rework java build #1902

loosebazooka · 2025-10-25T18:17:13Z

splits into reusable parts
- old builds should be cleared out when we deprecated debian12 and the java.bzl file will be much smaller
add libbz which is required by font config (this took longer that it should've to figure out)
use temurin from adoptium deb sources (not github releases)
- temurin 25 github releases replaced with official deb
- temurin 25 on debian 13 cacerts points to system certs
- confirmed with maintainers that the pool is additive, and references should exist for the life of the project
- we will no longer use github releases
update some java base image references in debian13 (use t64 suffix)

gemini-code-assist · 2025-10-25T18:17:50Z

Summary of Changes

Hello @loosebazooka, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request undertakes a significant rework of the Java build system, primarily focusing on modularity and updating dependency sourcing. The changes aim to simplify the build process by centralizing logic in a new Bazel file, transitioning Java 25 Temurin images to more reliable official Debian sources, and ensuring compatibility with Debian 13's updated package naming conventions. These improvements contribute to a more maintainable and robust Java image generation pipeline.

Highlights

Reworked Java Build Structure: The Java build system has been refactored into reusable parts, moving common logic into a new java.bzl file. This significantly reduces the size and complexity of the main java/BUILD file and aims to streamline future Java image definitions.
Switched Temurin Source for Java 25: Java 25 Temurin images are now sourced from official Adoptium debian repositories instead of GitHub releases. This change affects Debian 13 builds and ensures a more consistent and officially supported distribution channel.
Dependency Update for Fontconfig: The libbz2-1.0 library has been added as a required dependency for fontconfig, ensuring proper functionality for Java images that rely on font rendering.
Deprecation of Old Temurin Versions: Temurin Java 17 and Java 25 (from GitHub releases) have been removed from the build configuration, aligning with the deprecation of Debian 12 and the new Adoptium deb source strategy for Java 25.
Debian 13 Package Naming Updates: Java base image references for Debian 13 have been updated to reflect the t64 suffix for certain libraries (e.g., libglib2.0-0t64, libpng16-16t64), which is a change in Debian's package naming convention.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request is a great refactoring of the Java build definitions. Moving the logic from the BUILD file into a dedicated .bzl file with reusable functions significantly improves maintainability and readability. The switch to using Temurin from Adoptium's deb sources for Debian 13 is a good move towards more standard package management. The changes are well-structured and the PR description is clear. I've found a few minor issues, mostly related to code cleanup and documentation clarity in the new java.bzl file.

gemini-code-assist · 2025-10-25T18:19:52Z

java/java.bzl

+            tars = [
+                deb.package(arch, distro, "libharfbuzz0b"),
+                deb.package(arch, distro, "libgraphite2-3"),
+                deb.package(arch, distro, "libpcre2-8-0"),  # required for libharfbuzz0b but remove for temurin installs


The comment for libpcre2-8-0 states it should be removed for temurin installs. However, java_temurin_image_from_adoptium_debs (which is a temurin install) uses java_base which includes this package. This seems contradictory. Could you please clarify if this package is needed for temurin images from adoptium debs? If it's not needed, perhaps java_temurin_image_from_adoptium_debs should use java_build_base as its base image to avoid including unnecessary dependencies.

java/java.bzl

github-actions · 2025-10-25T18:37:02Z

🌳 🔄 Image Check

This pull request has modified the following images:

