Until the RFP (Request For Packaging) bug for karaf in the debian bug tracker is resolved, here is an APT archive with a karaf package for debian (architecture “all”). The package is created using native debian packaging tools, and built from a source tarball and the APT archive itself is created, using aptly.
The package has been tested on Debian 9 “stretch” (the current stable), amd64.
Do the following commands as root on a debian GNU/linux system:
- Add the keys for the APT archive (Edit: needed to sign with the first key in the keyring because of an aptly bug, must add this key as well, if using the repository)
wget -O - https://apt.bang.priv.no/apt_pub.gpg | apt-key add - wget -O - https://apt.bang.priv.no/maven_pub.gpg | apt-key add -
- Open the /etc/apt/sources.list file in a text editor, and add the following lines:
# APT archive for apache karaf deb http://apt.bang.priv.no/public stable main
- Install karaf with apt-get
apt-get update apt-get install openjdk-8-jdk karaf
- Log in with SSH (password is “karaf” (without the quotes)) and try giving some commands:
ssh -p 8101 karaf@localhost
Steinar Bangs blogg 
Note! Because the home directory of the karaf user has been changed to satisfy lintian it is recommended to purge karaf and reinstall, if you’re currently on karaf 4.1.4-8~9.30.
To purge, do the following as root:
Karaf 4.1.7 has been packaged and deployed to the repository.
This will probably be the last 4.1.x version I’ll package. I plan to package a 4.2.x version as the next version of the debian package.
Karaf 4.2.6 has been packaged and deployed to the repository.
I have tested that the packaged karaf runs with both openjdk-8 and openjdk-11.
Note that even though the package can be upgraded from 4.1.x with “apt-get dist-upgrade”, the old /etc/karaf/host.key won’t work, and need to be removed and karaf restarted before ssh can be used.
Karaf 4.2.8 has been packaged and deployed to the repository.
The package has been testet with openjdk-11.
Note! I needed to sign with a different gpg key because of an aptly bug, so this key must be added to apt. I have added install of maven_pub.gpg to the apt-key command example in the blog post above
Note2! There is a bug in karaf 4.2.8 that makes paste not work in an ssh login. This means that e..g. copy/pasting in config examples and install command examples does not work in karaf 4.2.8
Karaf 4.2.9 has been packaged and deployed to the repository.
The package has been testet with openjdk-11 on debian 10.5 “buster” on amd64.
Note! The release have been signed with the same key as karaf 4.2.8. If you added this key to apt with 4.2.8 you don’t’ have to do anything, but if not the key must be added (adding the key is part of the apt-key command example of the blog post).
karaf 4.3.0 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 10.9 “buster” on amd64
karaf 4.3.2 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 10.9 “buster” on amd64
Note on this release: karaf 4.3.2 comes with a users.properties file with the users and groups commented out and the .deb package will replace your /etc/karaf/users.properties with this file. And with users and groups in users.properties commented out it will not be possible to ssh in.
So you will need to either not let the .deb package replace your users.properties file or fix the one the .deb package puts in after the install.
karaf 4.3.3 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 11.1 “bullseye” on amd64.
When upgrading from 4.3.2, the config.properties files is seen as modified by user. Just pick the maintainer’s version.
There was no need to modify config files to re-open ssh after the upgrade. Don’t know if this means the defaults have changed on karaf, or if my modifications in the previous comment was preserved…?
karaf 4.3.4 has been packaged and deployed to the repository.
This version fixes the log4j vulnerability issue
The package has been tested with openjdk-11 on debian 11.2 “bullseye” on amd64.
When upgrading from 4.3.3, the config.properties files is seen as modified by user. Just pick the maintainer’s version.
karaf 4.3.5 has been packaged and deployed to the repository.
More logging fixes wrt karaf 4.3.4:
– with logback 1.2.9 upgrade, fixing CVE-2021-42550
– with log4j 2.17.0 upgrade, fixing CVE-2021-45105
The package has been tested with openjdk-11 on debian 11.2 “bullseye” on amd64.
When upgrading from 4.3.4, the config.properties files is seen as modified by user. Just pick the maintainer’s version.
karaf 4.3.6 has been packaged and deployed to the repository.
Important fixes wrt karaf 4.3.5:
– upgrade to Pax Logging 2.0.14 with log4j 2.17.1 (fixing CVE-2021-44832)
– fix deployment issue by upgrading to Apache Felix FileInstall 3.7.4
In addition, the embedded OSGi framework has been replaced with a dependency on the debian packaged OSGi framework, since the debian packaged OSGi framwork is version 7 in the current debian stable (11.2 “bullseye”).
The package has been tested with openjdk-11 on debian 11.2 “bullseye” on amd64.
When upgrading from 4.3.5, the config.properties files is seen as modified by user. Just pick the maintainer’s version.
karaf 4.3.7 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 11.3 “bullseye” on amd64.
When upgrading from 4.3.6, the config.properties files is seen as modified by user. Just pick the maintainer’s version.
karaf 4.4.0 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 11.3 “bullseye” on amd64.
This version uses OSGi 8 and pax-web 8.0.x and pax logging 2.1.x,
Note: this version uses an embedded OSGi framework, since the debian-packaged OSGi framework is still OSGi 7.
Note2: if pax-web won’t start, check that the settings in /etc/karaf/org.ops4j.pax.web.cfg refer to files in /etc/karaf/ rather than /usr/local/karaf/etc/, and edit org.ops4j.pax.web.cfg and restart karaf, if the settings need to be changed.
karaf 4.4.1 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 11.4 “bullseye” on amd64.
Maintenance update to karaf 4.4.1 (upgrade to Pax Web 8.0.6, Pax URL 2.6.11, Pax Logging 2.1.3).
karaf 4.4.2 has been packaged and deployed to the repository.
The package has been tested with openjdk-11 on debian 11.5 “bullseye” on amd64.
Karaf 4.4.3 was been packaged and deployed to to the repository, January 21 2023.
Karaf4.4.3 has been running both with openjdk-11 on debian 11 and openjdk-17 on debian 12.
It was replaced by Karaf 4.4.4 on October 28 2023, when karaf 4.4.4 was packaged as a debian package and replaced to the repository.
The karaf 4.4.4 package has been testet on openjdk-17 on debian 12.2 “bookworm” on amd64, but should in theory work on debian 12 on all architectures.
karaf 4.4.5 has been packaged and deployed to the repository at maven.bang.priv.no.
The package has been tested with openjdk-17 on debian 12.4 “bookworm” on amd64.