[8.8.2] Remove distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK (#31921) When building the reduced embedded JDK in `src/minimize_jdk.sh`, use `keytool` after `jlink` to remove the distrusted Sectigo (`CN=AAA Certificate Services`) and eMudhra (`CN=emSign ECC Root CA - G3`, `CN=emSign Root CA - G1`, `CN=emSign Root CA - G2`, `CN=emSign Root CA - C1`, `CN=emSign ECC Root CA - C3`) root CA certificates from `reduced/lib/security/cacerts` by matching their SHA-256 fingerprints, to address the eMudhra intermediate CA private key compromise (see https://emudhra.we-have-a-problem.com/). Also add `test_bundled_jdk_cacerts_excludes_distrusted_roots` to `src/test/shell/bazel/bazel_with_jdk_test.sh` to verify that none of the distrusted root certificates remain in the bundled JDK's `cacerts` keystore. RELNOTES: Removed distrusted eMudhra and Sectigo AAA root CA certificates from the bundled JDK, to address the private key leakage (see https://emudhra.we-have-a-problem.com/). PiperOrigin-RevId: 1003293459 Change-Id: I578bdeffb1882c20c351fa6289c20b3383ba19ec (cherry picked from commit efaf902c25d6af8e4d562f3b390def60d350be99)
{Fast, Correct} - Choose two
Build and test software of any size, quickly and reliably.
Speed up your builds and tests: Bazel rebuilds only what is necessary. With advanced local and distributed caching, optimized dependency analysis and parallel execution, you get fast and incremental builds.
One tool, multiple languages: Build and test Java, C++, Android, iOS, Go, and a wide variety of other language platforms. Bazel runs on Windows, macOS, and Linux.
Scalable: Bazel helps you scale your organization, codebase, and continuous integration solution. It handles codebases of any size, in multiple repositories or a huge monorepo.
Extensible to your needs: Easily add support for new languages and platforms with Bazel's familiar extension language. Share and re-use language rules written by the growing Bazel community.
Follow our tutorials:
To report a security issue, please email security@bazel.build with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue. Our vulnerability management team will respond within 3 working days of your email. If the issue is confirmed as a vulnerability, we will open a Security Advisory. This project follows a 90 day disclosure timeline.
See CONTRIBUTING.md
