/vectorization/runner/MultipleLoopsTest.java
Bad test, need to update quarantine patch

Armhf: FAILED: java/lang/ScopedValue/StressStackOverflow.java
https://bugs.openjdk.org/browse/JDK-8308609 (resolved in October patch)

S390x: FAILED: runtime/NMT/VirtualAllocCommitMerge.java
https://bugs.openjdk.org/browse/JDK-8309698 (in progress)

Focal:

FAILED: sun/security/pkcs11/KeyStore/CertChainRemoval.java
https://bugs.openjdk.org/browse/JDK-8309214 (needs backport to 21 - requested)

ARMHF: FAILED: serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java
https://bugs.openjdk.org/browse/JDK-8303168
Bad test, need to update quarantine patch

ARMHF: FAILED: compiler/vectorization/runner/MultipleLoopsTest.java
compiler.vectorization.runner.MultipleLoopsTest.reductionLoopWithAnotherReductionInput: Method is not compiled after 30s.
Intermittent runner timeout issue

Armhf: FAILED: java/lang/ScopedValue/StressStackOverflow.java
https://bugs.openjdk.org/browse/JDK-8308609 (resolved in October patch)

FAILED: runtime/NMT/VirtualAllocCommitMerge.java
https://bugs.openjdk.org/browse/JDK-8309698

Note: symlink /etc/localtime is being removed on purge by the package dependency
Note: Following files are left on system:
  /etc/timezone not owned
  /usr/local/share/fonts/ not owned
  /usr/local/share/fonts/.uuid not owned
  /usr/share/fonts/ owned by: fonts-dejavu-core
  /usr/share/fonts/.uuid not owned
  /usr/share/fonts/truetype/ owned by: fonts-dejavu-core
  /usr/share/fonts/truetype/.uuid not owned
  /usr/share/fonts/truetype/dejavu/ owned by: fonts-dejavu-core
  /usr/share/fonts/truetype/dejavu/.uuid not owned

Note: following files are left on system:
  /etc/timezone not owned
  /usr/local/share/fonts/ not owned
  /usr/local/share/fonts/.uuid not owned
  /usr/share/fonts/ owned by: fonts-dejavu-core
  /usr/share/fonts/.uuid not owned
  /usr/share/fonts/truetype/ owned by: fonts-dejavu-core
  /usr/share/fonts/truetype/.uuid not owned
  /usr/share/fonts/truetype/dejavu/ owned by: fonts-dejavu-core
  /usr/share/fonts/truetype/dejavu/.uuid not owned

Note: added block-proposed-jammy and block-proposed-focal tags for the bootstrap upload

Bootstrap build for Focal

Bootstrap build for Jammy

GA build for Focal

GA build for Jammy

In my opinion it should be backported also to Ubuntu 23.04, this is even a prerequisite for the backport to jammy and focal (see https://wiki.ubuntu.com/UbuntuBackports#Preparing_the_Backported_Package:~:text=so%20that%20version%202.x.y%20is%20usable%20in%20bionic%2C%20you%20must%20first%20backport%20that%20version%20to%20focal%2C%20so%20that%20upgrades%20from%20bionic%2Bbackport%20to%20focal%2Bbackports%20are%20covered)

Status changed to 'Confirmed' because the bug affects multiple users.

Lunar is currently building in PPA, I will update the bug with installation and jtreg test results after it finishes.

GA build for Lunar

Hi Vladimir,

I'm not particularly comfortable with disabling a whole range of tests for the toolchain in our stable releases. Have you looked into porting the testsuite onto the older GTest? It's probably not trivial, but who knows? ;)

Lunar JTREG test:

FAILED: sun/security/pkcs11/KeyStore/CertChainRemoval.java
https://bugs.openjdk.org/browse/JDK-8309214 (needs backport to 21 - requested)

Armhf: FAILED: java/io/File/GetXSpace.java
Runner issue, need to update quarantine patch
ARMHF: FAILED: serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java
https://bugs.openjdk.org/browse/JDK-8303168
Bad test, need to update quarantine patch
Armhf: FAILED: java/lang/ScopedValue/StressStackOverflow.java
https://bugs.openjdk.org/browse/JDK-8308609 (resolved in October patch)

