GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Delete unwanted CA certificates in Dockerfile by hibohra1398 · Pull Request #55 · hypertrace/docker-java-base

Conversation

@hibohra1398

@hibohra1398 hibohra1398 commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

Remove specific CA certificates from the Java keystore.

Summary

Remove the two Java trust anchors named in the OpenJDK eMudhra advisory from the Java 11 and Java 21 base images. keytool -delete runs in the Azul JDK stage, before jlink, so the stripped JRE ships without emsigneccrootcag3 [jdk] and comodoaaaca [jdk].

Current tags are Zulu 11.0.32.1 and 21.0.12.1, both built before the disclosure, and both still trust those roots.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
hibohra1398 added 2 commits October 24, 2026 15:50
@hibohra1398
Delete unwanted CA certificates in Dockerfile
5f6e096 
Remove specific CA certificates from the Java keystore.
@hibohra1398
Update Dockerfile
c5fd133
vishalsinghal03
vishalsinghal03 previously approved these changes Oct 24, 2026
View reviewed changes
@hibohra1398
Update pr-build.yml
7f35565
@hibohra1398
hibohra1398 dismissed vishalsinghal03’s stale review via 7f35565 October 24, 2026 10:29
@hibohra1398
hibohra1398 requested review from JBAhire, aaron-steinfeld and kotharironak as code owners October 24, 2026 10:29
ravisingal
ravisingal reviewed Oct 24, 2026
View reviewed changes
Comment thread .github/workflows/pr-build.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.
ravisingal
ravisingal reviewed Oct 24, 2026
View reviewed changes
Comment thread java-11/Dockerfile Resolved

Uh oh!

There was an error while loading. Please reload this page.
ravisingal
ravisingal reviewed Oct 24, 2026
View reviewed changes
Comment thread java-21/Dockerfile
ARG TARGETARCH
FROM base-${TARGETARCH}

COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java

@ravisingal ravisingal Oct 24, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hibohra1398 we should check certificates here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hibohra1398
Added comment and checks
38b2f54
@hibohra1398
hibohra1398 requested a review from ravisingal October 24, 2026 11:51
@ravisingal

ravisingal commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

@hibohra1398 file /etc/ssl/certs/ca-certificates.crt contains 4 eMudhra root certificates out of which emSign ECC Root CA - G3 is distrusted. we should remove all 4 root certs.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hibohra1398 added 3 commits October 24, 2026 17:50
@hibohra1398
fix: remove eMudhra and AAA roots from java base image truststores
428879e 
jlink copies cacerts from java.base.jmod, so the existing pre-jlink
keytool delete never reached the runtime store, and the cacerts copied
from distroless java-base still had both roots.

Add a temporary emudhra-clean stage that deletes emsigneccrootcag3 and
comodoaaaca from /jre and /etc/ssl/certs/java, and copy the cleaned
stores into the final image. Remove once upstream ships the fix.

Ref: https://openjdk.org/emudhra
@hibohra1398
file /etc/ssl/certs/ca-certificates.crt containing 4 eMudhra root cer…
f0781f1 
…tificates out of which emSign ECC Root CA - G3 is distrusted
@hibohra1398
Remove additional references JVM truststore (/usr/lib/jvm/zulu-{11,21…
02714bd 
…}-slim/lib/security/cacerts) and Distroless Java store (/etc/ssl/certs/java/cacerts) still has three, in both images
ravisingal
ravisingal reviewed Oct 24, 2026
View reviewed changes
Comment thread java-11/Dockerfile
COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim
# TEMP: eMudhra distrust, see emudhra-clean stage above
COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts

@ravisingal ravisingal Oct 24, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why overwrite this one? it was already cleaned up in line 8-19.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@hibohra1398 hibohra1398 Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The jlink step builds /jre/lib/security/cacerts from the copy inside java.base.jmod, not from the JDK's own cacerts, so the roots would still be trusted in the final image. That is why the emudhra-clean stage deletes them from /jre and the final stage overwrites /usr/lib/jvm/zulu-*-slim/lib/security/cacerts with the cleaned file. The same stage also cleans /etc/ssl/certs/java/cacerts from distroless and /etc/ssl/certs/ca-certificates.crt from BASE_IMAGE, and the final stage overwrites both. Because of this, the earlier keytool loop above jlink only edited the Zulu JDK's own truststore, which the final image never ships, so it is redundant and removing it.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@ravisingal ravisingal Oct 24, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can then remove changes in line 8-20?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@hibohra1398 hibohra1398 Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes already removed

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@hibohra1398
Remove redundant update
b7a5dad
This was referenced Oct 24, 2026
fix: bump Zulu to 11.0.33 / 21.0.13 for eMudhra blocklist (CVE-2026-91403) #56
Merged
fix: apply Azul eMudhra blocklist to the jlinked JRE #57
Closed
@hibohra1398 hibohra1398 closed this Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ravisingal ravisingal ravisingal left review comments
@vishalsinghal03 vishalsinghal03 vishalsinghal03 left review comments
@aaron-steinfeld aaron-steinfeld Awaiting requested review from aaron-steinfeld
@JBAhire JBAhire Awaiting requested review from JBAhire
@kotharironak kotharironak Awaiting requested review from kotharironak

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@hibohra1398 @ravisingal @vishalsinghal03
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.