Address feedback: fix IMAGE_REVISION handling and improve SSL certificate validation

[Copilot]

Addresses feedback from PR #52 on build script robustness and SSL certificate validation security.

Changes

• build.ps1: Trim and join IMAGE_REVISION content before checking. Prevents trailing dashes in image tags when metadata files contain only whitespace.

  $Revision = (Get-Content ... | ForEach-Object { $_.Trim() }) -join ""
  if ($Revision -and $Revision -ne "") { ... }

• SslTrustConfiguration.java: Replace string-based DN matching with cryptographic signature verification. Checks CA basic constraints before trusting signed certificates.

  boolean isCA = devCert.getBasicConstraints() != -1;
  if (!isCA) continue;
  cert.verify(devCert.getPublicKey());  // Cryptographic validation

• Added error handling for missing ADDITIONAL_TAGS files

Security

CodeQL scan: 0 alerts

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• start.spring.io
  • Triggering command: /usr/bin/pwsh pwsh ./build.ps1 -Name eureka-server (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR addresses feedback from PR #52 by improving the robustness of the build script and enhancing SSL certificate validation security. The changes fix edge cases in image tag generation and replace string-based certificate matching with cryptographic verification.

Changes:

• Fixed IMAGE_REVISION handling to prevent malformed image tags when metadata files contain only whitespace
• Added error handling for missing ADDITIONAL_TAGS and IMAGE_REVISION metadata files
• Replaced insecure DN string-based certificate matching with cryptographic signature verification and CA basic constraints checking

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
build.ps1	Added trimming and error handling for IMAGE_REVISION and ADDITIONAL_TAGS metadata files to prevent build failures and malformed image tags
shared/ssl-config/SslTrustConfiguration.java	Replaced string-based DN matching with cryptographic signature verification and added CA basic constraints checking to improve certificate validation security

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.