S390x: FAILED: runtime/NMT/VirtualAllocCommitMerge.java
https://bugs.openjdk.org/browse/JDK-8309698 (in progress)

PPC64EL: FAILED: serviceability/attach/AttachNegativePidTest.java
execStatus=Failed. Execution failed\: `main' threw exception\: java.lang.NoClassDefFoundError\: jdk/test/lib/Utils
This appears to be a jtreg7 classpath issue, but a lot of other tests should've failed if it was the case: LP: #2037587 (Invalid).
The test passed with 1000 repetitions in ppc64el vm.

Hi Simon,
Yes, I did look into it - the issue is compile errors with TEST_F() macros:
----
/<<PKGBUILDDIR>>/test/hotspot/gtest/classfile/test_AltHashing.cpp:139:24: error: 'halfsiphash_test_ByteArray' has not been declared
  139 | TEST_F(AltHashingTest, halfsiphash_test_ByteArray) {
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~
/<<PKGBUILDDIR>>/test/hotspot/gtest/classfile/test_AltHashing.cpp:139:1: error: ISO C++ forbids declaration of 'TEST_F' with no type [-fpermissive]
  139 | TEST_F(AltHashingTest, halfsiphash_test_ByteArray) {
      | ^~~~~~
/<<PKGBUILDDIR>>/test/hotspot/gtest/classfile/test_AltHashing.cpp:139:50: error: cannot declare parameter to be of abstract type 'AltHashingTest'
  139 | TEST_F(AltHashingTest, halfsiphash_test_ByteArray) {
      | ^
/<<PKGBUILDDIR>>/test/hotspot/gtest/classfile/test_AltHashing.cpp:30:7: note: because the following virtual functions are pure within 'AltHashingTest':
   30 | class AltHashingTest : public ::testing::Test {
      | ^~~~~~~~~~~~~~
In file included from /usr/src/googletest/googlemock/include/gmock/internal/gmock-internal-utils.h:47,
                 from /usr/src/googletest/googlemock/include/gmock/gmock-actions.h:145,
                 from /usr/src/googletest/googlemock/include/gmock/gmock.h:59,
                 from /<<PKGBUILDDIR>>/test/hotspot/gtest/unittest.hpp:52,
                 from /<<PKGBUILDDIR>>/test/hotspot/gtest/classfile/test_AltHashing.cpp:28:
/usr/src/googletest/googletest/include/gtest/gtest.h:494:16: note: 'virtual void testing::Test::TestBody()'
  494 | virtual void TestBody() = 0;

-----
that only happens with 1.11. Earlier (focal) and later (lunar) versions are not affected. Looks like a combination of toolchain/gtest that are not compatible[1].

I believe going forward we will bundle google test and will not have this problem.

Note: this is a common problem for openjdk-17 and up.
Note: since I am testing jammy against ppa anyway (due to missing jtreg7 backport), I have google test 1.13 to the ppa, I will update jammy test results once rebuild it done

[1] https://mail.openjdk.org/pipermail/hotspot-dev/2021-April/050965.html

JDK focal to jammy upgrade (success). Requires -security updates.

JDK jammy to lunar upgrade (success). Requires -security updates.

Lunar piuparts test.

Note:
 0m46.6s INFO: Warning: Package purging left files on system:
  /usr/share/icons/ owned by: humanity-icon-theme, ubuntu-mono, openjdk-21-jre:amd64, hicolor-icon-theme, adwaita-icon-theme
  /usr/share/icons/Humanity-Dark/ owned by: humanity-icon-theme
  /usr/share/icons/Humanity-Dark/icon-theme.cache not owned
  /usr/share/icons/Humanity/ owned by: humanity-icon-theme
  /usr/share/icons/Humanity/icon-theme.cache not owned

Removed jammy test results, pending rebuild with google test enabled.

Updated jammy jtreg test logs

Disclaimer: I'm not familiar with java packaging

I'm looking at the SRU policy for openjdk-N updates: https://wiki.ubuntu.com/OpenJDK-Updates

It says:
"At most two OpenJDK short term support versions can be found in an Ubuntu LTS release."

