From 2ae259dbacf12d4aba43d5f08c4829d8c840fc62 Mon Sep 17 00:00:00 2001
From: Aaron Steinfeld <aaron.steinfeld@harness.io>
Date: Sat, 24 Oct 2026 09:09:40 -0400
Subject: [PATCH] fix: apply Azul eMudhra blocklist to the jlinked JRE

Overlay Azul's emudhra-block-unix.certs (SHA-256 verified) onto
/jre/lib/security/blocked.certs after jlink, since jlink takes the list
from jmods. Same 86 fingerprints as Zulu 11.0.33 / 21.0.13. Temporary
until the base image is on a fixed Zulu release.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 java-11/Dockerfile    | 11 ++++++
 java-11/blocked.certs | 87 +++++++++++++++++++++++++++++++++++++++++++
 java-21/Dockerfile    | 11 ++++++
 java-21/blocked.certs | 87 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 196 insertions(+)
 create mode 100644 java-11/blocked.certs
 create mode 100644 java-21/blocked.certs

diff --git a/java-11/Dockerfile b/java-11/Dockerfile
index 77a9be7..3a2b12f 100644
--- a/java-11/Dockerfile
+++ b/java-11/Dockerfile
@@ -44,6 +44,17 @@ java.net.http,\
 jdk.zipfs\
  --output jre
 
+# TEMP: eMudhra blocklist, see https://docs.azul.com/core/emudhra-workaround.html
+# jlink copies blocked.certs from the JDK's jmods, so the fixed list has to be applied to the
+# jlinked runtime. The file is Azul's emudhra-block-unix.certs (SHA-256 below), which has the same
+# fingerprints as the Zulu 11.0.33 / 21.0.13 lists. Remove this and the COPY once the base image
+# is Zulu 11.0.33 / 21.0.13 or newer, otherwise it would hide later blocklist updates.
+COPY blocked.certs /tmp/emudhra-blocked.certs
+RUN echo "2596bb6dda83c66d96c5a252d7b2ae1f24cc1ae3f1890223b4f3591a8d52bf10  /tmp/emudhra-blocked.certs" | sha256sum -c - \
+    && cp /tmp/emudhra-blocked.certs /jre/lib/security/blocked.certs \
+    && chmod 644 /jre/lib/security/blocked.certs \
+    && rm /tmp/emudhra-blocked.certs
+
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
diff --git a/java-11/blocked.certs b/java-11/blocked.certs
new file mode 100644
index 0000000..d3b9f7b
--- /dev/null
+++ b/java-11/blocked.certs
@@ -0,0 +1,87 @@
+Algorithm=SHA-256
+0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
+03DB9E5E79FE6117177F81C11595AF598CB176AF766290DBCEB2C318B32E39A2
+08C396C006A21055D00826A5781A5CCFCE2C8D053AB3C197637A4A7A5BB9A650
+10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B
+14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD
+169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240
+1C5E6985ACC09221DBD1A4B7BBC6D3A8C3F8540D19F20763A9537FDD42B4FFE7
+1F6BF8A3F2399AF7FD04516C2719C566CBAD51F412738F66D0457E1E6BDE6F2D
+21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832
+2A464E4113141352C7962FBD1706ED4B88533EF24D7BBA6CCC5D797FD202F1C4
+31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133
+33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09
+37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8
+3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66
+3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829
+3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF
+3E11CF90719F6FB44D94EAC9A156B89BEBE7B8598F28EC58913F2BFCAF91D0C0
+423279423B9FC8CB06F1BB7C3B247522B948D5F18939F378ECC901126DE40BFB
+42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
+432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
+450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2
+45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE
+4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
+4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE
+4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C
+4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176
+50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A
+535D04DFCE027C70BD5F8A9E0AD4F218E9AFDCF5BBCF9B6DE0D81E148E2E3172
+558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB
+568FAF38D9F155F624838E2181B1CEB4D8459305EE652B0F810C97C3611BFE19
+579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512
+585CFE6B7436CBD4E732763A2137D7F49599BA9B1790E688FCEC799C58EB84A6
+59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66
+5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE
+5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B
+5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699
+62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72
+71CB00749B9130FB2707A2664BFF958D0FCC8E161D9674C7450BA0FC2BEAF9D3
+7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489
+75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536
+76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645
+7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2
+84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD
+8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF
+8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0
+8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82
+912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1
+98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
+9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
+9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7
+9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC
+9FADCE80D62A959F9930D748488C1E22E821F4E1E4A43584B848C2FC11E04D77
+A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC
+A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5
+A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC
+A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8
+A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8
+A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9
+A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083
+A90132CEA1D4F7185E4F688EFFD16F6AC14DFD78356A807599A5DABBEEF3333E
+AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986
+B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C
+B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD
+B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
+C0D1F42B9F4BF7ACC045B7BB5D4805E10737F67B6310CE505248D543D0D5FE07
+C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0
+C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222
+C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33
+CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
+CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978
+D0156949F1381943442C6974E9B5B49EF441BB799EF20477B90A89C3F33620CE
+D151962D954970501C60079258EBCFA38502E0A9F03CD640322B08C0A3117FE5
+D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F
+D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967
+D6CEAE5D9E047FAF7D797858D229AC991AD44316D1E2A37A21926D763153593A
+D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8
+DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE
+E0E740E4B0F8B3548181FF75B5372FAF4C70B99EC995D694ED0FB91B03FF8D21
+E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
+EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C
+EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E
+F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7
+FBB12938ABD86C125796EDF4162D291028890A7D6C0C1CCA75FD4B95EBFA7A1A
+FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD
+FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F
+FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B
diff --git a/java-21/Dockerfile b/java-21/Dockerfile
index a452763..63b6b94 100644
--- a/java-21/Dockerfile
+++ b/java-21/Dockerfile
@@ -44,6 +44,17 @@ java.net.http,\
 jdk.zipfs\
  --output jre
 
