From a70d495494a17649184842bc3e89dba14dfeb6bd Mon Sep 17 00:00:00 2001 From: Assad Riaz Date: Thu, 29 Oct 2026 09:09:31 +0100 Subject: [PATCH] Bump Liberica base image and CI JDK to 21.0.13.0.3+5 for eMudhra CA compromise --- .github/workflows/push.yml | 12 ++++++++++-- Dockerfile | 4 ++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 5b6cc474..6517fa9d 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -13,10 +13,18 @@ jobs: contents: read steps: - uses: actions/checkout@v7.0.1 + # setup-java's liberica distribution can't select 21.0.13.0.3+5 (it maps to the same + # semver as 21.0.13.0.2+5), so download the exact eMudhra-fixed build and install it. + # SHA-256 computed from the tarball after checking it against BellSoft's published SHA-1. + - name: Download Liberica JDK 21.0.13.0.3+5 + run: | + curl --proto '=https' --tlsv1.2 -fsSL -o "$RUNNER_TEMP/liberica.tar.gz" "https://github.com/bell-sw/Liberica/releases/download/21.0.13.0.3+5/bellsoft-jdk21.0.13.0.3+5-linux-amd64.tar.gz" + echo "f6bac5c836223d91525360bfbb2e422b39f8fcebedafbc1adda27945934926da $RUNNER_TEMP/liberica.tar.gz" | sha256sum -c - - uses: actions/setup-java@v6.1.0 with: - java-version: 21.0.1+12 - distribution: liberica + distribution: jdkfile + jdkFile: ${{ runner.temp }}/liberica.tar.gz + java-version: 21.0.13 - name: Cache Maven dependencies uses: actions/cache@v6.1.0 with: diff --git a/Dockerfile b/Dockerfile index ac694ece..066c7c96 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,9 @@ -FROM bellsoft/liberica-openjre-alpine:21.0.12.1 AS builder +FROM bellsoft/liberica-openjre-alpine:21.0.13.0.3-5 AS builder WORKDIR /builder COPY target/*-SNAPSHOT.jar application.jar RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted -FROM bellsoft/liberica-openjre-alpine:21.0.12.1 +FROM bellsoft/liberica-openjre-alpine:21.0.13.0.3-5 RUN apk update && apk upgrade && apk add --no-cache tini WORKDIR /deployments RUN addgroup appuser && adduser --disabled-password appuser --ingroup appuser