GeezerVison

Smaller alternative to #55 (and a stopgap next to #56): keep the current Zulu images and overlay Azul's published blocklist, per https://docs.azul.com/core/emudhra-workaround.html.

• Vendors Azul's emudhra-block-unix.certs as java-11/blocked.certs and java-21/blocked.certs.
• After jlink, each Dockerfile verifies its SHA-256 (2596bb6d…bf10) and copies it over /jre/lib/security/blocked.certs with mode 644. It has to run after jlink, which takes blocked.certs from jmods, so an overlay on the JDK before jlink would be lost.
• The file has the same 86 fingerprints as blocked.certs in Zulu 11.0.33 and 21.0.13, and is a superset of the lists in 11.0.32.1 and 21.0.12.1, so nothing is dropped.
• No base image, java.version or workflow changes, and no CA roots are deleted (unlike Delete unwanted CA certificates in Dockerfile #55). No network fetch at build time.

Limits:

• This only fixes the blocklist. Zulu 21.0.12.1 / 11.0.32.1 still lack the other fixes in the 21.0.13 / 11.0.33 PSUs, including CVE-2026-91403 (JSSE). fix: bump Zulu to 11.0.33 / 21.0.13 for eMudhra blocklist (CVE-2026-91403) #56 bumps the JDK for that.
• Temporary. Azul says to remove the overlay once on a fixed release, because it would hide later blocklist updates.

Tested by building java-11 and java-21 for linux/arm64. The hash check passes, and the installed file in each image matches Azul's hash with mode 644. amd64, the Trivy scan, and a forged-chain rejection test were not run.

🤖 Generated with Claude Code