Looking at jammy, there we seem to have versions 11 and 17 which are LTS releases, but also 8, 18 and 19. And now you want to introduce 21 for jammy. What happens to 8, 18 and 19? The policy also says:

"We want to ship the short term support OpenJDK version to get those exposed to users and developers, but want to drop them again when they become unsupported. "

Does that mean we should remove the unsupported versions?

> Jtreg tests should be disabled for the package due to the large number of packages that need to be
> upgraded in order to port jtreg7 [1]. This should be handled as a separate issue.

What is jtreg, what is it used for, what breaks if we don't ship it, and won't disabling the tests just paper over the problem? What do you mean by "handled as a separate issue", are you planning on fixing it somehow?

Is java21 useful without a working jtreg? Won't users be expecting java 21 to just work, but ours will have this defficiency?

> Does that mean we should remove the unsupported versions?

The unsupported versions are required for bootstrapping the next version, e.g. openjdk-19 is required to build openjdk-20, and openjdk-20 is required for building openjdk-21.
If we have openjdk-21 in the archive, then technically we do not need openjdk-19, since if we ever publish openjdk-21 containing a critical bug that does not allow to build a fix, we still can rely on openjdk20.

Thank you for looking into it! I should put together some wiki page on openjdk packaging.

> What is jtreg, what is it used for
This is a regression test harness for openjdk[1] and is used to validate that openjdk works correctly.

> what breaks if we don't ship it
Not shipping jtreg suite forces users to download it outside the archive to validate the openjdk.

> and won't disabling the tests just paper over the problem?
The tests were run in the ppa to ensure that there were no new problems introduced.

>What do you mean by "handled as a separate issue", are you planning on fixing it somehow?
Yes, there is a number of a new packages that needs to be added to focal and jammy[2].

>Is java21 useful without a working jtreg? Won't users be expecting java 21 to just work, but ours will have this defficiency?
Yes. jtreg is not needed to have a working openjdk. This is similar to disabling autopkgtests and executing them manually.

[1] https://github.com/openjdk/jtreg
[2] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-21-jtreg7

> Does that mean we should remove the unsupported versions?

Just to re-iterate one of Andreas' questions that I don't think has been answered yet: if this is accepted, jammy will have openjdk versions 8, 11 (LTS), 17 (LTS), 18, 19, 20, and 21. I note that 18 will be dropped on mantic (though not 19?). Should we be considering removal of (at least) 18 from earlier releases too, or is removal from an active release too disruptive?

The policy (kindly linked by Andreas above) states "At most two OpenJDK short term support versions" in an Ubuntu LTS release. Should we be considering revising that policy? As a follow-up to that: 18 and 19 didn't make it back to focal -- why should 20 and 21, given the SRU policy also states "A new OpenJDK short term support version has to be upload[ed] to [...] *the most recent* Ubuntu LTS release" (emphasis added)? Or in other words, we seem to be at least bending policy here; if there's a good reason for us to be doing so, should we be revising the policy?

>Just to re-iterate one of Andreas' questions that I don't think has been answered yet: if this is accepted, jammy will have openjdk versions 8, 11 (LTS), 17 (LTS), 18, 19, 20, and 21. I note that 18 will be dropped on mantic (though not 19?). Should we be considering removal of (at least) 18 from earlier releases too, or is removal from an active release too disruptive?

HI, just to clear up some misunderstanding here, 21 is a LTS release (see [Impact]) and the poilicy specifically targets short term (6 month support) releases.

The list of jamy versions is 8 (LTS), 11 (LTS), 17(LTS), 18, 19, 20 and 21(LTS).

18, 19 and 20 can be dropped as they are out of support and do not get security updates. 21 (LTS) is bootstrapped from 17 (LTS) with 21~35ea build.

Hi, I am not really familiar with Java packaging, however given that openjdk-21 is a NEW package and that version 21 is an LTS, it should be OK to sponsor the Focal and Jammy uploads.

However one thing I noticed is that the d/changelog entries explicitly target the -updates pocket, while I think we want the target release without specifying the pocket. (This is certainly true for "normal" SRUs, I am not 100% this is also the case for NEW packages, but I believe it is).

