Skip to content

Commit 699d31d

Browse files
gdamsgdams
authored
add gpg verification to downloads (#673)
1 parent 2e34404 commit 699d31d

File tree

47 files changed

+342
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+342
-0
lines changed

‎11/jdk/alpine/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3232
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
3333
fontconfig ttf-dejavu \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# utilities for keeping Alpine and OpenJDK CA certificates in sync
3537
# https://github.com/adoptium/containers/issues/293
3638
ca-certificates p11-kit-trust \
@@ -60,6 +62,12 @@ RUN set -eux; \
6062
;; \
6163
esac; \
6264
wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
65+
wget -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
66+
export GNUPGHOME="$(mktemp -d)"; \
67+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
68+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
69+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
70+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
6371
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
6472
mkdir -p "$JAVA_HOME"; \
6573
tar --extract \

‎11/jdk/ubi/ubi9-minimal/Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ RUN set -eux; \
6767
;; \
6868
esac; \
6969
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
70+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
71+
export GNUPGHOME="$(mktemp -d)"; \
72+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
73+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
74+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
75+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7076
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7177
mkdir -p "$JAVA_HOME"; \
7278
tar --extract \

‎11/jdk/ubuntu/focal/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎11/jdk/ubuntu/jammy/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎11/jdk/ubuntu/noble/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎11/jre/alpine/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3232
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
3333
fontconfig ttf-dejavu \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# utilities for keeping Alpine and OpenJDK CA certificates in sync
3537
# https://github.com/adoptium/containers/issues/293
3638
ca-certificates p11-kit-trust \
@@ -60,6 +62,12 @@ RUN set -eux; \
6062
;; \
6163
esac; \
6264
wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
65+
wget -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
66+
export GNUPGHOME="$(mktemp -d)"; \
67+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
68+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
69+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
70+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
6371
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
6472
mkdir -p "$JAVA_HOME"; \
6573
tar --extract \

‎11/jre/ubi/ubi9-minimal/Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ RUN set -eux; \
6767
;; \
6868
esac; \
6969
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
70+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
71+
export GNUPGHOME="$(mktemp -d)"; \
72+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
73+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
74+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
75+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7076
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7177
mkdir -p "$JAVA_HOME"; \
7278
tar --extract \

‎11/jre/ubuntu/focal/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎11/jre/ubuntu/jammy/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎11/jre/ubuntu/noble/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -69,6 +71,12 @@ RUN set -eux; \
6971
;; \
7072
esac; \
7173
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
74+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
75+
export GNUPGHOME="$(mktemp -d)"; \
76+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
77+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
78+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
79+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7280
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7381
mkdir -p "$JAVA_HOME"; \
7482
tar --extract \

‎17/jdk/alpine/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3232
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
3333
fontconfig ttf-dejavu \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# utilities for keeping Alpine and OpenJDK CA certificates in sync
3537
# https://github.com/adoptium/containers/issues/293
3638
ca-certificates p11-kit-trust \
@@ -63,6 +65,12 @@ RUN set -eux; \
6365
;; \
6466
esac; \
6567
wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
68+
wget -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
69+
export GNUPGHOME="$(mktemp -d)"; \
70+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
71+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
72+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
73+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
6674
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
6775
mkdir -p "$JAVA_HOME"; \
6876
tar --extract \

‎17/jdk/ubi/ubi9-minimal/Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ RUN set -eux; \
6767
;; \
6868
esac; \
6969
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
70+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
71+
export GNUPGHOME="$(mktemp -d)"; \
72+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
73+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
74+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
75+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7076
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7177
mkdir -p "$JAVA_HOME"; \
7278
tar --extract \

‎17/jdk/ubuntu/focal/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -76,6 +78,12 @@ RUN set -eux; \
7678
;; \
7779
esac; \
7880
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
81+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
82+
export GNUPGHOME="$(mktemp -d)"; \
83+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
84+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
85+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
86+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7987
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
8088
mkdir -p "$JAVA_HOME"; \
8189
tar --extract \

‎17/jdk/ubuntu/jammy/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -76,6 +78,12 @@ RUN set -eux; \
7678
;; \
7779
esac; \
7880
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
81+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
82+
export GNUPGHOME="$(mktemp -d)"; \
83+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
84+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
85+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
86+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7987
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
8088
mkdir -p "$JAVA_HOME"; \
8189
tar --extract \

‎17/jdk/ubuntu/noble/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -80,6 +82,12 @@ RUN set -eux; \
8082
;; \
8183
esac; \
8284
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
85+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
86+
export GNUPGHOME="$(mktemp -d)"; \
87+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
88+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
89+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
90+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
8391
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
8492
mkdir -p "$JAVA_HOME"; \
8593
tar --extract \

‎17/jre/alpine/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3232
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
3333
fontconfig ttf-dejavu \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# utilities for keeping Alpine and OpenJDK CA certificates in sync
3537
# https://github.com/adoptium/containers/issues/293
3638
ca-certificates p11-kit-trust \
@@ -60,6 +62,12 @@ RUN set -eux; \
6062
;; \
6163
esac; \
6264
wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
65+
wget -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
66+
export GNUPGHOME="$(mktemp -d)"; \
67+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
68+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
69+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
70+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
6371
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
6472
mkdir -p "$JAVA_HOME"; \
6573
tar --extract \

‎17/jre/ubi/ubi9-minimal/Dockerfile

+6
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ RUN set -eux; \
6767
;; \
6868
esac; \
6969
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
70+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
71+
export GNUPGHOME="$(mktemp -d)"; \
72+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
73+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
74+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
75+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7076
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7177
mkdir -p "$JAVA_HOME"; \
7278
tar --extract \

‎17/jre/ubuntu/focal/Dockerfile

+8
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ RUN set -eux; \
3131
# curl required for historical reasons, see https://github.com/adoptium/containers/issues/255
3232
curl \
3333
wget \
34+
# gnupg required to verify the signature
35+
gnupg \
3436
# java.lang.UnsatisfiedLinkError: libfontmanager.so: libfreetype.so.6: cannot open shared object file: No such file or directory
3537
# java.lang.NoClassDefFoundError: Could not initialize class sun.awt.X11FontManager
3638
# https://github.com/docker-library/openjdk/pull/235#issuecomment-424466077
@@ -73,6 +75,12 @@ RUN set -eux; \
7375
;; \
7476
esac; \
7577
wget --progress=dot:giga -O /tmp/openjdk.tar.gz ${BINARY_URL}; \
78+
wget --progress=dot:giga -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; \
79+
export GNUPGHOME="$(mktemp -d)"; \
80+
# gpg: key 843C48A565F8F04B: "Adoptium GPG Key (DEB/RPM Signing Key) <[email protected]>" imported
81+
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; \
82+
gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; \
83+
rm -r "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; \
7684
echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; \
7785
mkdir -p "$JAVA_HOME"; \
7886
tar --extract \

0 commit comments

Comments
 (0)