From 4b1c0511d0ec14eb9f4c437984dcb299f9016162 Mon Sep 17 00:00:00 2001 From: Adam Chrapkowski Date: Thu, 29 Oct 2026 13:50:06 +0100 Subject: [PATCH 1/2] fix/security: update Java image dependencies The image bundles vulnerable Guava and Tika versions through its build tools. Refresh Coursier, Maven and Gradle, apply available OS updates, and pin Guava 33.7.2-jre in the indexer and build-tool distributions. Build a standalone Coursier JVM launcher with Tika 3.2.2 while preserving the system trust store. Remove bootstrap and Gradle build caches before their image layers are created. --- Dockerfile | 5 ++--- bin/docker-setup.sh | 30 +++++++++++++++++++++++------- gradle/libs.versions.toml | 2 ++ scip-shared/build.gradle.kts | 5 +++++ 4 files changed, 32 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index fa52d09bf..48938bfbf 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM eclipse-temurin:25@sha256:3ab7fc8d0b4ade8fef96903fb36767c1dbb4fd1535dcfad85 # ca-certificates is listed so that the base image's copy is upgraded to the # latest Ubuntu release, which carries CA distrusts such as the eMudhra one. -RUN apt-get update && apt-get install --yes ca-certificates jq wget curl zip unzip git python3 python3-pip autoconf automake libtool build-essential libtool make g++ +RUN apt-get update && apt-get upgrade --yes && apt-get install --yes ca-certificates jq wget curl zip unzip git python3 python3-pip autoconf automake libtool build-essential libtool make g++ && rm -rf /var/lib/apt/lists/* WORKDIR /workdir @@ -12,7 +12,6 @@ RUN ./docker-setup.sh ENV PATH=/opt/maven/bin:${PATH} ENV PATH=/opt/gradle/bin:${PATH} -ENV PATH=/root/.local/share/coursier/bin:${PATH} # The trust store is generated by docker-setup.sh. Setting it here also covers # JDKs that coursier downloads at runtime, e.g. for `"jvm": "11"`. @@ -21,7 +20,7 @@ RUN git config --global --add safe.directory * COPY . . -RUN gradle --no-daemon :scip-java:installDist && mkdir -p /app/scip-java && cp -R scip-java/build/install/scip-java/. /app/scip-java/ +RUN gradle --no-daemon :scip-java:installDist && mkdir -p /app/scip-java && cp -R scip-java/build/install/scip-java/. /app/scip-java/ && rm -rf /root/.gradle COPY ./bin/scip-java-docker-script.sh /usr/bin/scip-java diff --git a/bin/docker-setup.sh b/bin/docker-setup.sh index 11757f553..f0e73243d 100755 --- a/bin/docker-setup.sh +++ b/bin/docker-setup.sh @@ -1,22 +1,38 @@ #!/usr/bin/env bash set -eux -curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.5/coursier +curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.26/coursier chmod +x /usr/local/bin/cs -ln -sf /usr/local/bin/cs /usr/local/bin/coursier -# Only install the JVM launcher. The native `cs` app embeds the trust store of -# the GraalVM it was built with, so it ignores the trust store set up below. -cs setup --yes --apps coursier +# Keep a JVM launcher so the system trust store applies. Resolve Tika explicitly +# because Coursier 2.1.26 still depends on a version affected by CVE-2025-66516. +cs bootstrap io.get-coursier:coursier-cli_3:2.1.26 \ + --main-class coursier.cli.Coursier \ + --force-version org.apache.tika:tika-core:3.2.2 \ + --standalone -o /usr/local/lib/coursier.jar +rm /usr/local/bin/cs +ln -s /usr/local/lib/coursier.jar /usr/local/bin/cs +ln -s /usr/local/lib/coursier.jar /usr/local/bin/coursier +# The standalone launcher contains its resolved dependencies; discard the +# bootstrap launcher's old dependency cache, which is no longer used. +rm -rf /root/.cache/coursier/v1 -curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.1/binaries/apache-maven-3.9.1-bin.zip +curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip unzip -d /opt/maven maven.zip rm maven.zip mv /opt/maven/*/* /opt/maven -curl -fLo gradle.zip https://services.gradle.org/distributions/gradle-9.4.1-bin.zip +curl -fLo gradle.zip https://services.gradle.org/distributions/gradle-9.8.2-bin.zip unzip -d /opt/gradle gradle.zip rm gradle.zip mv /opt/gradle/*/* /opt/gradle +# Both distributions bundle Guava versions affected by CVE-2026-102554. +GUAVA_VERSION=33.7.2-jre +curl -fLo "/opt/maven/lib/guava-$GUAVA_VERSION.jar" "https://repo.maven.apache.org/maven2/com/google/guava/guava/$GUAVA_VERSION/guava-$GUAVA_VERSION.jar" +cp "/opt/maven/lib/guava-$GUAVA_VERSION.jar" /opt/gradle/lib/ +rm /opt/maven/lib/guava-33.6.0-jre.jar /opt/gradle/lib/guava-33.4.6-jre.jar +# Gradle's dependency metadata names the JAR as well as its version. +sed -i "s/33.4.6-jre/$GUAVA_VERSION/g" /opt/gradle/lib/guava.properties + # The JVMs trust the system CA store instead of their