From 5f6e096c01ca40eb97d2d8ae62243b072e5981f9 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:50:16 +0530
Subject: [PATCH 1/8] Delete unwanted CA certificates in Dockerfile

Remove specific CA certificates from the Java keystore.
---
 java-21/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index a452763..763a29f 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -5,6 +5,9 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
+RUN keytool -delete -cacerts -storepass changeit -alias "emsigneccrootcag3 [jdk]" \
+ && keytool -delete -cacerts -storepass changeit -alias "comodoaaaca [jdk]"
+
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/21/docs/api/
 #
 # jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to

From c5fd133e223029a92ed026a51cbf0f3f7baf5024 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:52:11 +0530
Subject: [PATCH 2/8] Update Dockerfile

---
 java-11/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 77a9be7..82d71c7 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -5,6 +5,9 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
+RUN keytool -delete -cacerts -storepass changeit -alias "emsigneccrootcag3 [jdk]" \
+ && keytool -delete -cacerts -storepass changeit -alias "comodoaaaca [jdk]"
+
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
 #
 # jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to

From 7f35565cb5ff42f4c5b5d4540f2ce5c8252340af Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:59:29 +0530
Subject: [PATCH 3/8] Update pr-build.yml

---
 .github/workflows/pr-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 407a093..fd33b8b 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -49,7 +49,7 @@ jobs:
           load: true
 
       - name: Scan java-${{ matrix.java-major-version}} image
-        uses: hypertrace/github-actions/trivy-image-scan@main
+        uses: hypertrace/github-actions/trivy-image-scan@change-source-ghcr
         with:
           image: hypertrace/java-build
           tag: ${{ matrix.java-major-version}}

From 38b2f54ec8b0adb34be6d6584125e56668d88917 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:20:52 +0530
Subject: [PATCH 4/8] Added comment and checks

---
 .github/workflows/pr-build.yml |  2 +-
 java-11/Dockerfile             | 14 ++++++++++++--
 java-21/Dockerfile             | 14 ++++++++++++--
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index fd33b8b..407a093 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -49,7 +49,7 @@ jobs:
           load: true
 
       - name: Scan java-${{ matrix.java-major-version}} image
-        uses: hypertrace/github-actions/trivy-image-scan@change-source-ghcr
+        uses: hypertrace/github-actions/trivy-image-scan@main
         with:
           image: hypertrace/java-build
           tag: ${{ matrix.java-major-version}}
diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 82d71c7..4193bdf 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -5,8 +5,18 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
-RUN keytool -delete -cacerts -storepass changeit -alias "emsigneccrootcag3 [jdk]" \
- && keytool -delete -cacerts -storepass changeit -alias "comodoaaaca [jdk]"
+# Remove the eMudhra and Comodo CA certificates from the default JDK truststore
+# as described in https://openjdk.org/emudhra.
+# Check whether each alias exists before deletion to ensure compatibility with
+# future JDK versions where these certificates may no longer be present.
+
+RUN for alias in "emsigneccrootcag3 [jdk]" "comodoaaaca [jdk]"; do \
+    if keytool -list -cacerts -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+      keytool -delete -cacerts -storepass changeit -alias "$alias"; \
+    else \
+      echo "Certificate alias '$alias' not found; skipping deletion."; \
+    fi; \
+done
 
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
 #
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index 763a29f..ebfaea9 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -5,8 +5,18 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
-RUN keytool -delete -cacerts -storepass changeit -alias "emsigneccrootcag3 [jdk]" \
- && keytool -delete -cacerts -storepass changeit -alias "comodoaaaca [jdk]"
+# Remove the eMudhra and Comodo CA certificates from the default JDK truststore
+# as described in https://openjdk.org/emudhra.
+# Check whether each alias exists before deletion to ensure compatibility with
+# future JDK versions where these certificates may no longer be present.
+
+RUN for alias in "emsigneccrootcag3 [jdk]" "comodoaaaca [jdk]"; do \
+    if keytool -list -cacerts -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+      keytool -delete -cacerts -storepass changeit -alias "$alias"; \
+    else \
+      echo "Certificate alias '$alias' not found; skipping deletion."; \
+    fi; \
+done
 
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/21/docs/api/
 #

From 428879ee689c59ed10aa55d78271615af894c117 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:50:37 +0530
Subject: [PATCH 5/8] fix: remove eMudhra and AAA roots from java base image
 truststores

jlink copies cacerts from java.base.jmod, so the existing pre-jlink
keytool delete never reached the runtime store, and the cacerts copied
from distroless java-base still had both roots.

