Tag

#java

Tagged “java”

2 articles

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.

Jul 9, 2026 · Tomás Vega Security & supply chain

Chainguard's drop-in Java libraries trade a framework upgrade for an SLA

Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.

Jun 25, 2026 · Tomás Vega