[davidmreed]

Opened as draft because this moves the example's base distro and JDK line (distroless Debian 11 / Java 11 -> Debian 13 / Java 17). Also, distroless has no shell, so no ca-certificates gate can run inside the image.

What changes

• bolt-docker-examples/echo-command-app/Dockerfile:6: gcr.io/distroless/java:11 -> gcr.io/distroless/java17-debian13@sha256:bc5ad38faf0501a7f60859f85f00cfb285639736e2e948a2d98262f5b022a934. This is the latest digest, uploaded 2026-10-21 17:36 UTC.
• Java 17 is the smallest JDK step from 11 that has a rebuilt Debian 13 distroless image. Distroless publishes no Java 11 image on Debian 12 or 13.
• The build stage (gradle:8-jdk11, :1) is unchanged. It does not ship, and the Java 11 bytecode it produces runs on the Java 17 JRE.

Where it ships

• This is an example; nothing in this repo builds it.
  • The final stage is the distroless image (Dockerfile:6), with ENTRYPOINT ["java", "-jar", "/app/slack-app-backend.jar"] at :9.
  • The library itself ships to Maven Central from .github/workflows/release.yml:20-28 and carries no truststore.
• gcr.io/distroless/java:11 is deprecated and built on Debian 11 bullseye (its base-files is 11.1+deb11u3). Bullseye has no fixed ca-certificates package.

Not covered by this PR

• JDK cacerts: Java ignores the OS trust store and validates against the JDK's own cacerts. A JDK release that ships the distrust is needed for each of these:

  • the example JRE (Temurin 17.0.20.1 in this image)
  • the CI matrix (Zulu 8/14/17, .github/workflows/ci-build.yml:17)
  • the release JDK (Zulu 17, .github/workflows/release.yml:23)

  That is an owner follow-up; this PR does not change it.

• The digest pin will not pick up later distroless rebuilds. Bump it, or switch to the floating java17-debian13 tag, as preferred.

Verification

• Rebuild date of the image: the GCR tag list for distroless/java17-debian13 shows latest = sha256:bc5ad38faf05… with timeUploadedMs = 2026-10-21 17:36:26 UTC. The OCI created field is the reproducible-build epoch (1970-01-01), so it cannot be used.
• Contents of the pinned image: /var/lib/dpkg/status.d lists ca-certificates 20250419+deb13u1 (the fixed trixie version) and base-files 13.8+deb13u7.
• docker build --no-cache of the example (Gradle 8.14.6 on JDK 11.0.32.1): BUILD SUCCESSFUL, image built.
• docker run of the image with a dummy SLACK_BOT_TOKEN:
  • java -version reports Temurin-17.0.20.1+1.
  • The app calls POST https://slack.com/api/auth.test. TLS completes and the API answers invalid_auth (dummy token), so the app exits as expected.
• Negative: the old base gcr.io/distroless/java:11 reports base-files 11.1+deb11u3 (bullseye, no fixed package). Neither distroless image has a shell, so no gate is possible.
• CI: Java CI is waiting for maintainer approval (fork PR), and it does not build this example.

🤖 Generated with Claude Code
Part of the eMudhra 53119 CA-distrust remediation (CVE-2026-111943).