Skip to content

Delete unwanted CA certificates in Dockerfile #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hibohra1398 wants to merge 8 commits into from
Closed

Delete unwanted CA certificates in Dockerfile #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5f6e096
Delete unwanted CA certificates in Dockerfile
hibohra1398 Oct 24, 2026
c5fd133
Update Dockerfile
hibohra1398 Oct 24, 2026
7f35565
Update pr-build.yml
hibohra1398 Oct 24, 2026
38b2f54
Added comment and checks
hibohra1398 Oct 24, 2026
428879e
fix: remove eMudhra and AAA roots from java base image truststores
hibohra1398 Oct 24, 2026
f0781f1
file /etc/ssl/certs/ca-certificates.crt containing 4 eMudhra root cer…
hibohra1398 Oct 24, 2026
02714bd
Remove additional references JVM truststore (/usr/lib/jvm/zulu-{11,21…
hibohra1398 Oct 24, 2026
b7a5dad
Remove redundant update
hibohra1398 Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions java-11/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,40 @@ jdk.zipfs\
# Extract java SSL certs
FROM gcr.io/distroless/java-base-debian12:debug AS ssl

# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
# these roots.
# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
# The distroless store uses subject DN aliases and has no keytool.
# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
FROM ${BASE_IMAGE} AS base-ca

FROM jre AS emudhra-clean
COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
# subject, aliases differ between the two stores).
RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
keytool -list -v -keystore "$store" -storepass changeit \
| awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
> /tmp/aliases; \
while IFS= read -r alias; do \
echo "Removing '$alias' from $store"; \
keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
done < /tmp/aliases; \
done
# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
# matched by subject.
RUN mkdir /tmp/ca && cd /tmp/ca \
&& awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
&& for f in c*.pem; do \
if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
fi; \
done \
&& cat c*.pem > /etc/ssl/certs/ca-certificates.crt

FROM debian:bookworm-slim As builder
RUN apt update && apt install -y libjemalloc-dev

Expand Down Expand Up @@ -82,6 +116,10 @@ FROM base-${TARGETARCH}

COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
COPY --from=jre /jre /usr/lib/jvm/zulu-11-slim
# TEMP: eMudhra distrust, see emudhra-clean stage above
COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-11-slim/lib/security/cacerts

@ravisingal ravisingal Oct 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why overwrite this one? it was already cleaned up in line 8-19.

@hibohra1398 hibohra1398 Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The jlink step builds /jre/lib/security/cacerts from the copy inside java.base.jmod, not from the JDK's own cacerts, so the roots would still be trusted in the final image. That is why the emudhra-clean stage deletes them from /jre and the final stage overwrites /usr/lib/jvm/zulu-*-slim/lib/security/cacerts with the cleaned file. The same stage also cleans /etc/ssl/certs/java/cacerts from distroless and /etc/ssl/certs/ca-certificates.crt from BASE_IMAGE, and the final stage overwrites both. Because of this, the earlier keytool loop above jlink only edited the Zulu JDK's own truststore, which the final image never ships, so it is redundant and removing it.

@ravisingal ravisingal Oct 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can then remove changes in line 8-20?

@hibohra1398 hibohra1398 Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes already removed

COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/java /usr/bin/java
RUN ln -s /usr/lib/jvm/zulu-11-slim/bin/jfr /usr/bin/jfr
Expand Down
38 changes: 38 additions & 0 deletions java-21/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,40 @@ jdk.zipfs\
# Extract java SSL certs
FROM gcr.io/distroless/java-base-debian12:debug AS ssl

# TEMP: eMudhra/Comodo AAA distrust, see https://openjdk.org/emudhra
# Remove the base-ca and emudhra-clean stages and the "COPY --from=emudhra-clean" lines in the
# final image once the Zulu JDK, the distroless java-base image and BASE_IMAGE no longer ship
# these roots.
# jlink copies cacerts out of java.base.jmod, so the JDK's own cacerts is not what ships in /jre.
# The distroless store uses subject DN aliases and has no keytool.
# The PEM bundle in the final image comes from BASE_IMAGE and also has the eMudhra roots.
FROM ${BASE_IMAGE} AS base-ca

FROM jre AS emudhra-clean
COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
COPY --from=base-ca /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
# Java stores: delete every entry whose owner is eMudhra or AAA Certificate Services (matched by
# subject, aliases differ between the two stores).
RUN for store in /jre/lib/security/cacerts /etc/ssl/certs/java/cacerts; do \
keytool -list -v -keystore "$store" -storepass changeit \
| awk '/^Alias name: /{a=substr($0,13)} /^Owner: /{if (tolower($0) ~ /emudhra|aaa certificate services/) print a}' \
> /tmp/aliases; \
while IFS= read -r alias; do \
echo "Removing '$alias' from $store"; \
keytool -delete -keystore "$store" -storepass changeit -alias "$alias"; \
done < /tmp/aliases; \
done
# Drop every eMudhra root (emSign ECC Root CA - C3/G3, emSign Root CA - C1/G1) from the PEM bundle,
# matched by subject.
RUN mkdir /tmp/ca && cd /tmp/ca \
&& awk '/-----BEGIN CERTIFICATE-----/{n++} n{print > sprintf("c%04d.pem", n)}' /etc/ssl/certs/ca-certificates.crt \
&& for f in c*.pem; do \
if openssl x509 -in "$f" -noout -subject | grep -qi 'eMudhra'; then \
echo "Removing: $(openssl x509 -in "$f" -noout -subject)"; rm "$f"; \
fi; \
done \
&& cat c*.pem > /etc/ssl/certs/ca-certificates.crt

FROM debian:bookworm-slim AS builder
RUN apt update && apt install -y libjemalloc-dev

Expand Down Expand Up @@ -82,6 +116,10 @@ FROM base-${TARGETARCH}

COPY --from=ssl /etc/ssl/certs/java /etc/ssl/certs/java
COPY --from=jre /jre /usr/lib/jvm/zulu-21-slim
# TEMP: eMudhra distrust, see emudhra-clean stage above
COPY --from=emudhra-clean /jre/lib/security/cacerts /usr/lib/jvm/zulu-21-slim/lib/security/cacerts
COPY --from=emudhra-clean /etc/ssl/certs/java/cacerts /etc/ssl/certs/java/cacerts
COPY --from=emudhra-clean /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/java /usr/bin/java
RUN ln -s /usr/lib/jvm/zulu-21-slim/bin/jfr /usr/bin/jfr
Expand Down
Loading