bundled cacerts, so CA # distrusts shipped in Ubuntu's ca-certificates (e.g. emSign ECC Root CA - G3 # after the eMudhra compromise) apply to them without waiting for JDK releases. diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index d5196d3f0..8c3e3a5f2 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,6 +1,7 @@ [versions] clikt = "5.1.0" gradle-api = "8.11.1" +guava = "33.7.2-jre" junit-jupiter = "5.11.4" kctfork = "0.14.0" kotest = "6.2.6" @@ -21,6 +22,7 @@ vanniktech-maven-publish = "0.37.0" clikt-jvm = { module = "com.github.ajalt.clikt:clikt-jvm", version.ref = "clikt" } gradle-api = { module = "dev.gradleplugins:gradle-api", version.ref = "gradle-api" } gradle-test-kit = { module = "dev.gradleplugins:gradle-test-kit", version.ref = "gradle-api" } +guava = { module = "com.google.guava:guava", version.ref = "guava" } kctfork-core = { module = "dev.zacsweers.kctfork:core", version.ref = "kctfork" } kotest-assertions-core = { module = "io.kotest:kotest-assertions-core-jvm", version.ref = "kotest" } kotlin-compiler-embeddable = { module = "org.jetbrains.kotlin:kotlin-compiler-embeddable", version.ref = "kotlin" } diff --git a/scip-shared/build.gradle.kts b/scip-shared/build.gradle.kts index f046f5572..2b35f30cb 100644 --- a/scip-shared/build.gradle.kts +++ b/scip-shared/build.gradle.kts @@ -7,4 +7,9 @@ description = "Shared SCIP utilities used by scip-java compiler plugins" dependencies { api(libs.scip.java.bindings) + constraints { + api(libs.guava) { + because("CVE-2026-102554") + } + } } From 16ad15106c5cc8a50e5b5f5c32b1768bc5758b1e Mon Sep 17 00:00:00 2001 From: Adam Chrapkowski Date: Thu, 29 Oct 2026 16:19:48 +0100 Subject: [PATCH 2/2] fix/security: retain upstream Java tool distributions Use the upstream Coursier JVM launcher and leave Maven and Gradle bundled dependencies unchanged instead of maintaining custom tool distributions. Keep the tool upgrades, application Guava constraint, OS updates, and unused Gradle build-cache cleanup. Remove the Guava JAR replacements and Gradle metadata rewrite. Remove the custom Coursier bootstrap and Tika override, retaining the runtime cache required by the upstream launcher and the system trust-store behavior. The Tika CVE remains a package finding, but its vulnerable XML parsing path is not reached by Coursier 2.1.26 archive detection. Source inspection and targeted checks against unpatched Tika 2.9.4 support that assessment; they do not establish image-wide safety or Guava exploitability. --- bin/docker-setup.sh | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/bin/docker-setup.sh b/bin/docker-setup.sh index f0e73243d..b5707e7f3 100755 --- a/bin/docker-setup.sh +++ b/bin/docker-setup.sh @@ -1,19 +1,9 @@ #!/usr/bin/env bash set -eux +# Use the upstream JVM launcher so the configured system trust store applies. curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.26/coursier chmod +x /usr/local/bin/cs -# Keep a JVM launcher so the system trust store applies. Resolve Tika explicitly -# because Coursier 2.1.26 still depends on a version affected by CVE-2025-66516. -cs bootstrap io.get-coursier:coursier-cli_3:2.1.26 \ - --main-class coursier.cli.Coursier \ - --force-version org.apache.tika:tika-core:3.2.2 \ - --standalone -o /usr/local/lib/coursier.jar -rm /usr/local/bin/cs -ln -s /usr/local/lib/coursier.jar /usr/local/bin/cs -ln -s /usr/local/lib/coursier.jar /usr/local/bin/coursier -# The standalone launcher contains its resolved dependencies; discard the -# bootstrap launcher's old dependency cache, which is no longer used. -rm -rf /root/.cache/coursier/v1 +ln -sf /usr/local/bin/cs /usr/local/bin/coursier curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip unzip -d /opt/maven maven.zip @@ -25,14 +15,6 @@ unzip -d /opt/gradle gradle.zip rm gradle.zip mv /opt/gradle/*/* /opt/gradle -# Both distributions bundle Guava versions affected by CVE-2026-102554. -GUAVA_VERSION=33.7.2-jre -curl -fLo "/opt/maven/lib/guava-$GUAVA_VERSION.jar" "https://repo.maven.apache.org/maven2/com/google/guava/guava/$GUAVA_VERSION/guava-$GUAVA_VERSION.jar" -cp "/opt/maven/lib/guava-$GUAVA_VERSION.jar" /opt/gradle/lib/ -rm /opt/maven/lib/guava-33.6.0-jre.jar /opt/gradle/lib/guava-33.4.6-jre.jar -# Gradle's dependency metadata names the JAR as well as its version. -sed -i "s/33.4.6-jre/$GUAVA_VERSION/g" /opt/gradle/lib/guava.properties - # The JVMs trust the system CA store instead of their bundled cacerts, so CA # distrusts shipped in Ubuntu's ca-certificates (e.g. emSign ECC Root CA - G3 # after the eMudhra compromise) apply to them without waiting for JDK releases.