Could you please update the debdiffs dropping the pocket?

I have elected to do the change to the changelogs to target focal/jammy instead of -updates. So the 21~35ea-1ubuntu1 focal/jammy uploads are done.

There was a few tweaks I would have asked for otherwise but chose to permit, as we are going to replace these bootstrap builds shortly anyhow.

Since this patch set was started, 21.0.1+12-1 has been uploaded, does it make more sense to SRU that once it is present in noble?

(removing sponsors temporarily, when the next round of uploads are ready please resubscribe)

Bootstrap: updated changelog targeting focal.

GA: updated changelog targeting lunar

GA: updated changelog targeting jammy

GA: updated changelog targeting focal

I have updated debdiffs for documentation purposes, 21.0.1 is a better option as it does not contain 2 known vulnerabilities.

@Andreas, we should have removed 18 and 19 before releasing 22.04 LTS, however we cannot change that after the release.

Accepting the bootstrap version of openjdk-21.

Hello Vladimir, or anyone else affected,

Accepted openjdk-21 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openjdk-21/21~35ea-1ubuntu1~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Vladimir, or anyone else affected,

Accepted openjdk-21 into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openjdk-21/21~35ea-1ubuntu1~20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Note: as per Dan Bungert comment here are test plan notes for openjdk-21 21.0.1+12.

[Test Plan]

A package is built in

PPA ppa:vpa1977/openjdk-21-sru[1]

that has proposed enabled and uses bootstrap build published in the previous step

The package is tested by a set of JTREG (Java Regression Test Framework) tier1 and tier2 tests.
---- cut---
tier1: This is the most fundamental test tier. Roughly speaking, a failure of a test in this tier has the potential to indicate a problem that would affect many Java programs. Tests in tier1 include tests of HotSpot, core APIs in the java.base module, and the javac compiler. Multiple developers run these tests every day. Because of the widespread use, the tests in tier1 are carefully selected and optimized to run fast, and to run in the most stable manner. As a guideline, nearly all individual tests in tier1 are expected to run to completion in ten seconds or less when run on common configurations used for development. Long-running tests, even of core functionality, should occur in higher tiers or be covered in other kinds of testing. The test failures in tier1 are usually followed up on quickly, either with fixes, or adding relevant tests to problem list. GitHub Actions workflows, if enabled, run tier1 tests.

tier2: This test group covers even more ground. These contain, among other things, tests that either run for too long to be at tier1, or may require special configuration, or tests that are less stable, or cover the broader range of non-core JVM and JDK features/components(for example, XML)."
-----------[2]

The package should pass installation and upgrade tests with piupparts.

[Where problems could occur]

In addition to normal regression tests the user may have expectations that packages provided in the archive will work when using openjdk-21 as java update-alternative. This will require additional SRUs such as LP: #1930541 (fix maven for openjdk-17).

[1] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-21-sru/+packages
[2] https://openjdk.org/groups/build/doc/testing.html

21.0.1+12 patch for focal upload

21.0.1+12 OpenJDK patch for Jammy

JTREG test results.

Failing tests:
  FAILED: tools/jlink/JLinkReproducible3Test.java
  FAILED: tools/jpackage/share/RuntimePackageTest.java#id0
  FAILED: tools/jpackage/share/jdk/jpackage/tests/MainClassTest.java
  FAILED: java/security/Security/ConfigFileTest.java
  The tests fail due to dangling symlinks (openjdk-21-source and libatk-wrapper-java have to be installed in addition to jdk)
  This is an existing problem: https://bugs.launchpad.net/ubuntu/+source/openjdk-17/+bug/1723417

  FAILED: sun/security/lib/cacerts/VerifyCACerts.java
  FAILED: sun/security/ssl/X509TrustManagerImpl/Symantec/Distrust.java
  The list of CA certificates expected by the test and provided in focal/jammy do not match.
  FAILED: javax/crypto/CryptoPermissions/InconsistentEntries.java
  Writes to the openjdk installation directory, needs root permissions

