diff -Nru ca-certificates-java-20160321/debian/changelog ca-certificates-java-20161107/debian/changelog
--- ca-certificates-java-20160321/debian/changelog	2016-03-21 13:34:49.000000000 +0000
+++ ca-certificates-java-20161107/debian/changelog	2016-11-07 12:45:23.000000000 +0000
@@ -1,3 +1,12 @@
+ca-certificates-java (20161107) unstable; urgency=medium
+
+  * Team upload.
+  * postinst: Use exit trap instead of if condition to not fail silently
+    (e.g. in case the java binary is not found) (Closes: #822201)
+  * Bump Standards-Version to 3.9.8 (no changes)
+
+ -- Benjamin Drung <benjamin.drung@profitbricks.com>  Mon, 07 Nov 2016 13:45:23 +0100
+
 ca-certificates-java (20160321) unstable; urgency=medium
 
   * Team upload.
diff -Nru ca-certificates-java-20160321/debian/control ca-certificates-java-20161107/debian/control
--- ca-certificates-java-20160321/debian/control	2016-03-21 13:33:54.000000000 +0000
+++ ca-certificates-java-20161107/debian/control	2016-11-07 12:41:49.000000000 +0000
@@ -7,7 +7,7 @@
            Damien Raude-Morvan <drazzib@debian.org>,
            James Page <james.page@ubuntu.com>
 Build-Depends: debhelper (>= 9), default-jdk, javahelper, junit4
-Standards-Version: 3.9.7
+Standards-Version: 3.9.8
 Vcs-Svn: svn://anonscm.debian.org/pkg-java/trunk/ca-certificates-java
 Vcs-Browser: https://anonscm.debian.org/viewvc/pkg-java/trunk/ca-certificates-java/
 
diff -Nru ca-certificates-java-20160321/debian/postinst.in ca-certificates-java-20161107/debian/postinst.in
--- ca-certificates-java-20160321/debian/postinst.in	2016-03-21 13:22:05.000000000 +0000
+++ ca-certificates-java-20161107/debian/postinst.in	2016-11-07 12:29:56.000000000 +0000
@@ -1,5 +1,4 @@
 #!/bin/bash
-
 set -e
 
 # use the locale C.UTF-8
@@ -43,12 +42,12 @@
 first_install()
 {
     if which dpkg-query >/dev/null; then
-    nsspkg=$(dpkg-query -L "$(nsslib_name)" | sed -n 's,\(.*\)/libnss3\.so$,\1,p'|head -n 1)
-    nsscfg=/etc/${jvm%-$arch}/security/nss.cfg
-    nssjdk=$(test ! -f $nsscfg || sed -n '/nssLibraryDirectory/s/.*= *\(.*\)/\1/p' $nsscfg)
-    if [ -n "$nsspkg" ] && [ -n "$nssjdk" ] && [ "$nsspkg" != "$nssjdk" ]; then
-        ln -sf $nsspkg/libnss3.so $nssjdk/libnss3.so
-    fi
+        nsspkg=$(dpkg-query -L "$(nsslib_name)" | sed -n 's,\(.*\)/libnss3\.so$,\1,p'|head -n 1)
+        nsscfg=/etc/${jvm%-$arch}/security/nss.cfg
+        nssjdk=$(test ! -f $nsscfg || sed -n '/nssLibraryDirectory/s/.*= *\(.*\)/\1/p' $nsscfg)
+        if [ -n "$nsspkg" ] && [ -n "$nssjdk" ] && [ "$nsspkg" != "$nssjdk" ]; then
+            ln -sf $nsspkg/libnss3.so $nssjdk/libnss3.so
+        fi
     fi
 
     # Forcibly remove diginotar cert (LP: #920758)
@@ -59,8 +58,8 @@
 
     find /etc/ssl/certs -name \*.pem | \
     while read filename; do
-    alias=$(basename $filename .pem | tr A-Z a-z | tr -cs a-z0-9 _)
-    alias=${alias%*_}
+        alias=$(basename $filename .pem | tr A-Z a-z | tr -cs a-z0-9 _)
+        alias=${alias%*_}
         if [ -n "$FIXOLD" ]; then
             echo "-${alias}"
             echo "-${alias}_pem"
@@ -89,29 +88,25 @@
             fi
         fi
         if [ -z "$2" -o -n "$FIXOLD" ]; then
-        setup_path
+            setup_path
 
-        if ! mountpoint -q /proc; then
-        echo >&2 "the keytool command requires a mounted proc fs (/proc)."
-        exit 1
-        fi
+            if ! mountpoint -q /proc; then
+                echo >&2 "the keytool command requires a mounted proc fs (/proc)."
+                exit 1
+            fi
 
-        temp_jvm_cfg=
-        if [ ! -f /etc/${jvm%-$arch}/jvm-$arch.cfg ]; then
-            # the jre is not yet configured, but jvm.cfg is needed to run it
-            temp_jvm_cfg=/etc/${jvm%-$arch}/jvm-$arch.cfg
-            mkdir -p /etc/${jvm%-$arch}
-            printf -- "-server KNOWN\n" > $temp_jvm_cfg
-        fi
+            temp_jvm_cfg=
+            if [ ! -f /etc/${jvm%-$arch}/jvm-$arch.cfg ]; then
+                # the jre is not yet configured, but jvm.cfg is needed to run it
+                temp_jvm_cfg=/etc/${jvm%-$arch}/jvm-$arch.cfg
+                mkdir -p /etc/${jvm%-$arch}
+                printf -- "-server KNOWN\n" > $temp_jvm_cfg
+            fi
 
-        if first_install; then
-        do_cleanup
-        else
-        do_cleanup
-        exit 1
+            trap do_cleanup EXIT
+            first_install
         fi
-    fi
-    chmod 600 /etc/default/cacerts || true
+        chmod 600 /etc/default/cacerts || true
     ;;
 
     abort-upgrade|abort-remove|abort-deconfigure)
@@ -126,5 +121,3 @@
 #DEBHELPER#
 
 exit 0
-
-