Repository navigation
fix(security): distrust emSign root in tiles image - #105
Merged
Merged
Conversation
amazoncorretto:22 is past end of life. Corretto 25 is the current LTS. Java 21 is not viable: run.sh launches profiles via multi-file source launch (JEP 458, Java 22+), and every theme profile depends on OvertureProfile.java. Refs #104 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
Pull the newest ca-certificates available for the base image's AL2023 release so root store updates land without waiting for a new base image tag. Refs #104 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
The newest AL2023 ca-certificates (2025.2.76-1.0.amzn2023.0.3) still trusts this root, and Corretto's cacerts links to the system store. Add the root to the p11-kit blocklist so update-ca-trust drops it from the system bundle and Java cacerts. SHA256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B Refs #104 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The Java 22-to-25 runtime upgrade warrants human confirmation of application smoke-test results beyond the documented trust-store checks.
No open issues 🎉
What changed in this PR
Updates the tiles image to distrust emSign ECC Root CA - G3 in both system and Java trust stores, supporting the organization-wide security response.
Changes:
- Moves to
amazoncorretto:25-al2023, preserving multi-file Java source launch support. - Upgrades
ca-certificatesand regenerates trust stores during the build. - Adds the G3 certificate to the system blocklist.
| File | Description |
|---|---|
| Dockerfile | Updates Java and applies certificate upgrades and distrust settings. |
| certs/blocklist/emsign-ecc-root-ca-g3.pem | Adds the G3 certificate with its fingerprint and distrust rationale. |
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
OvertureMaps/ops-team#618 tracks the org-wide response to the compromised intermediates under emSign ECC Root CA - G3. This PR covers the tiles image.
Summary
The image runs on
amazoncorretto:22, which is past end of life, and its system trust store still trusts G3. Corretto's Java trust store is a symlink into it, so Java and s5cmd share one trust decision.amazoncorretto:25-al2023, the current LTSca-certificatesis upgraded at build time, so a stale base tag still picks up root store updates2025.2.76-1.0.amzn2023.0.3) still trusts it, so the upgrade alone doesn't remove itrun.shlaunches the theme profiles from source, and each one depends onOvertureProfile.java. That's multi-file source launch (JEP 458), which needs Java 22+.Warning
Any TLS endpoint chaining to G3 now fails from this container. At runtime it talks to S3 and the DuckDB extension repository, and neither chains to emSign.
Closes #104
Testing
Checked the trust stores in a no-cache amd64 build:
keytool -list -cacertsdrops from 143 to 142 entries, with noemsigneccrootca-g3trust listreports G3 as distrusted. The other emSign roots stay trustedThe arm64 build shows the same
keytoolresult.Post-merge (manual)
gh cache delete --all -R OvertureMaps/overture-tiles, then publish a release so the image builds without cached layers:latestdigest