Focal:
 - amd64: https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-21-sru/+build/26979075/+files/buildlog_ubuntu-focal-amd64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.2_BUILDING.txt.gz
 - arm64: https://launchpadlibrarian.net/696988802/buildlog_ubuntu-focal-arm64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.2_BUILDING.txt.gz
 - armhf: https://launchpadlibrarian.net/696975678/buildlog_ubuntu-focal-armhf.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.2_BUILDING.txt.gz
   - extra failure:
     FAILED: sun/security/ssl/SSLSocketImpl/SSLSocketCloseHang.java
     Failed due to the timeout (intermittent)
 - ppc64el: https://launchpadlibrarian.net/696895749/buildlog_ubuntu-focal-ppc64el.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.2_BUILDING.txt.gz
 - s390x: https://launchpadlibrarian.net/696889396/buildlog_ubuntu-focal-s390x.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.2_BUILDING.txt.gz

Jammy:
  - amd64: https://launchpadlibrarian.net/696892391/buildlog_ubuntu-jammy-amd64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.2_BUILDING.txt.gz
  - arm64: https://launchpadlibrarian.net/696980382/buildlog_ubuntu-jammy-arm64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.2_BUILDING.txt.gz
  - armhf: https://launchpadlibrarian.net/696937596/buildlog_ubuntu-jammy-armhf.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.2_BUILDING.txt.gz
  - ppc64el: https://launchpadlibrarian.net/696896619/buildlog_ubuntu-jammy-ppc64el.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.2_BUILDING.txt.gz
  - s390x: https://launchpadlibrarian.net/696898108/buildlog_ubuntu-jammy-s390x.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.2_BUILDING.txt.gz

openjdk-21 install tests pass, see logs of piuparts test (install/remove/purge) and distupgrade focal-> jammy

installation (install/remove/purge) and distupgrade (jammy -> lunar) tests pass.

Validated packages[1][2] built using the published bootstrap build in ppa:vpa1977/openjdk-21-sru PPA[3].

See[4][5][6].

Resubscribing Sponsors for uploading[1][2] to publish 21.0.1+12 in jammy and focal.
Lunar will be handled by the Security Update procedure.

[1] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/53
[2] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/54
[3] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-21-sru
[4] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/55
[5] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/56
[6] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/57

About the jtreg7 test results:

> The tests fail due to dangling symlinks (openjdk-21-source and libatk-wrapper-java have to be installed in addition to jdk)

IIUC, we could just depend on these openjdk-21-source and libatk-wrapper-java in jtreg7 and these would be resolved, correct? If not, can you elaborate on what's going on here? It seems that any user of jtreg7 is interested in the test results, so a few extra packages in service of that sounds worth the effort.

> The list of CA certificates expected by the test and provided in focal/jammy do not match.

What is the goal of these tests? An independent check of the system CA contents sounds redundant and unhelpful. What would a future-proof version of this look like? (which doesn't mean you have to go run and implement it right this second, we're just discussing) Or does this indicate that some certs that are meaningful for Java programs would not be usable?

Personal opinion: Checking the list of CA certs expected via test vs. what's available on the system sounds redundant, unhelpful, and in fact can be a problem.

Case in point: the December 2022 Trustcor certificates being removed as 'trusted' from ca-certificates and other components. If the cert list in the package expects Trustcor but they're removed from ca-certificates and the system store, you're going to always have failing tests then until you update the tests.

It makes more sense for jtreg to *not* do a CA Certificates validation/check. CA certificate trust/validation should be a ca-certificates, etc. job, not a jtreg build test test.

All autopkgtests for the newly accepted openjdk-21 (21~35ea-1ubuntu1~20.04) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

munin/2.0.56-1ubuntu1 (ppc64el, s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#openjdk-21

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

All autopkgtests for the newly accepted openjdk-21 (21~35ea-1ubuntu1~22.04) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

jsurf-alggeo/0.4.1+ds-3 (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#openjdk-21

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

I had a bit of a chat with the Security team as part of a rubber-ducking session.

It was discussed that jtreg7 - the upstream test suite for OpenJDK - should only be running CA checks in *their test environments* and not at a distro-level, which should instead be ignored on Ubuntu.

