* debian/postinst.in: Detect PKCS12 cacert keystore generated by
  previous ca-certificates-java and convert them to JKS. (Closes: #898678)
  (LP: #1771363)

* debian/jks-keystore.hook.in, debian/postinst.in: Only export JAVA_HOME
  and update PATH if a known jvm was found.

[ Matthias Klose ]
* debian/rules: Explicitly depend on openjdk-11-jre-headless, needed to
  configure.

* debian/jks-keystore.hook.in: don't create a jvm-*.cfg file, a default file
  with the right configuration is already supplied by the openjdk packages.

Matthias Klose authored Sep 30, 2017 and Emmanuel Bourg committed Sep 30, 2017

ca-certificates-java (20170930) unstable; urgency=medium

  * Team upload.
  * Revert the last two NMUs.
    - Depend again on openjdk-8 after the stretch release.
    - Stop fiddling around with jvm-*.cfg files. ca-certificates-java
      has no business with providing an initial cacerts file. This is
      implemented in the openjdk packages. We are not 2008 anymore.
  * Bump standards version.
  * Remove Torsten Werner as uploader.

ca-certificates-java (20170531+nmu1) unstable; urgency=high

  * Non-maintainer upload.
  * Revert to depending on openjdk-7 instead of openjdk-8, since this triggers
    a failure to dist-upgrade, due to the triggers loop (See: #864597). The
    openjdk-7 package was dropped from stretch, but the java7-runtime-headless
    alternative dependency is satisfied by openjdk-8.

first_install() is called inside an if condition and thus 'set -e' does
not cause the script to exit on failure. Replace the if condition by an
exit trap to not ignore failures (e.g. when the jvm is not found).

Closes: #822201