Update base images to latest patch versions - #64
Conversation
Up to standards ✅🟢 Issues
|
- adoptopenjdk/openjdk8: jre8u462-b08 -> jre8u502-b07 - eclipse-temurin (JDK17): 17.0.18_8-jre-jammy -> 17.0.19_10-jre-jammy - adoptopenjdk/openjdk8-openj9: jre8u462-b08_openj9-0.53.0 -> jre8u482-b08.1_openj9-0.57.0
6295b5a to
e1a3ebd
Compare
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
Codacy results indicate that the pull request meets project standards, with no new quality issues or logic defects identified. The implementation is consistent with the provided acceptance criteria for updating the base image versions for OpenJDK 8 and JDK 17.
No security vulnerabilities or significant logic errors were found that would prevent merging. The primary recommendation is to execute the suggested build verification to confirm the integrity of the updated base image tags.
Test suggestions
- Verify successful Docker build of images using the updated base tags.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify successful Docker build of images using the updated base tags.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
There was a problem hiding this comment.
Pull Request Overview
The PR aims to update Docker base images to their latest patch versions. While the Codacy analysis indicates the changes are up to standards, there are significant maintenance concerns regarding the choice of image providers. The adoptopenjdk namespace is deprecated and no longer receives security updates, which undermines the PR's objective of improving security.
Furthermore, there is an inconsistency regarding the OpenJDK 17 update; the PR description suggests an update that already exists in the provided diff. Finally, the absence of CI configuration changes or test scripts to verify the integrity of the new base images presents a risk to the build pipeline stability.
About this PR
- The PR does not include any CI configuration changes or scripts to verify that the 'docker build' for all four targets still passes with the new base images. Testing should be performed to ensure compatibility and build stability.
- There is a discrepancy regarding the OpenJDK 17 update. The PR description lists a bump to 17.0.19_10-jre-jammy, but the Makefile already contains this version. Please verify if this image was updated in a previous commit or if the description needs correction.
Test suggestions
- Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK (HotSpot 8)
- Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK11
- Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK17
- Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJ9
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK (HotSpot 8)
2. Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK11
3. Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJDK17
4. Missing recommended test scenario: Verify Docker build for BASE_IMAGE_OPENJ9
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| BASE_IMAGE_OPENJDK11=eclipse-temurin:11-jre-focal | ||
| BASE_IMAGE_OPENJDK17=eclipse-temurin:17.0.19_10-jre-jammy | ||
| BASE_IMAGE_OPENJ9=adoptopenjdk/openjdk8-openj9:x86_64-ubuntu-jre8u462-b08_openj9-0.53.0 | ||
| BASE_IMAGE_OPENJ9=adoptopenjdk/openjdk8-openj9:x86_64-ubuntu-jre8u482-b08.1_openj9-0.57.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The adoptopenjdk OpenJ9 images are deprecated and have been succeeded by the IBM Semeru Runtimes. Using the deprecated namespace prevents the build from receiving new security fixes and OpenJ9 improvements. Consider migrating the BASE_IMAGE_OPENJ9 base image to the equivalent ibm-semeru-runtimes namespace.
| OPENJDK11_VERSION?=jre11-$(VERSION) | ||
| OPENJDK17_VERSION?=jre17-$(VERSION) | ||
| BASE_IMAGE_OPENJDK=adoptopenjdk/openjdk8:x86_64-ubuntu-jre8u462-b08 | ||
| BASE_IMAGE_OPENJDK=adoptopenjdk/openjdk8:x86_64-ubuntu-jre8u502-b07 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Suggestion: The adoptopenjdk organization is deprecated and no longer receives security patches. To ensure the build uses a truly up-to-date and secure base image, this should be migrated to its official successor, Eclipse Temurin. Consider updating the BASE_IMAGE_OPENJDK base image in the Makefile to the eclipse-temurin namespace.
1 participant
Summary
adoptopenjdk/openjdk8:jre8u462-b08->jre8u502-b07eclipse-temurin):17.0.18_8-jre-jammy->17.0.19_10-jre-jammyadoptopenjdk/openjdk8-openj9:jre8u462-b08_openj9-0.53.0->jre8u482-b08.1_openj9-0.57.0eclipse-temurin:11-jre-focal) left unpinned/unchanged, floating tag already latestAll new tags verified pullable against Docker Hub registry manifest API.
Test plan