Unable to run apt-get update on aws/codebuild/standard:4.0 or aws/codebuild/standard:5.0 ubuntu images. java-1.8.0-amazon-corretto-jdk:amd64 issues

[mawaldne]

Hello, I am trying to run apt-get update and its failing with:

...
[Container] 2022/04/21 20:51:10 Running command apt-get update && apt-get upgrade ca-certificates -y
...
Errors were encountered while processing:
java-1.8.0-amazon-corretto-jdk:amd64
E: Sub-process /usr/bin/dpkg returned an error code (1)

My buildspec config is pretty simple:

...
phases:
  pre_build:
    commands:
      - echo Prep started on `date`
      - docker login ...
      - docker run ...
      - apt-get update && apt-get upgrade ca-certificates -y
      - curl -sLv https://deb.nodesource.com/setup_12.x | bash -
      - apt-get install -y nodejs
      - npm install --quiet 
....

I have tried both the aws/codebuild/standard:4.0 and aws/codebuild/standard:5.0 ubuntu images on latest. The last successful build was about a week ago. So this just started showing up today. I haven't seen anything about java-1.8.0-amazon-corretto-jdk:amd64 in our previous builds. So something new is definitely happening there.

[mawaldne]

Some more details about corretto:

Setting up java-1.8.0-amazon-corretto-jdk:amd64 (1:8.332.08-1) ...
--
590 |  
591 | Configuration file '/usr/lib/jvm/java-1.8.0-amazon-corretto/jre/lib/security/policy/limited/local_policy.jar'
592 | ==> File on system created by you or by a script.
593 | ==> File also in package provided by package maintainer.
594 | What would you like to do about it ?  Your options are:
595 | Y or I  : install the package maintainer's version
596 | N or O  : keep your currently-installed version
597 | D     : show the differences between the versions
598 | Z     : start a shell to examine the situation
599 | The default action is to keep your current version.
600 | *** local_policy.jar (Y/I/N/O/D/Z) [default=N] ? dpkg: error processing package java-1.8.0-amazon-corretto-jdk:amd64 (--configure):
601 | end of file on stdin at conffile prompt

Seems like its not giving it a default action?

[mawaldne]

I have a workaround for this. I don't use java in my application and I don't need to update them. I put the libs on hold so they don't update:

...
- apt-get update && apt-mark hold java-1.8.0-amazon-corretto-jdk && apt-mark hold java-11-amazon-corretto-jdk && apt-get upgrade ca-certificates -y
...

If you do need them, you might have to install java with an option like this: apt-get install -y $PACKAGENAME --option=Dpkg::Options::=--force-confdef. I found that here.

Not sure if this can be 'fixed' upstream, or if this is just expected now?

[dtledev]

I've run into the same issue and implemented the same workaround as @mawaldne. Our builds don't run every day but the earliest I see this starting to happen was on April 19.

[willdady]

This is breaking AWS Customizations for Control Tower v2.2.0. This was working fine but builds are now failing with this error.

[dtledev]

Looks like it was fixed v2.3.0 but based on the release notes seems the solution applied there was also to pin the version.
https://github.com/aws-solutions/aws-control-tower-customizations/releases/tag/v2.3.0

[Dylan-AWS]

This issue is resolved with the latest image release. Please reopen if the issue persists