diff --git a/runners/flink/job-server-container/Dockerfile b/runners/flink/job-server-container/Dockerfile index cbb73512400e..01c85b043612 100644 --- a/runners/flink/job-server-container/Dockerfile +++ b/runners/flink/job-server-container/Dockerfile @@ -19,7 +19,13 @@ FROM eclipse-temurin:11 MAINTAINER "Apache Beam " -RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 +RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \ + && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \ + | grep -iE "emsign|emudhra" \ + | awk -F', ' '{print $1}' \ + | while IFS= read -r alias; do \ + keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \ + done) ADD beam-runners-flink-job-server.jar /opt/apache/beam/jars/ ADD flink-job-server.sh /opt/apache/beam/ diff --git a/runners/spark/job-server/container/Dockerfile b/runners/spark/job-server/container/Dockerfile index f5639430a33b..8c2886476ea8 100644 --- a/runners/spark/job-server/container/Dockerfile +++ b/runners/spark/job-server/container/Dockerfile @@ -19,7 +19,13 @@ FROM eclipse-temurin:11 MAINTAINER "Apache Beam " -RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 +RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y libltdl7 \ + && (keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \ + | grep -iE "emsign|emudhra" \ + | awk -F', ' '{print $1}' \ + | while IFS= read -r alias; do \ + keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \ + done) ADD beam-runners-spark-job-server.jar /opt/apache/beam/jars/ ADD spark-job-server.sh /opt/apache/beam/ diff --git a/sdks/java/container/Dockerfile b/sdks/java/container/Dockerfile index 7a8c9e7e7d7e..bcfc41eed720 100644 --- a/sdks/java/container/Dockerfile +++ b/sdks/java/container/Dockerfile @@ -57,4 +57,14 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \ # Add Google Cloud Profiler agent. COPY target/profiler/* /opt/google_cloud_profiler/ +# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore. +RUN CACERTS="${JAVA_HOME}/lib/security/cacerts"; \ + if [ ! -f "${CACERTS}" ]; then CACERTS="${JAVA_HOME}/jre/lib/security/cacerts"; fi; \ + keytool -list -keystore "${CACERTS}" -storepass changeit \ + | grep -iE "emsign|emudhra" \ + | awk -F', ' '{print $1}' \ + | while IFS= read -r alias; do \ + keytool -delete -noprompt -alias "${alias}" -keystore "${CACERTS}" -storepass changeit; \ + done + ENTRYPOINT ["/opt/apache/beam/boot"] diff --git a/sdks/java/container/distroless/Dockerfile b/sdks/java/container/distroless/Dockerfile index 328c4dc6a7b3..ad1a1b9c76de 100644 --- a/sdks/java/container/distroless/Dockerfile +++ b/sdks/java/container/distroless/Dockerfile @@ -34,6 +34,7 @@ RUN if [ -z "${TARGETARCH}" ]; then echo "fatal: TARGETARCH not set; run as dock FROM ${DISTROLESS_BASE}:latest-${TARGETARCH} AS distroless COPY --from=base /opt /opt +COPY --from=base /opt/java/openjdk/lib/security/cacerts /etc/ssl/certs/java/cacerts # Along with the LANG environment variable above, prevents internally discovered failing bugs related to Dataflow Flex # template character encodings. diff --git a/sdks/java/expansion-service/container/Dockerfile b/sdks/java/expansion-service/container/Dockerfile index 513dd6b75b88..a39269cd9511 100644 --- a/sdks/java/expansion-service/container/Dockerfile +++ b/sdks/java/expansion-service/container/Dockerfile @@ -47,4 +47,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \ rm -rf /opt/apache/beam/third_party_licenses ; \ fi +# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore. +RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \ + | grep -iE "emsign|emudhra" \ + | awk -F', ' '{print $1}' \ + | while IFS= read -r alias; do \ + keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \ + done + ENTRYPOINT ["/opt/apache/beam/boot", "-config_file", "./expansion_service_config.yml", "-dependencies_dir", "jars/"] diff --git a/sdks/java/transform-service/controller-container/Dockerfile b/sdks/java/transform-service/controller-container/Dockerfile index 4efa7bdc42c3..ccb26b37b002 100644 --- a/sdks/java/transform-service/controller-container/Dockerfile +++ b/sdks/java/transform-service/controller-container/Dockerfile @@ -43,4 +43,12 @@ RUN if [ "${pull_licenses}" = "false" ] ; then \ rm -rf /opt/apache/beam/third_party_licenses ; \ fi +# Remove distrusted eMudhra / emSign root CA certificates from the JDK truststore. +RUN keytool -list -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit \ + | grep -iE "emsign|emudhra" \ + | awk -F', ' '{print $1}' \ + | while IFS= read -r alias; do \ + keytool -delete -noprompt -alias "${alias}" -keystore "${JAVA_HOME}/lib/security/cacerts" -storepass changeit; \ + done + ENTRYPOINT ["./boot", "-config_file", "./transform_service_config.yml"] diff --git a/sdks/python/container/ml/py310/base_image_requirements.txt b/sdks/python/container/ml/py310/base_image_requirements.txt index 6a459c7a9e97..9b149a59a12b 