+# TEMP: eMudhra blocklist, see https://docs.azul.com/core/emudhra-workaround.html
+# jlink copies blocked.certs from the JDK's jmods, so the fixed list has to be applied to the
+# jlinked runtime. The file is Azul's emudhra-block-unix.certs (SHA-256 below), which has the same
+# fingerprints as the Zulu 11.0.33 / 21.0.13 lists. Remove this and the COPY once the base image
+# is Zulu 11.0.33 / 21.0.13 or newer, otherwise it would hide later blocklist updates.
+COPY blocked.certs /tmp/emudhra-blocked.certs
+RUN echo "2596bb6dda83c66d96c5a252d7b2ae1f24cc1ae3f1890223b4f3591a8d52bf10  /tmp/emudhra-blocked.certs" | sha256sum -c - \
+    && cp /tmp/emudhra-blocked.certs /jre/lib/security/blocked.certs \
+    && chmod 644 /jre/lib/security/blocked.certs \
+    && rm /tmp/emudhra-blocked.certs
+
 # Extract java SSL certs
 FROM gcr.io/distroless/java-base-debian12:debug AS ssl
 
diff --git a/java-21/blocked.certs b/java-21/blocked.certs
new file mode 100644
index 0000000..d3b9f7b
--- /dev/null
+++ b/java-21/blocked.certs
@@ -0,0 +1,87 @@
+Algorithm=SHA-256
+0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
+03DB9E5E79FE6117177F81C11595AF598CB176AF766290DBCEB2C318B32E39A2
+08C396C006A21055D00826A5781A5CCFCE2C8D053AB3C197637A4A7A5BB9A650
+10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B
+14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD
+169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240
+1C5E6985ACC09221DBD1A4B7BBC6D3A8C3F8540D19F20763A9537FDD42B4FFE7
+1F6BF8A3F2399AF7FD04516C2719C566CBAD51F412738F66D0457E1E6BDE6F2D
+21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832
+2A464E4113141352C7962FBD1706ED4B88533EF24D7BBA6CCC5D797FD202F1C4
+31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133
+33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09
+37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8
+3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66
+3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829
+3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF
+3E11CF90719F6FB44D94EAC9A156B89BEBE7B8598F28EC58913F2BFCAF91D0C0
+423279423B9FC8CB06F1BB7C3B247522B948D5F18939F378ECC901126DE40BFB
+42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
+432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
+450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2
+45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE
+4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
+4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE
+4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C
+4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176
+50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A
+535D04DFCE027C70BD5F8A9E0AD4F218E9AFDCF5BBCF9B6DE0D81E148E2E3172
+558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB
+568FAF38D9F155F624838E2181B1CEB4D8459305EE652B0F810C97C3611BFE19
+579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512
+585CFE6B7436CBD4E732763A2137D7F49599BA9B1790E688FCEC799C58EB84A6
+59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66
+5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE
+5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B
+5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699
+62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72
+71CB00749B9130FB2707A2664BFF958D0FCC8E161D9674C7450BA0FC2BEAF9D3
+7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489
+75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536
+76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645
+7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2
+84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD
+8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF
+8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0
+8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82
+912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1
+98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
+9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
+9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7
+9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC
+9FADCE80D62A959F9930D748488C1E22E821F4E1E4A43584B848C2FC11E04D77
+A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC
+A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5
+A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC
+A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8
+A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8
+A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9
+A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083
+A90132CEA1D4F7185E4F688EFFD16F6AC14DFD78356A807599A5DABBEEF3333E
+AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986
+B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C
+B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD
+B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
+C0D1F42B9F4BF7ACC045B7BB5D4805E10737F67B6310CE505248D543D0D5FE07
+C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0
+C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222
+C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33
+CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
+CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978
+D0156949F1381943442C6974E9B5B49EF441BB799EF20477B90A89C3F33620CE
+D151962D954970501C60079258EBCFA38502E0A9F03CD640322B08C0A3117FE5
+D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F
+D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967
+D6CEAE5D9E047FAF7D797858D229AC991AD44316D1E2A37A21926D763153593A
+D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8
+DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE
+E0E740E4B0F8B3548181FF75B5372FAF4C70B99EC995D694ED0FB91B03FF8D21
+E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
+EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C
+EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E
+F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7
+FBB12938ABD86C125796EDF4162D291028890A7D6C0C1CCA75FD4B95EBFA7A1A
+FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD
+FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F
+FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B