[damccorm]

Follow-up to #40696 and #40811:

• Bump httplib2 from 0.32.0 to 0.32.1 across all Python and ML container image requirements files (0.32.1 removes the distrusted eMudhra / emSign CA roots from httplib2/cacerts.txt).
• Remove the remaining distrusted emsign / emudhra root CA entries from the OpenJDK cacerts truststore in the Java SDK, distroless Java SDK, expansion service, transform service, Flink job server, and Spark job server container images.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.39%. Comparing base (0f1ac43) to head (70fe933).
⚠️ Report is 22 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #40889       +/-   ##
===========================================
+ Coverage        0   56.39%   +56.39%     
===========================================
  Files           0      876      +876     
  Lines           0   154798   +154798     
===========================================
+ Hits            0    87303    +87303     
- Misses          0    65635    +65635     
- Partials        0     1860     +1860     

Flag	Coverage Δ
go	28.91% <ø> (?)
python	79.81% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

📋 Review Summary

This PR bumps httplib2 from 0.32.0 to 0.32.1 across all Python and ML container image requirements files and removes distrusted eMudhra / emSign root CA certificates from the OpenJDK cacerts truststores across the Java SDK, distroless Java SDK, expansion service, transform service, Flink job server, and Spark job server container images. The changes are clean, consistent, and ready to merge.

🔍 General Feedback

• The keytool pipeline handles both Java 8 (jre/lib/security/cacerts) and Java 11+ (lib/security/cacerts) paths in sdks/java/container/Dockerfile and remains safe/idempotent if upstream base images remove these certificates in the future.
• Copying the sanitized cacerts into /etc/ssl/certs/java/cacerts in sdks/java/container/distroless/Dockerfile properly updates the truststore used by the distroless Java runtime.

---

💡 Tip: Comment /gemini review on this pull request to trigger a new Gemini code review.

[github-actions]

Assigning reviewers:

R: @chamikaramj for label java.
Backup reviewer: Abacn (if the main reviewer is unresponsive, you can escalate to them by tagging their username)

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).