Repository navigation
Delete unwanted CA certificates in Dockerfile - #55
hibohra1398 wants to merge 8 commits into
Conversation
Remove specific CA certificates from the Java keystore.
| ARG TARGETARCH | ||
| FROM base-${TARGETARCH} | ||
|
|
||
| COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java |
There was a problem hiding this comment.
@hibohra1398 we should check certificates here.
|
@hibohra1398 file |
jlink copies cacerts from java.base.jmod, so the existing pre-jlink keytool delete never reached the runtime store, and the cacerts copied from distroless java-base still had both roots. Add a temporary emudhra-clean stage that deletes emsigneccrootcag3 and comodoaaaca from /jre and /etc/ssl/certs/java, and copy the cleaned stores into the final image. Remove once upstream ships the fix. Ref: https://openjdk.org/emudhra
…tificates out of which emSign ECC Root CA - G3 is distrusted
…}-slim/lib/security/cacerts) and Distroless Java store (/etc/ssl/certs/java/cacerts) still has three, in both images
| COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java | ||
| COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim | ||
| # TEMP: eMudhra distrust, see emudhra-clean stage above | ||
| COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts |
There was a problem hiding this comment.
why overwrite this one? it was already cleaned up in line 8-19.
There was a problem hiding this comment.
The jlink step builds /jre/lib/security/cacerts from the copy inside java.base.jmod, not from the JDK's own cacerts, so the roots would still be trusted in the final image. That is why the emudhra-clean stage deletes them from /jre and the final stage overwrites /usr/lib/jvm/zulu-*-slim/lib/security/cacerts with the cleaned file. The same stage also cleans /etc/ssl/certs/java/cacerts from distroless and /etc/ssl/certs/ca-certificates.crt from BASE_IMAGE, and the final stage overwrites both. Because of this, the earlier keytool loop above jlink only edited the Zulu JDK's own truststore, which the final image never ships, so it is redundant and removing it.
There was a problem hiding this comment.
we can then remove changes in line 8-20?
There was a problem hiding this comment.
yes already removed
Remove specific CA certificates from the Java keystore.
Summary
Remove the two Java trust anchors named in the OpenJDK eMudhra advisory from the Java 11 and Java 21 base images. keytool -delete runs in the Azul JDK stage, before jlink, so the stripped JRE ships without emsigneccrootcag3 [jdk] and comodoaaaca [jdk].
Current tags are Zulu 11.0.32.1 and 21.0.12.1, both built before the disclosure, and both still trust those roots.