Skip to content

Stop trusting compromised eMudhra roots in the exploration-tests image #13026

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eliottness wants to merge 1 commit into
base: master
Choose a base branch
from
+24 −0
Open

Stop trusting compromised eMudhra roots in the exploration-tests image #13026

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,11 @@
FROM debian:bookworm-slim

RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates && \
apt-get install -y --only-upgrade ca-certificates && \
update-ca-certificates -f && \
rm -rf /var/lib/apt/lists/*

RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y procps tini build-essential git curl unzip zip && \
apt-get -y clean && \
Expand Down Expand Up @@ -50,3 +56,21 @@ RUN git clone -b okhttp_5.3.x https://github.com/square/okhttp.git
COPY okhttp_exploration-tests.patch .
RUN cd okhttp && git apply /exploration-tests/okhttp_exploration-tests.patch
RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && sdk use java 17.0.10-tem && cd okhttp && ./gradlew dependencies"

# Remove compromised CA entries from every SDKMAN and Gradle-provisioned JDK.
RUN set -eu; \
Comment on lines +60 to +61

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Distrust the roots before downloading build inputs

This cleanup runs only after the Maven dependency resolutions at lines 31, 39, and 44 and the Gradle resolution at line 58, so those downloads use the newly installed standalone JDK stores before the required root removals. In the compromised-CA attack scenario this change addresses, a forged repository certificate can therefore inject artifacts into the image's warmed caches, and deleting the trust anchors afterward does not remove those artifacts. Scrub the SDKMAN JDKs immediately after installation, then separately repeat the cleanup after any later toolchain provisioning.

Useful? React with 👍 / 👎.

mkdir -p "$HOME/.gradle/jdks"; \
keytool="$HOME/.sdkman/candidates/java/17.0.10-tem/bin/keytool"; \
find "$HOME/.sdkman/candidates/java" "$HOME/.gradle/jdks" -type f -path '*/lib/security/cacerts' | \

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Scrub the JDK provisioned when tests start

In the OkHttp job, .gitlab/exploration-tests.yml:148-150 requests a Java 11 test launcher, while this image installs only SDKMAN Java 8 and 17. Gradle provisions missing toolchains on demand, so the Java 11 store is created under $HOME/.gradle/jdks only when jvmTest runs, after this build-time find has completed; that test JVM consequently retains both affected roots. Pre-provision Java 11 before this cleanup or scrub newly provisioned stores at job startup.

Useful? React with 👍 / 👎.

while IFS= read -r store; do \
"$keytool" -list -v -keystore "$store" -storepass changeit | \
awk '/^Alias name: / { alias = substr($0, 13) } /^Owner: .*([eE]mSign ECC Root CA - G3|AAA Certificate Services)/ { print alias }' | \

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove all four roots required by the JDK mitigation

For the pinned Java 17.0.10 installation, this predicate leaves emSign Root CA - G1 and emSign Root CA - G2 in cacerts; that JDK release explicitly added all three eMudhra roots, and Oracle's incident mitigation requires removing G1, G2, ECC G3, and AAA. Consequently the image's existing Java 17 runtime remains only partially mitigated even when this loop succeeds. Match the G1 and G2 owner subjects as well, or replace the pinned runtimes with fixed JDK builds.

Useful? React with 👍 / 👎.

while IFS= read -r alias; do \
"$keytool" -delete -keystore "$store" -storepass changeit -alias "$alias"; \
done; \
done

# Do not publish Gradle's generated API jar with its old embedded CA snapshot.
RUN if [ -d "$HOME/.gradle/caches" ]; then \
find "$HOME/.gradle/caches" -type f -path '*/generated-gradle-jars/gradle-api-*.jar' -delete; \

@datadog-datadog-prod-us1 datadog-datadog-prod-us1 Bot Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Remove the root from Gradle's source truststore too

After the okhttp warm-up, Gradle's cached distribution retains google-api-client-*.jar, whose embedded google.p12 truststore contains AAA Certificate Services. Gradle's GCS transport uses this store independently of JDK cacerts. Deleting the generated API jar therefore leaves the root trusted and permits regeneration of the same CA snapshot. Sanitize the source truststore as well as removing generated copies.

React: 👍 useful · 👎 wrong · 😕 unclear · 👀 right, but not acting on it

What each reaction means
  • 👍 Useful: correct, and you're fixing it or will.
  • 👎 Wrong: the finding is incorrect, for example the bug can't happen or the code was misread.
  • 😕 Unclear: you can't tell what it means or why it matters.
  • 👀 Right, not acting: correct, but intended, out of scope for this PR, a known risk, or too minor.

🤖 Bits Code Review · Open Bits AI session

fi
Loading