[pedrobpereira]

Changes

Eight eMudhra intermediate CAs had recoverable private keys (Oct 2026). Every published image (stable, 7.10.0, 7.10.3) still trusts emSign ECC Root CA - G3 in Java's cacerts, so an attacker on the network can present a forged certificate for the Codacy API and read the project/API token. Alpine 3.24.3 ships ca-certificates 20261020-r0, which drops that root, and moves JDK 8 from 8u452 to 8u492. A build step now fails if the root comes back.

After merge: approve publish_dockerhub_stable_hold so stable moves (the wrapper's default tag). Then bump CODACY_ANALYSIS_CLI_VERSION (pinned to 7.10.0) in codacy-analysis-cli-action.

Manual Testing

Built this Dockerfile locally with /workdir copied from the published 7.10.3 image (no sbt build). The test host is from the community tracker and is signed by a compromised intermediate.

	published 7.10.3	this branch
Java cacerts has emSign ECC Root CA - G3	yes	no
Guard step	fails (exit 1)	passes
analyze --upload --codacy-api-base-url https://dv-g3b-emudhra.we-have-a-problem.com	TLS handshake succeeds (exposed)	PKIX path building failed (safe)
--help / java -version	—	works / 1.8.0_492

The full sbt build, the CI test suite and a real analysis run were not run locally.

[pedrobpereira]

Should we have this safe guard?

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-0.50%)
Diff coverage	✅ ∅ diff coverage (50.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (282cd36)	Report Missing	Report Missing	Report Missing
Head commit (fbf5834)	1285 (+0)	1048 (+0)	81.56% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#565)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

👀 Worth a closer look

The Dockerfile guard only checks for the compromised root certificate and may not prevent trust in affected intermediate certificates; this needs review. All required security and runtime test scenarios are currently missing.

About this PR

• Add automated build, truststore/TLS rejection, and CLI smoke-test coverage for the acceptance criteria.

Test suggestions

• Verify the image build succeeds when emSign ECC Root CA - G3 is absent.
• Verify the image build fails when emSign ECC Root CA - G3 is present in Java cacerts.
• Verify a TLS connection signed by the compromised eMudhra chain is rejected.
• Verify the CLI remains runnable and java -version reports the expected runtime.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the image build succeeds when emSign ECC Root CA - G3 is absent.
2. Verify the image build fails when emSign ECC Root CA - G3 is present in Java cacerts.
3. Verify a TLS connection signed by the compromised eMudhra chain is rejected.
4. Verify the CLI remains runnable and java -version reports the expected runtime.

Low confidence findings

• Confirm separately that the downstream CODACY_ANALYSIS_CLI_VERSION bump and stable publication approval are tracked before release.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}