From 006982fba689b10a553f4327fa52c9461c392307 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Tue, 27 Oct 2026 08:34:32 +0000
Subject: [PATCH] [#1229] Look for java on the PATH of the caller in upgrade, before it narrows PATH to /bin:/usr/bin (#1230)
---
.github/workflows/build.yml | 9 ++++
opendj-server-legacy/resource/bin/_script-util.sh | 42 ++++++++++++--------
opendj-server-legacy/resource/upgrade | 12 ++++++
3 files changed, 46 insertions(+), 17 deletions(-)
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index af01eed..d65e40c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -711,6 +711,15 @@
test "$(docker exec test grep -c "The Directory Server is now stopped" /opt/opendj/data/logs/errors)" -gt "$stopped"
docker exec test 'sh' '-c' '/opt/opendj/bin/rebuild-index --hostname localhost --port 4444 --bindDN "cn=Directory Manager" --bindPassword password --baseDN "dc=example2,dc=com" --rebuildAll --trustAll'
docker exec test 'sh' '-c' '/opt/opendj/bin/ldapsearch --hostname localhost --port 1636 --bindDN "cn=Directory Manager" --bindPassword password --useSsl --trustAll --baseDN "ou=people,dc=example2,dc=com" --searchScope sub "(uid=user.*)" dn | grep ^dn: | wc -l | grep -q 10000'
+ # upgrade looks for java before it narrows PATH to /bin:/usr/bin, as the other tools do:
+ # the java of the default image is on the PATH from /opt/java/openjdk/bin alone (alpine has
+ # /usr/bin/java, so only the default row can fail), and run.sh runs upgrade on every start of a volume (#1229)
+ docker exec test sh -c 'unset JAVA_HOME; sh /opt/opendj/upgrade -n --force'
+ # upgrade runs set_environment_vars twice: the module flags reach the JVM once
+ docker exec test sh -c 'OPENDJ_JAVA_BIN=$(command -v java) INSTALL_ROOT=/opt/opendj INSTANCE_ROOT=/opt/opendj SCRIPT_NAME=upgrade; export OPENDJ_JAVA_BIN INSTALL_ROOT INSTANCE_ROOT SCRIPT_NAME; SCRIPT_UTIL_CMD=set-environment-vars; . /opt/opendj/lib/_script-util.sh; . /opt/opendj/lib/_script-util.sh; test "$(echo " $OPENDJ_JAVA_ARGS " | tr " " "\n" | grep -c -- "^--add-opens$")" -eq 1'
+ # a java found nowhere is reported without a shell error about the empty lookup
+ out=$(docker exec test sh -c 'unset JAVA_HOME; PATH=/bin:/usr/bin /opt/opendj/bin/ldapsearch --version' 2>&1 || true)
+ if grep -F "unexpected operator" <<<"$out"; then echo "::error::The lookup of java on the PATH fails with a shell error where it finds no java"; false; fi
docker rm -f test
- name: Docker test custom password
shell: bash
diff --git a/opendj-server-legacy/resource/bin/_script-util.sh b/opendj-server-legacy/resource/bin/_script-util.sh
index 5a4fbe3..67324ab 100644
--- a/opendj-server-legacy/resource/bin/_script-util.sh
+++ b/opendj-server-legacy/resource/bin/_script-util.sh
@@ -64,7 +64,7 @@
OPENDJ_JAVA_BIN=${PROPERTY_VALUE}/bin/java
else
TEST_JAVA_PATH=`command -v java 2> /dev/null`
- if test ! -z ${TEST_JAVA_PATH} -a -f ${TEST_JAVA_PATH}
+ if test ! -z "${TEST_JAVA_PATH}" -a -f "${TEST_JAVA_PATH}"
then
OPENDJ_JAVA_BIN=${TEST_JAVA_PATH}
