)]}'
{
  "commit": "2d83fb9f099140661af4362818002c595d207813",
  "tree": "ade334fbbe70f22a5ee673ca516841fa15ecd45f",
  "parents": [
    "f8278f94e9a0861e8bda56619d9e8df9b3b99e69"
  ],
  "author": {
    "name": "Xùdōng Yáng",
    "email": "wyverald@gmail.com",
    "time": "Tue Oct 20 20:14:24 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Oct 20 20:14:24 2026 +0000"
  },
  "message": "[8.8.2] Remove distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK (#31921)\n\nWhen building the reduced embedded JDK in `src/minimize_jdk.sh`, use\n`keytool`\nafter `jlink` to remove the distrusted Sectigo (`CN\u003dAAA Certificate\nServices`)\nand eMudhra (`CN\u003demSign ECC Root CA - G3`, `CN\u003demSign Root CA - G1`,\n`CN\u003demSign Root CA - G2`, `CN\u003demSign Root CA - C1`,\n`CN\u003demSign ECC Root CA - C3`) root CA certificates from\n`reduced/lib/security/cacerts` by matching their SHA-256 fingerprints,\nto\naddress the eMudhra intermediate CA private key compromise (see\nhttps://emudhra.we-have-a-problem.com/).\n\nAlso add `test_bundled_jdk_cacerts_excludes_distrusted_roots` to\n`src/test/shell/bazel/bazel_with_jdk_test.sh` to verify that none of the\ndistrusted root certificates remain in the bundled JDK\u0027s `cacerts`\nkeystore.\n\nRELNOTES: Removed distrusted eMudhra and Sectigo AAA root CA\ncertificates from the bundled JDK, to address the private key leakage\n(see https://emudhra.we-have-a-problem.com/).\n\nPiperOrigin-RevId: 1003293459\nChange-Id: I578bdeffb1882c20c351fa6289c20b3383ba19ec\n\n(cherry picked from commit efaf902c25d6af8e4d562f3b390def60d350be99)",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dcb1182a839d0900fee38fef66dd4e55f1512671",
      "old_mode": 33261,
      "old_path": "src/minimize_jdk.sh",
      "new_id": "92da6e9fcd7002db716f2339cdee97df807ccaa7",
      "new_mode": 33261,
      "new_path": "src/minimize_jdk.sh"
    },
    {
      "type": "modify",
      "old_id": "b82efa86efb42a736c9210d1794b969e8c73d89e",
      "old_mode": 33261,
      "old_path": "src/test/shell/bazel/bazel_with_jdk_test.sh",
      "new_id": "ec3dd8d39fed278a0dc30f00e80ccbdc46ba9088",
      "new_mode": 33261,
      "new_path": "src/test/shell/bazel/bazel_with_jdk_test.sh"
    }
  ]
}