fix: move base images to distroless cc-debian13

Debian 12 (bookworm) is approaching the end of its full-support window, so
move the runtime base for both Java images to gcr.io/distroless/cc-debian13.

The helper stages move to trixie alongside it so the JRE and jemalloc are
built against the same glibc (2.41) as the runtime base, and the SSL stage
moves to java-base-debian13 so the Java cacerts come from a matching release.

cc-debian13 already ships zlib (libz.so.1 -> libz.so.1.3.1), unlike
cc-debian12, so copying libz in from the build stage is no longer needed.
Replace it with an assertion that the base still provides the library, left
unversioned so a routine zlib patch bump does not break the weekly
update-docker-args PR.

Verified by building both images on amd64 and arm64: java 11.0.33 and
21.0.13 start, jemalloc preloads, cacerts are present, and the eMudhra
blocked.certs entry survives jlink.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ravisingal

.github/workflows/update-docker-args.yml

@@ -17,7 +17,7 @@ jobs:
         shell: bash
         id: args
         run: |
-          BASE_IMAGE="gcr.io/distroless/cc-debian12"
+          BASE_IMAGE="gcr.io/distroless/cc-debian13"
           BASE_IMAGE_TAG="debug"
           BASE_IMAGE_DIGEST=$(gcloud container images list-tags $BASE_IMAGE --format json | jq --arg tag "$BASE_IMAGE_TAG" -r '.[] | {digest: .digest, tag: .tags[]} | select(.tag == $tag) | .digest')
           if [ -n "$BASE_IMAGE_DIGEST" ]; then

java-11/Dockerfile

@@ -5,7 +5,7 @@ ARG BASE_IMAGE
 # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
 # from the JDK it runs, so it must be the fixed one.
 # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:bookworm-slim AS jre
+FROM debian:trixie-slim AS jre
 ARG JAVA_VERSION
 ARG TARGETARCH
 # Update these together with java.version.
@@ -73,9 +73,9 @@ jdk.zipfs\
 RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs
 
 # Extract java SSL certs
-FROM gcr.io/distroless/java-base-debian12:debug AS ssl
+FROM gcr.io/distroless/java-base-debian13:debug AS ssl
 
-FROM debian:bookworm-slim As builder
+FROM debian:trixie-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
 # stage for amd64
@@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/x86_64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/
@@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/aarch64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/

java-11/base.image

@@ -1 +1 @@
-gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154
+gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234

java-21/Dockerfile

@@ -5,7 +5,7 @@ ARG BASE_IMAGE
 # Zulu CA build straight from Azul's CDN. The SHA-256 pins the download. jlink copies blocked.certs
 # from the JDK it runs, so it must be the fixed one.
 # TEMP: go back to azul/zulu-openjdk-debian once it publishes a tag with the fix.
-FROM debian:bookworm-slim AS jre
+FROM debian:trixie-slim AS jre
 ARG JAVA_VERSION
 ARG TARGETARCH
 # Update these together with java.version.
@@ -73,9 +73,9 @@ jdk.zipfs\
 RUN grep -q 7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2 /jre/lib/security/blocked.certs
 
 # Extract java SSL certs
-FROM gcr.io/distroless/java-base-debian12:debug AS ssl
+FROM gcr.io/distroless/java-base-debian13:debug AS ssl
 
-FROM debian:bookworm-slim AS builder
+FROM debian:trixie-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
 # stage for amd64
@@ -84,8 +84,8 @@ FROM ${BASE_IMAGE} AS base-amd64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/x86_64-linux-gnu/libz.so.1.2.13 /lib/x86_64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/x86_64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/x86_64-linux-gnu/libjemalloc* /usr/lib/x86_64-linux-gnu/
@@ -97,8 +97,8 @@ FROM ${BASE_IMAGE} AS base-arm64
 SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-COPY --from=jre /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1.2.13
-RUN ln -s /lib/aarch64-linux-gnu/libz.so.1.2.13 /lib/aarch64-linux-gnu/libz.so.1
+# libz.so.1 is already present in the base image
+RUN test -e /lib/aarch64-linux-gnu/libz.so.1
 
 # change default memory allocator to jemalloc
 COPY --from=builder /usr/lib/aarch64-linux-gnu/libjemalloc* /usr/lib/aarch64-linux-gnu/

java-21/base.image

@@ -1 +1 @@
-gcr.io/distroless/cc-debian12:debug@sha256:bc3546a529388660b583cc85ca6559927652d54391dc8059419d7b4bf3921154
+gcr.io/distroless/cc-debian13:debug@sha256:8eb229dfe1ec97410a495e312dfba214afd86bfc72010973e08796ac5e94e234