[ravisingal]

Summary

• Azul has republished 11.0.33-11.92 and 21.0.13.0.3-21.54 with the updated blocked.certs, so the temporary Azul CDN download from fix: bump Zulu to 11.0.33 / 21.0.13 for eMudhra blocklist (CVE-2026-91403) #56 is no longer needed.
• The jre stage goes back to FROM azul/zulu-openjdk-debian:${JAVA_VERSION}. The CDN download, the SHA-256 pins and curl are removed.
• java.version goes back to the Docker tag format.
• The build-time grep for the 7BA62FEC… fingerprint in blocked.certs is kept, so the build fails if a tag ever loses the fix.

Verification

• Both tags exist on Docker Hub for amd64 and arm64, and blocked.certs in each contains the 7BA62FEC… fingerprint.
• Both images build for arm64 and pass the blocklist check. amd64 was not built locally.
• Scanned with grype and trivy (OS packages): only base-image findings. These are 3 HIGH libc6 CVEs that Debian marks won't-fix, plus zlib1g and busybox findings. Nothing comes from the Zulu change.

Notes

• publish.yml is unchanged. With the new format, the Java 21 full-version tag becomes hypertrace/java:21.0.13.0.3 rather than 21.0.13, and the ca-jdk branch there is now unused.
• The Azul base is a mutable tag again (the CDN download was SHA-pinned). Pinning it by digest would be a sensible follow-up.

🤖 Generated with Claude Code