Repository navigation
fix(infra): JRE 25.0.5+8 고정 + eMudhra 루트 cacerts 제거 - #385
Merged
Merged
Conversation
eMudhra 중간 CA 키 유출(CVE-2026-91403·CVE-2026-114820)로 Java 가 위조 인증서를 정상으로 믿을 수 있다. prod 는 25.0.4.1+1 이라 emSign 루트 4개를 모두 신뢰하고 있었고, 최신 Temurin 25.0.5+8 에도 emSign Root CA - G1 이 남아 있다(OpenJDK 원본 수정 JDK-8395690 은 이것도 뺀다). 빌드 때 이 회사 루트를 모두 지우고, 하나라도 남으면 빌드를 실패시킨다. 서버가 부르는 외부 호스트는 GlobalSign·DigiCert·Starfield·ISRG 루트라 영향이 없다. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Test Coverage
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
배경
eMudhra 중간 CA 키 유출(CVE-2026-91403·CVE-2026-114820) — Java 가 위조 인증서를 정상으로 믿을 수 있다.
변경
Dockerfile.deploy런타임을eclipse-temurin:25.0.5_8-jre로 고정(떠다니는25-jre대신)emsign|emudhra루트를 cacerts 에서 지우고, 남으면 빌드 실패영향
서버가 부르는 외부 호스트 체인 맨 위(2026-10-30 확인): Google 계열 GlobalSign, 카카오·네이버·Apple DigiCert G2, AWS Starfield G2, Slack ISRG X1 — emSign 없음.
로컬 이미지에서 118 → 117개, emSign 0개 확인.
확인
stg 배포 후 로그인(카카오·구글)·푸시·Gemini 호출 정상 → dev→main.
🤖 Generated with Claude Code