From fbf583456d79f8be48ba03b10af02d3aeec687d8 Mon Sep 17 00:00:00 2001
From: Pedro Pereira <pedro.pereira@codacy.com>
Date: Thu, 22 Oct 2026 12:15:48 +0100
Subject: [PATCH] fix: Bump Alpine to 3.24.3 for eMudhra CA distrust

Published images trust emSign ECC Root CA - G3, so forged certs from the compromised intermediates pass.
---
 Dockerfile | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 607fd767..203272a0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,12 @@
-FROM alpine:3.21.3
+FROM alpine:3.24.3
 
 RUN apk add --no-cache --update bash docker openjdk8
 
+# Fail the build if Java still trusts the root behind the compromised eMudhra intermediates (Oct 2026)
+RUN keytool -list -v -keystore /etc/ssl/certs/java/cacerts -storepass changeit > /tmp/cacerts.txt \
+    && ! grep -qi "emSign ECC Root CA - G3" /tmp/cacerts.txt \
+    && rm /tmp/cacerts.txt
+
 WORKDIR /workdir
 
 COPY --chown=root:root cli/target/universal/stage /workdir