Repository navigation
Update jdk-27 to 27.0.1.0.2 - #1302
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
There was a problem hiding this comment.
Scope matches the title. The diff changes only version, build_num and the two sha256 values in packages/jdk-27/build.ncl.
Clobber none. git log on packages/jdk-27 and packages/jdk shows no recent fix reverted.
Correctness The bump will probably fail in the CVE-2026-111943 step of build.sh. Commit bd7d663f reports that Temurin 27.0.1 already lists all 48 fingerprints in its stock blocked.certs. The pre check at this head rejects that state. The harness fix is on origin/jdk-distrust-upstream-blocked and origin/unstable, not on main. Merge that fix first. The URL, tag and top directory forms match build.sh and the jdk-21 and jdk-25 packages. The java_version test still matches version "27.
Not checked Access to the upstream release was denied, so I did not download the tarballs. I did not confirm the tag, the asset names, the top directory or the sha256 values. I did not inspect the cacerts and java.security changes that pkgscan flagged, so a person must review those two MEDIUM signals. remove-anchors does not detect added roots. I did not run a build, so the blocked.certs claim comes from the bd7d663f commit message and not from the image. gitleaks and trivy did not run. A text search of the diff found no secret terms, and no dependency manifest changed.
Outside the diff packages/jdk/cve-2026-111943.sh:4 and packages/jdk/JdkDistrust.java:3 say that upstream shipped no fix. bd7d663f corrects both comments.
| let version = "27" in | ||
| let build_num = "35" in | ||
| let version = "27.0.1.0.2" in | ||
| let build_num = "1" in |
There was a problem hiding this comment.
medium · This bump will probably fail the jdk-27 build at this head. Commit bd7d663f reports that the stock blocked.certs in Temurin 27.0.1 already lists all 48 fingerprints. JdkDistrust.java:195-196 then rejects the must-validate fixtures and calls die, so cve-2026-111943.sh stops the build. The failure is closed, so no unpatched JDK ships, but jdk-27 stays on the older release. Merge the harness fix from origin/jdk-distrust-upstream-blocked first, then rebase this PR. The defect is local to jdk-27: the commit messages of b0acb061 and 61fa32e9 say the stock lists of jdk-25 and jdk-21 hold none of the fingerprints. I did not inspect the image or run a build.
| let version = "27" in | ||
| let build_num = "35" in | ||
| let version = "27.0.1.0.2" in | ||
| let build_num = "1" in |
There was a problem hiding this comment.
low · The comment at lines 23-24 still describes the GA release, and this change moves the package off that release. It gives tag jdk-27+35, assets ..._27_35.tar.gz and top directory jdk-27+35. The next reader will take these as the current forms, but the package now uses jdk-27.0.1.0.2+1. Remove the sentence or update it. The comment is outside the diff, so this finding anchors on the version lines. The sentence appears only in this file.
Update jdk-27
27→27.0.1.0.2Source:
github:adoptium/temurin27-binaries:operator-pinnedRelease: https://github.com/adoptium/temurin27-binaries/releases/tag/jdk-27.0.1.0.2+1
Changelog: adoptium/temurin27-binaries@27...jdk-27.0.1.0.2+1
Released: 10 days ago (2026-10-24)
Note
Auto-applied structural fixes:
build_num35 -> 1 alongside the version (the release asset name and tag both embed it).Warning
Pkgscan: 4 new signals introduced by this update (risk score 15.0).
Diff against the prior version surfaced patterns that weren't present before. Review carefully before merging — supply-chain attacks land via version-bump injection.
Amd64/conf/security/java.security,Arm64/conf/security/java.securitydefense-evasion/install-root-certificatesecurity policy added or changed (java.security)Amd64/lib/security/cacerts,Arm64/lib/security/cacertsdefense-evasion/install-root-certificatetrust store added or changed (cacerts)Plus 70 Info signals (rebuilt in place, or demoted in benign contexts).
Amd64/bin/javap,Amd64/lib/libprefs.so,Amd64/bin/jstatd,Amd64/bin/jcmd,Amd64/bin/jshelland 30 moreanti-static-analysis/embedded-blobELF executable in source (x86-64 — host arch)Arm64/bin/jmod,Arm64/bin/jimage,Arm64/bin/jnativescan,Arm64/bin/jpackage,Arm64/bin/javapand 30 moreanti-static-analysis/embedded-blobELF executable in source (aarch64 — host arch)Components changed
CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
jdk-272727.0.1.0.2jdk-27-upstream2727.0.1.0.2Changes
2727.0.1.0.21cf69a4848ffb728...30cb129f6cf299c8...https://github.com/adoptium/temurin27-binaries/releases/download/jdk-27+35/OpenJDK27U-jdk_x64_linux_hotspot_27_35.tar.gz%{dl_base}/OpenJDK27U-jdk_x64_linux_hotspot_27.0.1.0.2_%{build_num}.tar.gzUpstream digests:
Amd64✓ matches GitHub's published sha256 forOpenJDK27U-jdk_x64_linux_hotspot_27.0.1.0.2_1.tar.gz;Arm64✓ matches GitHub's published sha256 forOpenJDK27U-jdk_aarch64_linux_hotspot_27.0.1.0.2_1.tar.gz.🔒 TLS: [Amd64]
github.com— Sectigo Public Server Authentication CA DV E36 → Sectigo Public Server Authentication Root E46 (rootc90f26f0fb1b4018…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519 ⇒release-assets.githubusercontent.com— YR1 → Root YR → ISRG Root X1 (root96bcec06264976f3…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519🔒 TLS: [Arm64]
github.com— Sectigo Public Server Authentication CA DV E36 → Sectigo Public Server Authentication Root E46 (rootc90f26f0fb1b4018…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519 ⇒release-assets.githubusercontent.com— YR1 → Root YR → ISRG Root X1 (root96bcec06264976f3…) · TLSv1_3 · TLS13_AES_128_GCM_SHA256 · X25519Per-arch sources
Amd6430cb129f6cf299c8...(was1cf69a4848ffb728...)%{dl_base}/OpenJDK27U-jdk_x64_linux_hotspot_27.0.1.0.2_%{build_num}.tar.gzArm645ddacf925244a00b...(wase4ec5c7276290c7b...)%{dl_base}/OpenJDK27U-jdk_aarch64_linux_hotspot_27.0.1.0.2_%{build_num}.tar.gzCreated by pkgmgr