Example files

Article: https://youdozi.github.io/en/posts/2026-10-30-jdk-emudhra-truststore/

Extract into a new empty directory and run commands from that directory.

Environment
JDK 17 or later with javac and java; standard APIs only. No network request is made by the collector.

Commands
javac --release 17 TrustInventory.java
java TrustInventory

Scope
Reads the new JVM and its default JSSE trust initialization. CA name candidates and SHA-256 fingerprints are inventory, not a protection verdict. No store modification, external TLS handshake, revocation/path validation or signed-JAR test. Does not discover existing services or application-created SSL contexts.

Read the article for outputs, conditions and failure cases. PROVENANCE.json records the source and file hashes; hashes establish identity, not correctness.
