alberto-art3ch commented on PR #6693: URL: https://github.com/apache/fineract/pull/6693#issuecomment-6340538755
> @alberto-art3ch Can we pin the base image to an exact Zulu runtime version or digest instead of a floating -jre-headless tag? This keeps the container build reproducible and avoids unexpected upstream changes outside the PR scope. Thanks for the review. I'd keep the floating tag here, for two reasons: 1. Scope: `develop` already uses the floating `azul/zulu-openjdk-alpine:25` tag (it has floated since Jib was introduced in 2022 with `:11`). This PR only switches the variant to `-jre-headless`; pinning is a project-wide policy change that deserves its own ticket. 2. Security: the goal of this PR is dropping the 3 HIGH CVEs that come from Alpine packages in the base image, and those fixes reach us precisely because Azul republishes the floating tag. A digest (or a version tag: Azul does not republish old ones, `25.0.3-jre-headless` was last pushed 2026-07-21) freezes the Alpine package set and the quarterly JDK CPUs, and nothing would bump it automatically since Dependabot's `docker` ecosystem does not parse Jib image strings in `build.gradle`. The build JDK in CI also floats (`java-version: '25'`), so the reproducibility gain would be partial. If we want pinning, I'm happy to open a follow-up that adds the pin together with an automated bump (Renovate regex manager or a small workflow), so the image keeps receiving security updates. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