Add a temporary emudhra-clean stage that deletes emsigneccrootcag3 and
comodoaaaca from /jre and /etc/ssl/certs/java, and copy the cleaned
stores into the final image. Remove once upstream ships the fix.

Ref: https://openjdk.org/emudhra
---
 java-11/Dockerfile | 23 +++++++++++++++++++++++
 java-21/Dockerfile | 23 +++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 4193bdf..6bf674b 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -60,6 +60,26 @@ jdk.zipfs\
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
+# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
+# Remove this stage and the two "COPY --from=emudhra-clean" lines in the final image once
+# the Zulu JDK and the distroless java-base image no longer ship these roots.
+# jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
+# reach /jre. The distroless store uses subject DN aliases and has no keytool.
+FROM jre AS emudhra-clean
+COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+RUN for entry in \
+    "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
+    "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
+    "/etc/ssl/certs/java/cacerts|cn=emsign ecc root ca - g3,o=emudhra technologies limited,ou=emsign pki,c=in" \
+    "/etc/ssl/certs/java/cacerts|cn=aaa certificate services,o=comodo ca limited,l=salford,st=greater manchester,c=gb"; do \
+    store="${entry%%|*}"; alias="${entry#*|}"; \
+    if keytool -list -keystore "$store" -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+      keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
+    else \
+      echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
+    fi; \
+done
+
 FROM debian:bookworm-slim As builder
 RUN apt update && apt install -y libjemalloc-dev
 
@@ -95,6 +115,9 @@ FROM base-${TARGETARCH}
 
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim
+# TEMP: eMudhra distrust, see emudhra-clean stage above
+COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
 
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/jfr /usr/bin/jfr
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index ebfaea9..3f2e58e 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -60,6 +60,26 @@ jdk.zipfs\
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
+# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
+# Remove this stage and the two "COPY --from=emudhra-clean" lines in the final image once
+# the Zulu JDK and the distroless java-base image no longer ship these roots.
+# jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
+# reach /jre. The distroless store uses subject DN aliases and has no keytool.
+FROM jre AS emudhra-clean
+COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+RUN for entry in \
+    "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
+    "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
+    "/etc/ssl/certs/java/cacerts|cn=emsign ecc root ca - g3,o=emudhra technologies limited,ou=emsign pki,c=in" \
+    "/etc/ssl/certs/java/cacerts|cn=aaa certificate services,o=comodo ca limited,l=salford,st=greater manchester,c=gb"; do \
+    store="${entry%%|*}"; alias="${entry#*|}"; \
+    if keytool -list -keystore "$store" -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+      keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
+    else \
+      echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
+    fi; \
+done
+
 FROM debian:bookworm-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
 
@@ -95,6 +115,9 @@ FROM base-${TARGETARCH}
 
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=jre /jre /usr/lib/jvm/zulu-21-slim
+# TEMP: eMudhra distrust, see emudhra-clean stage above
+COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-21-slim/lib/security/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
 
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/jfr /usr/bin/jfr

From f0781f155a2b7b85985e512fbec4fc68d09b9a14 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:54:59 +0530
Subject: [PATCH 6/8] file /etc/ssl/certs/ca-certificates.crt containing 4
 eMudhra root certificates out of which emSign ECC Root CA - G3 is distrusted

---
 java-11/Dockerfile | 15 +++++++++++++++
 java-21/Dockerfile | 15 +++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 6bf674b..b9d0e0b 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -65,8 +65,12 @@ FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 # the Zulu JDK and the distroless java-base image no longer ship these roots.
 # jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
 # reach /jre. The distroless store uses subject DN aliases and has no keytool.
+# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
+FROM ${BASE_IMAGE} AS base-ca
+
 FROM jre AS emudhra-clean
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 RUN for entry in \
     "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
     "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
@@ -79,6 +83,16 @@ RUN for entry in \
       echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
     fi; \
 done
+# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
+# matched by subject.
+RUN mkdir /tmp/ca && cd /tmp/ca \
+    && awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
+    && for f in c*.pem; do \
+      if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
+        echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
+      fi; \
+    done \
+    && cat c*.pem > /etc/ssl/certs/ca-certificates.crt
 