With Marc Deslauriers' opinion matching mine, it's a suggestion that the CA Certificate checks in jtreg7 be disabled at the distro level. It makes sense for upstream to run this CA test, but not on Ubuntu where we separately manage certificates at the ca-certificates, etc. level.

> IIUC, we could just depend on these openjdk-21-source and libatk-wrapper-java in jtreg7 and these would be resolved, correct? If not, can you elaborate on what's going on here? It seems that any user of jtreg7 is interested in the test results, so a few extra packages in service of that sounds worth the effort.

The test failures detect the actual bug - a normal user installing just openjk-*-jdk will run into issues when trying to use jpackage. This is an existing problem across all openjdk-* packages[1] that we should fix.

> It was discussed that jtreg7 - the upstream test suite for OpenJDK - should only be running CA checks in *their test environments* and not at a distro-level, which should instead be ignored on Ubuntu.

Probably those should be disabled in autopkgtest environment (testing against the installation of openjdk package) and are ok to run in the build environment.

[1] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/1723417

> What is the goal of these tests? An independent check of the system CA contents sounds redundant and unhelpful.
> What would a future-proof version of this look like? (which doesn't mean you have to go run and implement it right this second, we're just discussing) Or does this indicate that some certs that are meaningful for Java programs would not be usable?

VerifyCACertificates tries to assert that cacerts truststore contents can be retrieved and match the expected values.
This assertion is covered by ca-certificates-java tests and is redundant. We can disable it in autopkgtest (work in progress).

sun/security/ssl/X509TrustManagerImpl/Symantec/Distrust.java - fails to find a trust root and checks transition that already happened. This can be rewritten in a more generic way to check any other future root ca expiry.

javax/crypto/CryptoPermissions/InconsistentEntries.java - this one will need root permissions to write to the installation directory (it tries to set up custom crypto policy).

Updated Jammy debdiff removing openjdk-20 dependency (as the package is not in the archive/out of support)

Updated focal debdiff removing openjdk-20 dependency (version is out of support and not present in the archive).

Hello Vladimir, or anyone else affected,

Accepted openjdk-21 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openjdk-21/21.0.1+12-2~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Hello Vladimir, or anyone else affected,

Accepted openjdk-21 into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openjdk-21/21.0.1+12-2~20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

I have approved the jammy and focal updates. I see that the new version has a CVE included, but since those are new packages in both jammy and focal I think it's fine for this to go to just -updates (as it's like the release pocket for this package in these series).

That being said, I see that mantic's openjdk-21 does not have the 21.0.1 version. Is this being handled by security? I think we'd want to see 21.0.1 in mantic as well, for people that would install jammy and then upgrade to the latest released version: mantic.

All autopkgtests for the newly accepted openjdk-21 (21~35ea-1ubuntu1~22.04) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

jsurf-alggeo/0.4.1+ds-3 (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#openjdk-21

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

All autopkgtests for the newly accepted openjdk-21 (21~35ea-1ubuntu1~20.04) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

munin/2.0.56-1ubuntu1 (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#openjdk-21

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

21.0.1+12 jammy install/purge piuparts tests (OK).

21.0.1+12 focal install/purge piuparts test (OK)

jammy jtreg tests were run in PPA: ppa:vpa1977/openjdk-21-sru-verify-proposed[1][2][3][4][5].
focal jtreg tests were run in PPA: ppa:vpa1977/openjdk-21-sru-verify-proposed[6][7][8][9][10]

There are no regressions compared to the previous run[11] (all tests pass).

The dangling symlinks issue was worked around by installing -source and atk-wrapper packages.

The failing certificates tests were quarantined:
# exclude ca certificates test
sun/security/lib/cacerts/VerifyCACerts.java 000000 generic-all
sun/security/ssl/X509TrustManagerImpl/Symantec/Distrust.java 000000 generic-all
# tries to write into installation dir
javax/crypto/CryptoPermissions/InconsistentEntries.java 000000 generic-all

