Stop trusting compromised eMudhra roots in the exploration-tests image

dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests

@@ -1,5 +1,14 @@
 FROM debian:bookworm-slim
 
+ARG JAVA_11_VERSION=11.0.32.1+1-tem
+ARG JAVA_17_VERSION=17.0.21.0+9-tem
+
+RUN apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates && \
+    apt-get install -y --only-upgrade ca-certificates && \
+    update-ca-certificates -f && \
+    rm -rf /var/lib/apt/lists/*
+
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y procps tini build-essential git curl unzip zip && \
     apt-get -y clean && \
@@ -12,9 +21,32 @@ RUN curl -fsSL --retry 5 --retry-delay 2 --retry-connrefused -o /tmp/sdkman-inst
     rm /tmp/sdkman-install.sh
 RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && \
     sdk env install && \
-    sdk install java 17.0.10-tem && \
+    sdk install java ${JAVA_11_VERSION} && \
+    sdk install java ${JAVA_17_VERSION} && \
     sdk flush"
 
+ENV JAVA_11_HOME=/root/.sdkman/candidates/java/${JAVA_11_VERSION}
+# Keep OkHttp's Java 11 test launcher on the scrubbed image JDK, not a runtime download.
+RUN mkdir -p "$HOME/.gradle" && \
+    printf '%s\n' \
+      "org.gradle.java.installations.paths=$JAVA_11_HOME,$HOME/.sdkman/candidates/java/8.0.372-tem,$HOME/.sdkman/candidates/java/${JAVA_17_VERSION}" \
+      'org.gradle.java.installations.auto-download=false' > "$HOME/.gradle/gradle.properties"
+
+# Distrust the affected roots before Maven or Gradle downloads any build inputs.
+RUN set -eu; \
+    keytool="$HOME/.sdkman/candidates/java/${JAVA_17_VERSION}/bin/keytool"; \
+    find "$HOME/.sdkman/candidates/java" -type f -path '*/lib/security/cacerts' | \
+    while IFS= read -r store; do \
+      listing=$("$keytool" -list -v -keystore "$store" -storepass changeit); \
+      aliases=$(printf '%s\n' "$listing" | \
+        awk '/^Alias name: / { alias = substr($0, 13) } /^Owner: .*([eE]mSign (ECC )?Root CA - G[123]|AAA Certificate Services)/ { print alias }'); \
+      if [ -n "$aliases" ]; then \
+        printf '%s\n' "$aliases" | while IFS= read -r alias; do \
+          "$keytool" -delete -keystore "$store" -storepass changeit -alias "$alias"; \
+        done; \
+      fi; \
+    done
+
 RUN mkdir exploration-tests
 WORKDIR /exploration-tests
 # jsoup
@@ -49,4 +81,33 @@ RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && cd jackson-databind && m
 RUN git clone -b okhttp_5.3.x https://github.com/square/okhttp.git
 COPY okhttp_exploration-tests.patch .
 RUN cd okhttp && git apply /exploration-tests/okhttp_exploration-tests.patch
-RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && sdk use java 17.0.10-tem && cd okhttp && ./gradlew dependencies"
+RUN bash -c "source $HOME/.sdkman/bin/sdkman-init.sh && sdk use java ${JAVA_17_VERSION} && cd okhttp && ./gradlew dependencies"
+
+# Older google-api-client artifacts embed independent Google truststores.
+RUN set -eu; \
+    keytool="$HOME/.sdkman/candidates/java/${JAVA_17_VERSION}/bin/keytool"; \
+    find "$HOME/.gradle" -type f -name 'google-api-client-*.jar' | \
+    while IFS= read -r archive; do \
+      for entry in com/google/api/client/googleapis/google.p12 com/google/api/client/googleapis/google.jks; do \
+        if unzip -Z1 "$archive" | grep -Fxq "$entry"; then \
+          scratch="$(mktemp -d)"; \
+          mkdir -p "$scratch/com/google/api/client/googleapis"; \
+          unzip -p "$archive" "$entry" > "$scratch/$entry"; \
+          listing=$("$keytool" -list -v -keystore "$scratch/$entry" -storepass notasecret); \
+          aliases=$(printf '%s\n' "$listing" | \
+            awk '/^Alias name: / { alias = substr($0, 13) } /^Owner: .*([eE]mSign (ECC )?Root CA - G[123]|AAA Certificate Services)/ { print alias }'); \
+          if [ -n "$aliases" ]; then \
+            printf '%s\n' "$aliases" | while IFS= read -r alias; do \
+              "$keytool" -delete -keystore "$scratch/$entry" -storepass notasecret -alias "$alias"; \
+            done; \
+            (cd "$scratch" && zip -q "$archive" "$entry"); \
+          fi; \
+          rm -rf "$scratch"; \
+        fi; \
+      done; \
+    done
+
+# Do not publish Gradle's generated API jar with its old embedded CA snapshot.
+RUN if [ -d "$HOME/.gradle/caches" ]; then \
+      find "$HOME/.gradle/caches" -type f -path '*/generated-gradle-jars/gradle-api-*.jar' -delete; \
+    fi