From 630539d234811d0f6c4e2d522ef74299617857e0 Mon Sep 17 00:00:00 2001 From: Ravi Singal Date: Fri, 6 Nov 2026 20:33:26 +0530 Subject: [PATCH] fix: use azul/zulu-openjdk-debian tags carrying the eMudhra blocklist fix Azul has republished 11.0.33-11.92 and 21.0.13.0.3-21.54 with the updated blocked.certs, so the temporary download from Azul's CDN (added in #56) is no longer needed. Go back to building the jlink stage from the azul/zulu-openjdk-debian image and the Docker tag style in java.version. The build-time grep of blocked.certs for the 2026-10-21 fingerprint is kept, so the build fails if a tag ever loses the fix. Verified: both tags contain the fingerprint; both images build (arm64) and pass the blocklist check. Co-Authored-By: Claude Sonnet 5.5 AI-Session-Id: 5a335e1a-d24a-4eb3-8091-8981aefc4b88 AI-Tool: claude-code AI-Model: unknown --- java-11/Dockerfile | 28 ++-------------------------- java-11/java.version | 2 +- java-21/Dockerfile | 28 ++-------------------------- java-21/java.version | 2 +- 4 files changed, 6 insertions(+), 54 deletions(-) diff --git a/java-11/Dockerfile b/java-11/Dockerfile index ea67a4a..4441a2a 100644 --- a/java-11/Dockerfile +++ b/java-11/Dockerfile @@ -1,33 +1,9 @@ -# Zulu build name, e.g. zulu11.54.107-ca-jdk11.0.13 (see java.version) ARG JAVA_VERSION ARG BASE_IMAGE -# The azul/zulu-openjdk-debian image has no tag with the eMudhra blocked.certs fix yet, so fetch the -# Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs -# from the JDK it runs, so it must be the fixed one. -# TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix. -FROM debian:trixie-slim AS jre -ARG JAVA_VERSION -ARG TARGETARCH -# Update these together with java.version. -ARG ZULU_SHA256_AMD64=64658a2be5140c2ffd571c0e09ac3b505a2be0d4654e09957b584b54b4dac8b5 -ARG ZULU_SHA256_ARM64=abed984a694d4da40662ec0bdfd2ecbe798bab1b8ce784d4f02d00479d53e802 +FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre # Needed for --strip-debug -RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils curl ca-certificates - -RUN case "${TARGETARCH}" in \ - amd64) ZULU_ARCH=x64; ZULU_SHA256="${ZULU_SHA256_AMD64}" ;; \ - arm64) ZULU_ARCH=aarch64; ZULU_SHA256="${ZULU_SHA256_ARM64}" ;; \ - *) echo "unsupported arch ${TARGETARCH}" >&2; exit 1 ;; \ - esac \ - && curl -fsSL -o /tmp/zulu.tar.gz "https://cdn.azul.com/zulu/bin/${JAVA_VERSION}-linux_${ZULU_ARCH}.tar.gz" \ - && echo "${ZULU_SHA256} /tmp/zulu.tar.gz" | sha256sum -c - \ - && mkdir -p /usr/lib/jvm \ - && tar -xzf /tmp/zulu.tar.gz -C /usr/lib/jvm \ - && ln -s "/usr/lib/jvm/${JAVA_VERSION}-linux_${ZULU_ARCH}" /usr/lib/jvm/zulu \ - && rm /tmp/zulu.tar.gz -ENV JAVA_HOME=/usr/lib/jvm/zulu -ENV PATH=${JAVA_HOME}/bin:${PATH} +RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils ca-certificates # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/ # diff --git a/java-11/java.version b/java-11/java.version index 1edb69a..1083209 100644 --- a/java-11/java.version +++ b/java-11/java.version @@ -1 +1 @@ -zulu11.92.109-ca-jdk11.0.33 \ No newline at end of file +11.0.33-11.92 diff --git a/java-21/Dockerfile b/java-21/Dockerfile index a25269d..0748987 100644 --- a/java-21/Dockerfile +++ b/java-21/Dockerfile @@ -1,33 +1,9 @@ -# Zulu build name, e.g. zulu21.54.107-ca-jdk21.0.13 (see java.version) ARG JAVA_VERSION ARG BASE_IMAGE -# The azul/zulu-openjdk-debian image has no tag with the eMudhra blocked.certs fix yet, so fetch the -# Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs -# from the JDK it runs, so it must be the fixed one. -# TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix. -FROM debian:trixie-slim AS jre -ARG JAVA_VERSION -ARG TARGETARCH -# Update these together with java.version. -ARG ZULU_SHA256_AMD64=dd8cf0628cfb8c369b7d4fe96783e2b516482b37d2b3e140b208c91deabf1169 -ARG ZULU_SHA256_ARM64=783460592bc66c9290b14c32a537b29da812bd62ad53bf6cb565355bca7ea563 +FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre # Needed for --strip-debug -RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils curl ca-certificates - -RUN case "${TARGETARCH}" in \ - amd64) ZULU_ARCH=x64; ZULU_SHA256="${ZULU_SHA256_AMD64}" ;; \ - arm64) ZULU_ARCH=aarch64; ZULU_SHA256="${ZULU_SHA256_ARM64}" ;; \ - *) echo "unsupported arch ${TARGETARCH}" >&2; exit 1 ;; \ - esac \ - && curl -fsSL -o /tmp/zulu.tar.gz "https://cdn.azul.com/zulu/bin/${JAVA_VERSION}-linux_${ZULU_ARCH}.tar.gz" \ - && echo "${ZULU_SHA256} /tmp/zulu.tar.gz" | sha256sum -c - \ - && mkdir -p /usr/lib/jvm \ - && tar -xzf /tmp/zulu.tar.gz -C /usr/lib/jvm \ - && ln -s "/usr/lib/jvm/${JAVA_VERSION}-linux_${ZULU_ARCH}" /usr/lib/jvm/zulu \ - && rm /tmp/zulu.tar.gz -ENV JAVA_HOME=/usr/lib/jvm/zulu -ENV PATH=${JAVA_HOME}/bin:${PATH} +RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils ca-certificates # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/21/docs/api/ # diff --git a/java-21/java.version b/java-21/java.version index a259b7b..03d948c 100644 --- a/java-21/java.version +++ b/java-21/java.version @@ -1 +1 @@ -zulu21.54.107-ca-jdk21.0.13 \ No newline at end of file +21.0.13.0.3-21.54