Note: the results exclude RISC-V tests

[1] https://launchpadlibrarian.net/699180711/buildlog_ubuntu-jammy-amd64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.3_BUILDING.txt.gz
[2] https://launchpadlibrarian.net/699102562/buildlog_ubuntu-jammy-arm64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.3_BUILDING.txt.gz
[3] https://launchpadlibrarian.net/699080019/buildlog_ubuntu-jammy-armhf.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.3_BUILDING.txt.gz
[4] https://launchpadlibrarian.net/699077849/buildlog_ubuntu-jammy-ppc64el.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.3_BUILDING.txt.gz
[5] https://launchpadlibrarian.net/699079311/buildlog_ubuntu-jammy-s390x.openjdk-test-21_21.0.1+12-0ubuntu1~ppa22.04.3_BUILDING.txt.gz
[6] https://launchpadlibrarian.net/699074746/buildlog_ubuntu-focal-amd64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[7] https://launchpadlibrarian.net/699098454/buildlog_ubuntu-focal-arm64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[8] https://launchpadlibrarian.net/699081628/buildlog_ubuntu-focal-armhf.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[9] https://launchpadlibrarian.net/699077755/buildlog_ubuntu-focal-ppc64el.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[10] https://launchpadlibrarian.net/699077403/buildlog_ubuntu-focal-s390x.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[11] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/55

Jammy end to end test: build and run spring petclinic[1] application (OK).

[1] https://github.com/spring-projects/spring-petclinic

Focal end to end test: build and run spring petclinic [1] (OK)

Note: using maven wrapper, because packaged maven does not work with openjdk-21 due to [2]

[1] https://github.com/spring-projects/spring-petclinic
[2] https://bugs.launchpad.net/ubuntu/+source/maven/+bug/1930541

Note: investigating focal RISC-V build failure due to the random gcc SIGSEGV

Raised: https://bugs.launchpad.net/ubuntu/+source/gcc-9/+bug/2044899

Mantic and noble seem to have openjdk-21 already, but the corresponding bug tasks are still open, did I miss something in the many comments of this bug?

$ rmadison -asource openjdk-21
 openjdk-21 | 21~14ea~us1-0ubuntu1 | lunar/universe | source
 openjdk-21 | 21+35-1 | mantic/universe | source
 openjdk-21 | 21.0.1+12-2~20.04 | focal-proposed/universe | source
 openjdk-21 | 21.0.1+12-2~22.04 | jammy-proposed/universe | source
 openjdk-21 | 21.0.1+12-2~23.04 | lunar-security/universe | source
 openjdk-21 | 21.0.1+12-2~23.04 | lunar-updates/universe | source
 openjdk-21 | 21.0.1+12-2~23.10 | mantic-security/universe | source
 openjdk-21 | 21.0.1+12-2~23.10 | mantic-updates/universe | source
 openjdk-21 | 21.0.1+12-2 | noble/universe | source

Oh, I have closed task for mantic, this bug is for focal and jammy only.
Jammy build is fine, focal will need an upload with gcc-10 most likely due to the RISCV gcc-9 crash

Noble is also released, yes? I'm marking as such, please correct it if not.

All releases since focal now have the same version, so I believe comment #70 is addressed:
$ rmadison -asource openjdk-21
 openjdk-21 | 21~14ea~us1-0ubuntu1 | lunar/universe | source
 openjdk-21 | 21+35-1 | mantic/universe | source
 openjdk-21 | 21.0.1+12-2~20.04 | focal-proposed/universe | source
 openjdk-21 | 21.0.1+12-2~22.04 | jammy-proposed/universe | source
 openjdk-21 | 21.0.1+12-2~23.04 | lunar-security/universe | source
 openjdk-21 | 21.0.1+12-2~23.04 | lunar-updates/universe | source
 openjdk-21 | 21.0.1+12-2~23.10 | mantic-security/universe | source
 openjdk-21 | 21.0.1+12-2~23.10 | mantic-updates/universe | source
 openjdk-21 | 21.0.1+12-2 | noble/universe | source

This bug was fixed in the package openjdk-21 - 21.0.1+12-2~22.04

---------------
openjdk-21 (21.0.1+12-2~22.04) jammy; urgency=medium

  * Upload to Ubuntu 22.04 (LP: #2036873).
  * d/rules: disable jtreg tests for focal and jammy. No jtreg7 backport
    yet.