100644 --- a/sdks/python/container/ml/py310/base_image_requirements.txt +++ b/sdks/python/container/ml/py310/base_image_requirements.txt @@ -105,7 +105,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 huggingface_hub==0.36.2 hyperframe==6.1.0 diff --git a/sdks/python/container/ml/py310/gpu_image_requirements.txt b/sdks/python/container/ml/py310/gpu_image_requirements.txt index 373aecffc53e..cc09fd7ab598 100644 --- a/sdks/python/container/ml/py310/gpu_image_requirements.txt +++ b/sdks/python/container/ml/py310/gpu_image_requirements.txt @@ -125,7 +125,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httptools==0.8.0 httpx==0.28.1 huggingface_hub==0.36.2 diff --git a/sdks/python/container/ml/py311/base_image_requirements.txt b/sdks/python/container/ml/py311/base_image_requirements.txt index 60c32b64099b..010b3ba44d7f 100644 --- a/sdks/python/container/ml/py311/base_image_requirements.txt +++ b/sdks/python/container/ml/py311/base_image_requirements.txt @@ -103,7 +103,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 huggingface_hub==0.36.2 hyperframe==6.1.0 diff --git a/sdks/python/container/ml/py311/gpu_image_requirements.txt b/sdks/python/container/ml/py311/gpu_image_requirements.txt index 57c130d29ed7..87958fddfa36 100644 --- a/sdks/python/container/ml/py311/gpu_image_requirements.txt +++ b/sdks/python/container/ml/py311/gpu_image_requirements.txt @@ -123,7 +123,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httptools==0.8.0 httpx==0.28.1 huggingface_hub==0.36.2 diff --git a/sdks/python/container/ml/py312/base_image_requirements.txt b/sdks/python/container/ml/py312/base_image_requirements.txt index d093c15673aa..fa95716946e5 100644 --- a/sdks/python/container/ml/py312/base_image_requirements.txt +++ b/sdks/python/container/ml/py312/base_image_requirements.txt @@ -102,7 +102,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 huggingface_hub==0.36.2 hyperframe==6.1.0 diff --git a/sdks/python/container/ml/py312/gpu_image_requirements.txt b/sdks/python/container/ml/py312/gpu_image_requirements.txt index 1750acc80f93..20bd5cfc739a 100644 --- a/sdks/python/container/ml/py312/gpu_image_requirements.txt +++ b/sdks/python/container/ml/py312/gpu_image_requirements.txt @@ -122,7 +122,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httptools==0.8.0 httpx==0.28.1 huggingface_hub==0.36.2 diff --git a/sdks/python/container/ml/py313/base_image_requirements.txt b/sdks/python/container/ml/py313/base_image_requirements.txt index 20362d45831f..3ac48c12dd9c 100644 --- a/sdks/python/container/ml/py313/base_image_requirements.txt +++ b/sdks/python/container/ml/py313/base_image_requirements.txt @@ -101,7 +101,7 @@ h5py==3.14.0 hf-xet==1.6.0 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 huggingface_hub==0.36.2 hyperframe==6.1.0 diff --git a/sdks/python/container/py310/base_image_requirements.txt b/sdks/python/container/py310/base_image_requirements.txt index f88e84ce75cf..e1ac27a882b8 100644 --- a/sdks/python/container/py310/base_image_requirements.txt +++ b/sdks/python/container/py310/base_image_requirements.txt @@ -96,7 +96,7 @@ h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 hyperframe==6.1.0 hypothesis==6.148.3 diff --git a/sdks/python/container/py311/base_image_requirements.txt b/sdks/python/container/py311/base_image_requirements.txt index c7be537ce39d..58fc4f459b95 100644 --- a/sdks/python/container/py311/base_image_requirements.txt +++ b/sdks/python/container/py311/base_image_requirements.txt @@ -94,7 +94,7 @@ h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 hyperframe==6.1.0 hypothesis==6.148.3 diff --git a/sdks/python/container/py312/base_image_requirements.txt b/sdks/python/container/py312/base_image_requirements.txt index 1a6dbaf56195..24b4baca945f 100644 --- a/sdks/python/container/py312/base_image_requirements.txt +++ b/sdks/python/container/py312/base_image_requirements.txt @@ -93,7 +93,7 @@ h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 hyperframe==6.1.0 hypothesis==6.148.3 diff --git a/sdks/python/container/py313/base_image_requirements.txt b/sdks/python/container/py313/base_image_requirements.txt index cb946e1aa3fe..d04061d7dd48 100644 --- a/sdks/python/container/py313/base_image_requirements.txt +++ b/sdks/python/container/py313/base_image_requirements.txt @@ -92,7 +92,7 @@ h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 hyperframe==6.1.0 hypothesis==6.148.3 diff --git a/sdks/python/container/py314/base_image_requirements.txt b/sdks/python/container/py314/base_image_requirements.txt index 98a0656cedcc..c54035585ab3 100644 --- a/sdks/python/container/py314/base_image_requirements.txt +++ b/sdks/python/container/py314/base_image_requirements.txt @@ -92,7 +92,7 @@ h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 -httplib2==0.32.0 +httplib2==0.32.1 httpx==0.28.1 hyperframe==6.1.0 hypothesis==6.148.3