From c6743a05150dabebf9692f6ac2d2e4a739e87564 Mon Sep 17 00:00:00 2001 From: Assad Riaz Date: Thu, 29 Oct 2026 08:07:43 +0100 Subject: [PATCH 1/2] Bump Liberica base image and CI JDK to 25.0.5.0.3+5 for eMudhra CA compromise --- .github/workflows/push.yml | 11 +++++++++-- Dockerfile | 4 ++-- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 223bce28..c29cfa16 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -15,10 +15,17 @@ jobs: - uses: actions/checkout@v7.0.1 with: fetch-depth: 0 + # setup-java's liberica distribution can't select 25.0.5.0.3+5 (it maps to the same + # semver as 25.0.5.0.2+5), so download the exact eMudhra-fixed build and install it. + - name: Download Liberica JDK 25.0.5.0.3+5 + run: | + curl -fsSL -o "$RUNNER_TEMP/liberica.tar.gz" "https://github.com/bell-sw/Liberica/releases/download/25.0.5.0.3+5/bellsoft-jdk25.0.5.0.3+5-linux-amd64.tar.gz" + echo "d6f798af1ace9d228e0fcae073ba87b600bc9c33 $RUNNER_TEMP/liberica.tar.gz" | sha1sum -c - - uses: actions/setup-java@v6.1.0 with: - java-version: 25.0.4+9 - distribution: liberica + distribution: jdkfile + jdkFile: ${{ runner.temp }}/liberica.tar.gz + java-version: 25.0.5 - name: Cache Maven dependencies uses: actions/cache@v6.1.0 with: diff --git a/Dockerfile b/Dockerfile index 5c9dbdbf..094e9780 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,9 @@ -FROM bellsoft/liberica-openjre-alpine:25.0.4.1 AS builder +FROM bellsoft/liberica-openjre-alpine:25.0.5.0.3-5 AS builder WORKDIR /builder COPY target/*-SNAPSHOT.jar application.jar RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted -FROM bellsoft/liberica-openjre-alpine:25.0.4.1 +FROM bellsoft/liberica-openjre-alpine:25.0.5.0.3-5 RUN apk update && apk upgrade && apk add --no-cache tini WORKDIR /deployments RUN addgroup appuser && adduser --disabled-password appuser --ingroup appuser From a6d47ec9b9e58a29bc04a678f1bcc9f5a4baf412 Mon Sep 17 00:00:00 2001 From: Assad Riaz Date: Thu, 29 Oct 2026 08:11:21 +0100 Subject: [PATCH 2/2] Restrict JDK download to HTTPS and verify it with SHA-256 --- .github/workflows/push.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index c29cfa16..975c7d18 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -17,10 +17,11 @@ jobs: fetch-depth: 0 # setup-java's liberica distribution can't select 25.0.5.0.3+5 (it maps to the same # semver as 25.0.5.0.2+5), so download the exact eMudhra-fixed build and install it. + # SHA-256 computed from the tarball after checking it against BellSoft's published SHA-1. - name: Download Liberica JDK 25.0.5.0.3+5 run: | - curl -fsSL -o "$RUNNER_TEMP/liberica.tar.gz" "https://github.com/bell-sw/Liberica/releases/download/25.0.5.0.3+5/bellsoft-jdk25.0.5.0.3+5-linux-amd64.tar.gz" - echo "d6f798af1ace9d228e0fcae073ba87b600bc9c33 $RUNNER_TEMP/liberica.tar.gz" | sha1sum -c - + curl --proto '=https' --tlsv1.2 -fsSL -o "$RUNNER_TEMP/liberica.tar.gz" "https://github.com/bell-sw/Liberica/releases/download/25.0.5.0.3+5/bellsoft-jdk25.0.5.0.3+5-linux-amd64.tar.gz" + echo "619c84961ce12dd1cd455719680e22d080bee63dbfe64711e2ef47243114e3ef $RUNNER_TEMP/liberica.tar.gz" | sha256sum -c - - uses: actions/setup-java@v6.1.0 with: distribution: jdkfile