 FROM debian:bookworm-slim As builder
 RUN apt update && apt install -y libjemalloc-dev
@@ -118,6 +132,7 @@ COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim
 # TEMP: eMudhra distrust, see emudhra-clean stage above
 COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts
 COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/jfr /usr/bin/jfr
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index 3f2e58e..b65160c 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -65,8 +65,12 @@ FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 # the Zulu JDK and the distroless java-base image no longer ship these roots.
 # jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
 # reach /jre. The distroless store uses subject DN aliases and has no keytool.
+# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
+FROM ${BASE_IMAGE} AS base-ca
+
 FROM jre AS emudhra-clean
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
+COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 RUN for entry in \
     "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
     "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
@@ -79,6 +83,16 @@ RUN for entry in \
       echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
     fi; \
 done
+# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
+# matched by subject.
+RUN mkdir /tmp/ca && cd /tmp/ca \
+    && awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
+    && for f in c*.pem; do \
+      if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
+        echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
+      fi; \
+    done \
+    && cat c*.pem > /etc/ssl/certs/ca-certificates.crt
 
 FROM debian:bookworm-slim AS builder
 RUN apt update && apt install -y libjemalloc-dev
@@ -118,6 +132,7 @@ COPY --from=jre /jre /usr/lib/jvm/zulu-21-slim
 # TEMP: eMudhra distrust, see emudhra-clean stage above
 COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-21-slim/lib/security/cacerts
 COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
+COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/java /usr/bin/java
 RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/jfr /usr/bin/jfr

From 02714bd8db0f3dd23f869ede39c6907b76cab885 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:00:44 +0530
Subject: [PATCH 7/8] Remove additional references JVM truststore
 (/usr/lib/jvm/zulu-{11,21}-slim/lib/security/cacerts) and Distroless Java
 store (/etc/ssl/certs/java/cacerts) still has three, in both images

---
 java-11/Dockerfile | 24 ++++++++++++------------
 java-21/Dockerfile | 24 ++++++++++++------------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index b9d0e0b..6dc4686 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -61,8 +61,9 @@ jdk.zipfs\
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
 # TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
-# Remove this stage and the two "COPY --from=emudhra-clean" lines in the final image once
-# the Zulu JDK and the distroless java-base image no longer ship these roots.
+# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
+# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
+# these roots.
 # jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
 # reach /jre. The distroless store uses subject DN aliases and has no keytool.
 # The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
@@ -71,17 +72,16 @@ FROM ${BASE_IMAGE} AS base-ca
 FROM jre AS emudhra-clean
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-RUN for entry in \
-    "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
-    "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
-    "/etc/ssl/certs/java/cacerts|cn=emsign ecc root ca - g3,o=emudhra technologies limited,ou=emsign pki,c=in" \
-    "/etc/ssl/certs/java/cacerts|cn=aaa certificate services,o=comodo ca limited,l=salford,st=greater manchester,c=gb"; do \
-    store="${entry%%|*}"; alias="${entry#*|}"; \
-    if keytool -list -keystore "$store" -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
+# subject, aliases differ between the two stores).
+RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
+    keytool -list -v -keystore "$store" -storepass changeit \
+      | awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
+      > /tmp/aliases; \
+    while IFS= read -r alias; do \
+      echo "Removing '$alias' from $store"; \
       keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
-    else \
-      echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
-    fi; \
+    done < /tmp/aliases; \
 done
 # Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
 # matched by subject.
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index b65160c..e60a1ac 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -61,8 +61,9 @@ jdk.zipfs\
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
 # TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
-# Remove this stage and the two "COPY --from=emudhra-clean" lines in the final image once
-# the Zulu JDK and the distroless java-base image no longer ship these roots.
+# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
+# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
+# these roots.
 # jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
 # reach /jre. The distroless store uses subject DN aliases and has no keytool.
 # The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
@@ -71,17 +72,16 @@ FROM ${BASE_IMAGE} AS base-ca
 FROM jre AS emudhra-clean
 COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
 COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-RUN for entry in \
-    "/jre/lib/security/cacerts|emsigneccrootcag3 [jdk]" \
-    "/jre/lib/security/cacerts|comodoaaaca [jdk]" \
-    "/etc/ssl/certs/java/cacerts|cn=emsign ecc root ca - g3,o=emudhra technologies limited,ou=emsign pki,c=in" \
-    "/etc/ssl/certs/java/cacerts|cn=aaa certificate services,o=comodo ca limited,l=salford,st=greater manchester,c=gb"; do \
-    store="${entry%%|*}"; alias="${entry#*|}"; \
-    if keytool -list -keystore "$store" -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
+# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
+# subject, aliases differ between the two stores).
+RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
+    keytool -list -v -keystore "$store" -storepass changeit \
+      | awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
+      > /tmp/aliases; \
+    while IFS= read -r alias; do \
+      echo "Removing '$alias' from $store"; \
       keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
-    else \
-      echo "Certificate alias '$alias' not found in $store; skipping deletion."; \
-    fi; \
+    done < /tmp/aliases; \
 done
 # Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
 # matched by subject.

