CA certs have been compromised in the past.

The right way to fix the issue and prevent problems is using updated JDKs.

The quarterly releases come out on third Tuesday of October etc, which we missed. So unless there's going to an out-of-schedule update, an updated JDK will not come out until January/February of 2027.

The right way to fix the issue and prevent problems is using updated JDKs.

If there's been a communication regarding this vulnerability that might make sense, but without one I disagree that we should wait until January/February of 2027, leaving our CI process vulnerable to attack. blocked.certs exists for this exact purpose.

Please see https://ops.java/emudhra

https://ops.java/emudhra says

1. Manually block the impacted certificates.

So I guess Oracle would be supportive of this PR as well?