Switched to ubi 10 base image and set ACCP default for all crypto

Author: Samin Rahman

Dockerfile

@@ -1,8 +1,5 @@
 # sha from https://hub.docker.com/layers/library/eclipse-temurin/21-jre-alpine-3.23/images/sha256-693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6
-FROM eclipse-temurin:21-jdk-alpine
-
-# For Amazon Corretto Crypto Provider
-RUN apk add --no-cache gcompat
+FROM eclipse-temurin:21-jdk-ubi10-minimal
 
 WORKDIR /app
 EXPOSE 8080

src/main/java/com/uid2/operator/service/CryptoProviderService.java

@@ -7,45 +7,38 @@
 import javax.crypto.KeyAgreement;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
-import java.security.Security;
 
 public class CryptoProviderService {
     private static final Logger LOGGER = LoggerFactory.getLogger(CryptoProviderService.class);
 
-    // ECDH provider selection: tries ACCP first, falls back to default (SunEC)
-    private static final String ECDH_PROVIDER_NAME = initEcdhProvider();
+    // ACCP provider name when available (after install()); null otherwise
+    private static final String ACCP_PROVIDER_NAME = initAccpAsDefault();
 
-    private static String initEcdhProvider() {
-        // Try ACCP (Amazon Corretto Crypto Provider) first
+    private static String initAccpAsDefault() {
         try {
-            // Add ACCP at lowest priority so it doesn't become default for other algorithms            
-            Security.addProvider(AmazonCorrettoCryptoProvider.INSTANCE);
-            
-            // Verify it works for ECDH
-            KeyAgreement ka = KeyAgreement.getInstance("ECDH", AmazonCorrettoCryptoProvider.PROVIDER_NAME);
-            LOGGER.info("ECDH using AmazonCorrettoCryptoProvider (added at lowest priority)");
-            return AmazonCorrettoCryptoProvider.PROVIDER_NAME;
+            AmazonCorrettoCryptoProvider.install();
+            if (AmazonCorrettoCryptoProvider.INSTANCE.getLoadingError() == null) {
+                LOGGER.info("AmazonCorrettoCryptoProvider installed as default for all crypto");
+                return AmazonCorrettoCryptoProvider.PROVIDER_NAME;
+            }
         } catch (Throwable e) {
-            // ACCP not available
             LOGGER.info("AmazonCorrettoCryptoProvider is not available: {}", e.getMessage());
         }
-
-        // Fall back to default provider
-        LOGGER.info("ECDH using default provider (SunEC)");
+        LOGGER.info("Using platform default crypto provider");
         return null;
     }
 
     /**
-     * Create ECDH Key Agreement using ACCP if available, fall back to SunEC if not
+     * Create ECDH Key Agreement. Uses ACCP when installed as default; otherwise platform default (e.g. SunEC).
      * @return ECDH KeyAgreement
      * @throws NoSuchAlgorithmException
      */
-    public static KeyAgreement createKeyAgreement() throws  NoSuchAlgorithmException {
-        if (ECDH_PROVIDER_NAME != null) {
+    public static KeyAgreement createKeyAgreement() throws NoSuchAlgorithmException {
+        if (ACCP_PROVIDER_NAME != null) {
             try {
-                return KeyAgreement.getInstance("ECDH", ECDH_PROVIDER_NAME);
+                return KeyAgreement.getInstance("ECDH", ACCP_PROVIDER_NAME);
             } catch (NoSuchProviderException e) {
-                LOGGER.info("{} is not available: {}", ECDH_PROVIDER_NAME, e.getMessage());
+                LOGGER.info("{} is not available: {}", ACCP_PROVIDER_NAME, e.getMessage());
             }
         }
         return KeyAgreement.getInstance("ECDH");