[assadriaz]

Why

actions/setup-java with distribution: liberica cannot select BellSoft's fixed .0.3 builds; it installs the regular ones (17.0.21+11, 21.0.13+11, 25.0.5+11 today), and those still trust the roots behind the compromised eMudhra intermediate CAs, including the AAA Certificate Services cross-sign path. Older pins such as 17.0.13 do too.

This repo's CI builds with that JVM and, more importantly, publishes to Maven Central with it: the Sonatype credentials, GPG key passphrase and signed artifacts all go over TLS from that JVM. A MITM with a certificate from those intermediates could capture the publishing credentials or tamper with dependencies pulled into the build.

Temurin's current builds (17.0.21+9, 21.0.13+9, 25.0.5+8) are fixed, and setup-java resolves a floating major to them.

Change

• actions/setup-java: distribution: liberica → temurin, with any pinned patch version replaced by the floating major (same Java major).
• entur/gha-maven-central publish job: pass java_distribution: temurin (its default is liberica).

No other changes. A floating major keeps picking up new Temurin updates without manual bumps.

Verification

verify.sh (OpenJDK CheckCerts + BellSoft 12-chain test, run with the JDK's own java, linux/amd64) on the exact tarballs setup-java resolves today:

JDK	CheckCerts	12-chain test
Liberica 17.0.21+11 (current)	FAIL (emSign ECC Root CA - G3, AAA)	12/12 trusted
Liberica 21.0.13+11 (current)	FAIL	12/12 trusted
Liberica 25.0.5+11 (current)	FAIL	12/12 trusted
Temurin 17.0.21+9 (new)	PASS (only emSign G1/G2, unrelated)	0/12 trusted
Temurin 21.0.13+9 (new)	PASS	0/12 trusted
Temurin 25.0.5+8 (new)	PASS	0/12 trusted

Not covered: advisory -noct- hosts.

Note

Merging triggers the usual publish workflow on the default branch.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.38%. Comparing base (e56f382) to head (6668cba).
⚠️ Report is 81 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #338      +/-   ##
============================================
- Coverage     89.28%   88.38%   -0.90%     
- Complexity      241      243       +2     
============================================
  Files            16       17       +1     
  Lines           821      835      +14     
  Branches         63       70       +7     
============================================
+ Hits            733      738       +5     
- Misses           63       65       +2     
- Partials         25       32       +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.