elif test ! -z "${JAVA_BIN}" -a -f "${JAVA_BIN}"
@@ -248,23 +248,31 @@
SCRIPT_NAME_ARG=-Dorg.opends.server.scriptName=${SCRIPT_NAME}
export SCRIPT_NAME_ARG
- "${OPENDJ_JAVA_BIN}" --add-opens java.base/jdk.internal.loader=ALL-UNNAMED --version > /dev/null 2>&1
- RESULT_CODE=${?}
- if test ${RESULT_CODE} -eq 0
- then
- export OPENDJ_JAVA_ARGS="$OPENDJ_JAVA_ARGS --add-exports java.base/sun.security.x509=ALL-UNNAMED --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED --add-opens java.base/jdk.internal.loader=ALL-UNNAMED"
- fi
+ # upgrade runs this function again in _server-script.sh: flags already there are neither probed nor added twice
+ case " ${OPENDJ_JAVA_ARGS} " in
+ *" --add-exports java.base/sun.security.x509=ALL-UNNAMED --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED --add-opens java.base/jdk.internal.loader=ALL-UNNAMED "*) ;;
+ *)
+ "${OPENDJ_JAVA_BIN}" --add-opens java.base/jdk.internal.loader=ALL-UNNAMED --version > /dev/null 2>&1
+ RESULT_CODE=${?}
+ if test ${RESULT_CODE} -eq 0
+ then
+ export OPENDJ_JAVA_ARGS="$OPENDJ_JAVA_ARGS --add-exports java.base/sun.security.x509=ALL-UNNAMED --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED --add-opens java.base/jdk.internal.loader=ALL-UNNAMED"
+ fi
+ ;;
+ esac
- "${OPENDJ_JAVA_BIN}" --enable-native-access=ALL-UNNAMED --version > /dev/null 2>&1
- RESULT_CODE=${?}
- if test ${RESULT_CODE} -eq 0
- then
- case " ${OPENDJ_JAVA_ARGS} " in
- *" --enable-native-access=ALL-UNNAMED "*) ;;
- *) OPENDJ_JAVA_ARGS="${OPENDJ_JAVA_ARGS} --enable-native-access=ALL-UNNAMED" ;;
- esac
- export OPENDJ_JAVA_ARGS
- fi
+ case " ${OPENDJ_JAVA_ARGS} " in
+ *" --enable-native-access=ALL-UNNAMED "*) ;;
+ *)
+ "${OPENDJ_JAVA_BIN}" --enable-native-access=ALL-UNNAMED --version > /dev/null 2>&1
+ RESULT_CODE=${?}
+ if test ${RESULT_CODE} -eq 0
+ then
+ OPENDJ_JAVA_ARGS="${OPENDJ_JAVA_ARGS} --enable-native-access=ALL-UNNAMED"
+ export OPENDJ_JAVA_ARGS
+ fi
+ ;;
+ esac
}
# Configure the appropriate CLASSPATH for server, using Opend DJ logger.
diff --git a/opendj-server-legacy/resource/upgrade b/opendj-server-legacy/resource/upgrade
index 74ad098..2006980 100644
--- a/opendj-server-legacy/resource/upgrade
+++ b/opendj-server-legacy/resource/upgrade
@@ -13,6 +13,7 @@
# information: "Portions Copyright [year] [name of copyright owner]".
#
# Copyright 2013-2015 ForgeRock AS.
+# Portions Copyright 2026 3A Systems, LLC.
# This script may be used to perform a backup of a Directory Server backend.
@@ -27,6 +28,17 @@
INSTALL_ROOT=${SCRIPT_DIR}
export INSTALL_ROOT
+# Look for java on the PATH of the caller, as the other tools do, before set-environment-vars
+# narrows it to /bin:/usr/bin: _server-script.sh takes the OPENDJ_JAVA_BIN found here as it is
+SCRIPT_UTIL_CMD=set-java-home-and-args
+export SCRIPT_UTIL_CMD
+. "${INSTALL_ROOT}/lib/_script-util.sh"
+RETURN_CODE=$?
+if test ${RETURN_CODE} -ne 0
+then
+ exit ${RETURN_CODE}
+fi
+
# Set environment variables
SCRIPT_UTIL_CMD=set-environment-vars
export SCRIPT_UTIL_CMD
--
Gitblit v1.10.0