[assadriaz]

Why

actions/setup-java with distribution: liberica cannot select BellSoft's fixed .0.3 builds; it installs the regular ones (17.0.21+11, 21.0.13+11, 25.0.5+11 today), and those still trust the roots behind the compromised eMudhra intermediate CAs, including the AAA Certificate Services cross-sign path. Older pins such as 17.0.13 do too.

This repo's CI builds with that JVM and, more importantly, publishes to Maven Central with it: the Sonatype credentials, GPG key passphrase and signed artifacts all go over TLS from that JVM. A MITM with a certificate from those intermediates could capture the publishing credentials or tamper with dependencies pulled into the build.

Temurin's current builds (17.0.21+9, 21.0.13+9, 25.0.5+8) are fixed, and setup-java resolves a floating major to them.

Change

• actions/setup-java: distribution: liberica → temurin, with any pinned patch version replaced by the floating major (same Java major).
• entur/gha-maven-central publish job: pass java_distribution: temurin (its default is liberica).

No other changes. A floating major keeps picking up new Temurin updates without manual bumps.

Verification

verify.sh (OpenJDK CheckCerts + BellSoft 12-chain test, run with the JDK's own java, linux/amd64) on the exact tarballs setup-java resolves today:

JDK	CheckCerts	12-chain test
Liberica 17.0.21+11 (current)	FAIL (emSign ECC Root CA - G3, AAA)	12/12 trusted
Liberica 21.0.13+11 (current)	FAIL	12/12 trusted
Liberica 25.0.5+11 (current)	FAIL	12/12 trusted
Temurin 17.0.21+9 (new)	PASS (only emSign G1/G2, unrelated)	0/12 trusted
Temurin 21.0.13+9 (new)	PASS	0/12 trusted
Temurin 25.0.5+8 (new)	PASS	0/12 trusted

Not covered: advisory -noct- hosts.

Note

Merging triggers the usual publish workflow on the default branch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud