)]}'
{
  "commit": "7f11dd25d410f5f8792e4f5488750498320a3f2c",
  "tree": "2785754aae93334854bf04496806ff2c42e15560",
  "parents": [
    "dd6f75c05f5ae49bce1a68c95533c9af9d72e4f9"
  ],
  "author": {
    "name": "Xùdōng Yáng",
    "email": "wyverald@gmail.com",
    "time": "Tue Oct 20 21:41:31 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Tue Oct 20 21:41:31 2026 +0000"
  },
  "message": "[9.3.1] Remove distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK (#31920)\n\nWhen building the reduced embedded JDK in `src/minimize_jdk.sh`, use\n`keytool`\nafter `jlink` to remove the distrusted Sectigo (`CN\u003dAAA Certificate\nServices`)\nand eMudhra (`CN\u003demSign ECC Root CA - G3`, `CN\u003demSign Root CA - G1`,\n`CN\u003demSign Root CA - G2`, `CN\u003demSign Root CA - C1`,\n`CN\u003demSign ECC Root CA - C3`) root CA certificates from\n`reduced/lib/security/cacerts` by matching their SHA-256 fingerprints,\nto\naddress the eMudhra intermediate CA private key compromise (see\nhttps://emudhra.we-have-a-problem.com/).\n\nAlso add `test_bundled_jdk_cacerts_excludes_distrusted_roots` to\n`src/test/shell/bazel/bazel_with_jdk_test.sh` to verify that none of the\ndistrusted root certificates remain in the bundled JDK\u0027s `cacerts`\nkeystore.\n\nRELNOTES: Removed distrusted eMudhra and Sectigo AAA root CA\ncertificates from the bundled JDK, to address the private key leakage\n(see https://emudhra.we-have-a-problem.com/).\n\nPiperOrigin-RevId: 1003293459\nChange-Id: I578bdeffb1882c20c351fa6289c20b3383ba19ec\n\n(cherry picked from commit efaf902c25d6af8e4d562f3b390def60d350be99)",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "32a2f274fdfd0288b710f97717ac23ce56bb5bd0",
      "old_mode": 33261,
      "old_path": "src/minimize_jdk.sh",
      "new_id": "fa652ceda49b542f254499f1872401d1714ff8f1",
      "new_mode": 33261,
      "new_path": "src/minimize_jdk.sh"
    },
    {
      "type": "modify",
      "old_id": "6f3bf24a3719c1a6ac5d6bee69836121281bed25",
      "old_mode": 33261,
      "old_path": "src/test/shell/bazel/bazel_with_jdk_test.sh",
      "new_id": "4ac602ebfdceaedc7a008e406baf5cecf89c5a3d",
      "new_mode": 33261,
      "new_path": "src/test/shell/bazel/bazel_with_jdk_test.sh"
    }
  ]
}