fix: unset JAVA_HOME to prevent mkcert hang#6940
Conversation
|
Download the artifacts for this pull request:
See Testing a PR. |
stasadev
left a comment
There was a problem hiding this comment.
I tested this PR with export JAVA_HOME=/usr and confirm that it works.
At first I wasn't able to reproduce the error using v1.24.2, until I renamed my ~/.ddev directory.
$ mv ~/.ddev ~/.ddev.bak
$ ddev start
Starting d11...
Building project images....
Project images built in 2s.
Network ddev-d11 Created
Container ddev-d11-db Created
Container ddev-d11-web Created
Container ddev-d11-web Started
Container ddev-d11-db Started
Failed to create certificates for project, check mkcert operation: ERROR: failed to execute "keytool -list": exit status 1
keytool error: java.lang.Exception: Keystore file does not exist:
; err=exit status 1
|
So the problem is that mkcert tries to install in the java cacerts file, and fails if there is an incorrect An ignored attempt to provide users with a clear error message was made in: If we unset -mkcert -install
+JAVA_HOME= mkcert -install |
dd74b18 to
b470567
Compare
|
Based on what I found, it doesn't seem right to completely unset This way, we ensure DDEV continues to work without HTTPS, even if the user has a broken |
|
Thank you, and congratulations on reproducing the problem too! |
|
The one thing about the approach here is that we could in fact have turned off JAVA_HOME for DDEV's use, even though people might use it for other things outside of DDEV, true? |
|
Yes, I think there may be some edge cases, and turning |
78451e2 to
294f200
Compare
stasadev
left a comment
There was a problem hiding this comment.
After another round of testing and exploring mkcert source code, I can say, that unsetting JAVA_HOME is enough, it's simple, and doesn't require any maintenance.
export JAVA_HOME=$(readlink -f /usr/bin/javac | sed "s:/bin/javac::")
# JAVA_HOME=/usr/lib/jvm/java-23-openjdk for me on Arch
mkcert -install
Created a new local CA 💥
The local CA is now installed in the system trust store! ⚡
The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)! 🦊
The local CA is already installed in Java's trust store! 👍
mkcert uses all available stores, and we simply don't need Java store in DDEV, it'll fallback to a different available store.
The Issue
In very occasional cases, JAVA_HOME may be set incorrectly, leading to failure or hang of the
mkcertcommand, which is used to create trusted certs. Examples in https://stackoverflow.com/questions/78865612/ddev-mkcert-install-fails-or-hangs-when-java-home-misconfiguredHow This PR Solves The Issue
Disables
mkcertifJAVA_HOMEis incorrect.mkcertfails to run ifJAVA_HOMEis set, and$JAVA_HOME/lib/security/cacertsor$JAVA_HOME/jre/lib/security/cacertsis not found.Manual Testing Instructions
Set JAVA_HOME to something that causes failure. Try
ddev start, it should work with this PR, and fail with v1.24.2:Automated Testing Overview
Release/Deployment Notes