GeezerVison

Alternative to #55: bump to the fixed Zulu instead of deleting CA roots from the keystores.

Azul's out-of-cycle release of 2026-10-21 adds the compromised eMudhra intermediates to blocked.certs. azul/zulu-openjdk-debian has no tag with the fix yet (latest are 21.0.12.1 and 11.0.32.1), so this fetches the Zulu CA build from cdn.azul.com, pinned by SHA-256.

• java.version now holds the Zulu build name (zulu21.54.107-ca-jdk21.0.13, zulu11.92.109-ca-jdk11.0.33). The workflows pass it through as JAVA_VERSION unchanged.
• The jre stage is now debian:bookworm-slim plus the verified tarball (amd64 and arm64 hashes). jlink copies blocked.certs from the JDK it runs, so it has to be the fixed one.
• A build step fails if a fingerprint added by the fixed release is missing from the jlinked JRE's blocked.certs.
• Deleting roots (Delete unwanted CA certificates in Dockerfile #55) also breaks legitimate emSign and Comodo AAA chains. The blocklist rejects the compromised chains only.
• Revert to azul/zulu-openjdk-debian once a tag with the fix is published.

Bumping later means updating java.version and the two checksums in each Dockerfile together. A mismatch fails the build.

Tested by building java-11 and java-21 for linux/amd64 (under QEMU) and linux/arm64. All four builds pass, and the images report 11.0.33 (Zulu 11.92+109-CA) and 21.0.13 (Zulu 21.54+107-CA). The Trivy scan and publish workflow were not run locally.

🤖 Generated with Claude Code