End of transition - no more updates to -140-2 jdk-fips/jre-fips tags

Hello, 

On August 12, 2024 Chainguard FIPS Java images migrated from BC-FJA 1.0 to BC-FJA 2.0 with support for FIPS 140-3. The previous email communicating this change was titled “Java FIPS 140-3 Base Images Available in Your Registry”.

We want to remind you that the BC-FJA 2.0 transition that started in August 2024 is now coming to an end. The optional -140-2/-140-3 suffixed tags will no longer be updated starting April 22, 2025, which impacts jdk-fips & jre-fips images. The tags will remain published, but please ensure you stop using them for new deployments after April 22, 2025. The updates to the optional tags are now ending.

What is changing?

• Jdk-fips and jre-fips images -140-2 and -140-3 optional tags will no longer be updated

Why is Chainguard making this change?

• BC-FJA 1.0 FIPS certificate is now historical
• It has not been suitable for any new deployments or procurement by US and Canadian governments since August 2024
• Chainguard has provided six additional months to allow transitions, and can no longer maintain these as they are not recommended

How will this affect me?

• -140-3 and -140-2 tags will continue to be available in your registries
• These tags will no longer be updated
• Suffix-less tags will continue to be supported

What do I need to do?

• After April 22, 2025 stop using -140-2 and -140-3 suffixed tags
• Ensure you only use suffixless tags

Need help or have questions?

We're here for you. Drop us a line at support.chainguard.dev and we’d be happy to help.

Your friends at Chainguard