 -- Vladimir Petko <email address hidden> Mon, 06 Nov 2023 16:11:20 +0200

The verification of the Stable Release Update for openjdk-21 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

gcc-10 workaround for openjdk-21 in focal.

RISC-V build crashes due to the gcc bug LP: 2044899

gcc-10 toolchain compiles the build fine[1]

jtreg test results[2]: no regressions.

Note: some RISCV tests fail, we have not looked into fixing RISCV issues yet.

[1] https://launchpad.net/~vpa1977/+archive/ubuntu/october-21-2/+sourcepub/15402628/+listing-archive-extra
[2] https://launchpad.net/~vpa1977/+archive/ubuntu/october-21-2/+sourcepub/15403033/+listing-archive-extra

Resubscribing Sponsors, as openjdk-21 21.0.1+12~20.04.1 needs to be uploaded to -proposed to resolve RISCV build failure.

Uploaded 21.0.1+12-2~20.04.1.

Hello Vladimir, or anyone else affected,

Accepted openjdk-21 into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/openjdk-21/21.0.1+12-2~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Focal jtreg tests were run in PPA: ppa:vpa1977/openjdk-sru-verify-proposed-focal
There are no regressions compared to the previous run[1] (all tests pass) [2][3][4][5][6].
Note: the results exclude RISC-V[7] that has following tests failing:
- Error: jdk/incubator/vector/VectorMaxConversionTests.java (test timeout) - in preview API
- Error: java/util/Random/RandomTestBsi1999.java (test timeout)
- Error: jdk/nio/zipfs/LargeEntriesTest.java (test timeout)

[1] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/55
[2] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065225/+files/buildlog_ubuntu-focal-amd64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[3] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065226/+files/buildlog_ubuntu-focal-arm64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[4] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065227/+files/buildlog_ubuntu-focal-armhf.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[5] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065228/+files/buildlog_ubuntu-focal-ppc64el.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[6] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065230/+files/buildlog_ubuntu-focal-s390x.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz
[7] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-sru-verify-proposed-focal/+build/27065229/+files/buildlog_ubuntu-focal-riscv64.openjdk-test-21_21.0.1+12-0ubuntu1~ppa20.04.3_BUILDING.txt.gz

openjdk-21 20.04.1 install/purge piuparts test (ok)

openjdk-21 20.04 upgrade to 22.04 piuparts test (ok)

Focal end to end test: build and run spring petclinic [1] (OK)

Note: using maven wrapper, because packaged maven does not work with openjdk-21 due to [2]

[1] https://github.com/spring-projects/spring-petclinic
[2] https://bugs.launchpad.net/ubuntu/+source/maven/+bug/1930541

[Verification summary]

Verified:
- openjdk-21 21.0.1+12-2~20.04.1

Testing:
 - Java regression test framework run on all platform [1]
 - installation and upgrade tests with piuparts [2][3]
 - end to end test (build and run spring petclinic[4] demo - a typical example of the Java web application) [5]

[1] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/90
[2] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/91
[3] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/92
[4] https://github.com/spring-projects/spring-petclinic
[5] https://bugs.launchpad.net/ubuntu/+source/openjdk-21/+bug/2036873/comments/93

Hello,

we also have been using/testing the proposed packages for focal/20.04 for a couple of weeks already in our (in house) CI setup.

Version tested:
- 21.0.1+12-2~20.04.1 (amd64)

Tested:
- Installation of openjdk-21-jdk-headless
- Running nightly builds + our full CI pipeline on top of it

Maybe this feedback is helpful to get those promoted into focal/universe.
Is there something else one can help or maybe an ETA for those reaching focal/universe?

This bug was fixed in the package openjdk-21 - 21.0.1+12-2~20.04.1

---------------
openjdk-21 (21.0.1+12-2~20.04.1) focal; urgency=medium

  * Use gcc 10 to workaround LP: #2044899.

openjdk-21 (21.0.1+12-2~20.04) focal; urgency=medium

  * Upload to Ubuntu 20.04 (LP: #2036873).
  * d/rules: disable jtreg tests for focal and jammy. No jtreg7 backport
    yet.

 -- Vladimir Petko <email address hidden> Wed, 29 Nov 2023 08:05:34 +1300