From b7a5dad58ff29f066529931b7c244dda16ee6e76 Mon Sep 17 00:00:00 2001
From: Himanshu Bohra <113414131+hibohra1398@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:15:06 +0530
Subject: [PATCH 8/8] Remove redundant update

---
 java-11/Dockerfile | 17 ++---------------
 java-21/Dockerfile | 17 ++---------------
 2 files changed, 4 insertions(+), 30 deletions(-)

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 6dc4686..3fe7fbd 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -5,19 +5,6 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
-# Remove the eMudhra and Comodo CA certificates from the default JDK truststore
-# as described in https://openjdk.org/emudhra.
-# Check whether each alias exists before deletion to ensure compatibility with
-# future JDK versions where these certificates may no longer be present.
-
-RUN for alias in "emsigneccrootcag3 [jdk]" "comodoaaaca [jdk]"; do \
-    if keytool -list -cacerts -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
-      keytool -delete -cacerts -storepass changeit -alias "$alias"; \
-    else \
-      echo "Certificate alias '$alias' not found; skipping deletion."; \
-    fi; \
-done
-
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/11/docs/api/
 #
 # jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to
@@ -64,8 +51,8 @@ FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 # Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
 # final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
 # these roots.
-# jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
-# reach /jre. The distroless store uses subject DN aliases and has no keytool.
+# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
+# The distroless store uses subject DN aliases and has no keytool.
 # The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
 FROM ${BASE_IMAGE} AS base-ca
 
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index e60a1ac..dc112d9 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -5,19 +5,6 @@ FROM azul/zulu-openjdk-debian:${JAVA_VERSION} AS jre
 # Needed for --strip-debug
 RUN apt-get -y update && apt-get -y upgrade libssl3 && apt-get -y install binutils
 
-# Remove the eMudhra and Comodo CA certificates from the default JDK truststore
-# as described in https://openjdk.org/emudhra.
-# Check whether each alias exists before deletion to ensure compatibility with
-# future JDK versions where these certificates may no longer be present.
-
-RUN for alias in "emsigneccrootcag3 [jdk]" "comodoaaaca [jdk]"; do \
-    if keytool -list -cacerts -storepass changeit -alias "$alias" >/dev/null 2>&1; then \
-      keytool -delete -cacerts -storepass changeit -alias "$alias"; \
-    else \
-      echo "Certificate alias '$alias' not found; skipping deletion."; \
-    fi; \
-done
-
 # Included modules cherrypicked from https://docs.oracle.com/en/java/javase/21/docs/api/
 #
 # jdk.unsupported is undocumented but contains Unsafe, which is used by several dependencies to
@@ -64,8 +51,8 @@ FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 # Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
 # final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
 # these roots.
-# jlink copies cacerts out of java.base.jmod, so the cleanup above (before jlink) does not
-# reach /jre. The distroless store uses subject DN aliases and has no keytool.
+# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
+# The distroless store uses subject DN aliases and has no keytool.
 # The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
 FROM ${BASE_IMAGE} AS base-ca