//java:java_base_nonroot_amd64_debian12
//java:java_base_root_amd64_debian12
//java:java_base_debug_nonroot_amd64_debian12
//java:java_base_debug_nonroot_amd64_debian12
//java:java_base_debug_root_arm64_debian12
//java:java_base_root_amd64_debian12
//java:java_base_debug_nonroot_arm64_debian12
//java:java_base_debug_nonroot_s390x_debian12
//java:java_base_debug_root_ppc64le_debian12
//java:java_base_debug_root_amd64_debian12
//java:java_base_nonroot_s390x_debian12
//java:java_base_nonroot_amd64_debian12
//java:java_base_root_s390x_debian12
//java:java_base_root_arm64_debian12
//java:java17_nonroot_s390x_debian12
//java:java_base_nonroot_ppc64le_debian12
//java:java21_root_arm64_debian12
//java:java21_nonroot_amd64_debian12
//java:java17_debug_nonroot_amd64_debian12
//java:java17_nonroot_amd64_debian12
//java:java_base_debug_nonroot_ppc64le_debian12
//java:java17_debug_root_ppc64le_debian12
//java:java21_nonroot_ppc64le_debian12
//java:java17_root_amd64_debian12
//java:java17_root_s390x_debian12
//java:java21_root_amd64_debian12
//java:java21_debug_root_ppc64le_debian12
//java:java_base_root_ppc64le_debian12
//java:java17_nonroot_ppc64le_debian12
//java:java17_debug_nonroot_ppc64le_debian12
//java:java21_debug_root_amd64_debian12
//java:java21_debug_nonroot_amd64_debian12
//java:java21_debug_nonroot_ppc64le_debian12
//java:java21_debug_root_arm64_debian12
//java:java_base_debug_root_amd64_debian12
//java:java17_root_amd64_debian12
//java:java_base_nonroot_arm64_debian12
//java:java25_debug_root_ppc64le_debian13
//java:java25_root_ppc64le_debian13
//java:java21_root_ppc64le_debian12
//java:java25_debug_nonroot_arm64_debian13
//java:java21_root_s390x_debian12
//java:java_base_debug_root_s390x_debian12
//java:java17_debug_root_amd64_debian12
//java:java25_root_s390x_debian13
//java:java17_debug_nonroot_arm64_debian12
//java:java17_nonroot_amd64_debian12
//java:java21_nonroot_arm64_debian12
//java:java17_debug_root_amd64_debian12
//java:java25_debug_nonroot_s390x_debian13
//java:java21_debug_nonroot_arm64_debian12
//java:java25_nonroot_s390x_debian13
//java:java25_debug_nonroot_ppc64le_debian13
//java:java21_nonroot_s390x_debian12
//java:java25_nonroot_ppc64le_debian13
//java:java25_debug_root_amd64_debian13
//java:java21_debug_nonroot_s390x_debian12
//java:java25_root_amd64_debian13
//java:java17_debug_root_s390x_debian12
//java:java25_root_arm64_debian13
//java:java17_debug_root_arm64_debian12
//java:java25_debug_root_s390x_debian13
//java:java17_debug_nonroot_s390x_debian12
//java:java25_debug_root_arm64_debian13
//java:java25_debug_nonroot_amd64_debian13
//java:java25_nonroot_arm64_debian13
//java:java17_root_arm64_debian12
//java:java17_nonroot_arm64_debian12
//java:java17_root_ppc64le_debian12
//java:java17_debug_nonroot_amd64_debian12
//java:java21_debug_root_s390x_debian12
//java:java25_nonroot_amd64_debian13

You can check the details in the report here

- splits into reusable parts - old builds should be cleared out when we deprecated debian12 and the java.bzl file will be much smaller - add libbz which is required by font config - use temurin from adoptium deb sources (not github releases) - temurin 25 github releases replaced with official deb - temurin 25 on debian 13 cacerts points to system certs - confirmed with maintainers that the pool is additive, and references should exist for the life of the project - we will no longer use github releases - update some java base image references in debian13 (use t64 suffix) Signed-off-by: Appu Goundan <appu@google.com>

loosebazooka requested review from bobcallaway and thesayyn October 25, 2025 18:17

loosebazooka mentioned this pull request Oct 25, 2025

Unable to execute java command in distroless image java25-debian13 on linux/arm64 environment #1898

Closed

gemini-code-assist bot reviewed Oct 25, 2025

View reviewed changes

loosebazooka force-pushed the rework_build_2 branch from ad6f996 to fa34df4 Compare October 26, 2025 22:31

loosebazooka mentioned this pull request Oct 27, 2025

java 21 distroless base images contain unpatched CVEs (CVE-2025-53066, CVE-2025-53057) #1906

Closed

loosebazooka force-pushed the rework_build_2 branch from fa34df4 to 07eb0a9 Compare October 28, 2025 12:00

loosebazooka force-pushed the rework_build_2 branch from 07eb0a9 to f12e3f8 Compare October 28, 2025 12:11

bobcallaway approved these changes Oct 28, 2025

View reviewed changes

loosebazooka merged commit 428f67f into main Oct 28, 2025
11 checks passed

loosebazooka deleted the rework_build_2 branch October 28, 2025 12:35

loosebazooka mentioned this pull request Oct 29, 2025

rework nodejs build, add deb13 #1911

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

rework java build #1902

rework java build #1902

Uh oh!

loosebazooka commented Oct 25, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Oct 25, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Oct 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 25, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rework java build #1902

rework java build #1902

Uh oh!

Conversation

loosebazooka commented Oct 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot commented Oct 25, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Oct 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Oct 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

loosebazooka commented Oct 25, 2025 •

edited

Loading

github-actions bot commented Oct 25, 2025 •

edited

Loading