CCR review: Azul Payara Community 7.2026.5 for Platform 11.0 — hash discrepancies

[Copilot]

Review of the compatibility certification request for Azul Payara Community 7.2026.5 against Jakarta EE Platform 11.0, following the CCR Review Guidance. This is a review-only task; no repository files were changed.

Blocking findings

• Annotations 3.0.0 and Authentication 3.1.0 share the identical SHA-256 (8b916f1b…2dd22cd54). Two distinct archives cannot produce the same hash. Official values:
  • Authentication 3.1.0 → 6ab2e52127de2beabb396879d9d57a8e34bfd23114369b8960d87dd9afec296b
  • Annotations 3.0.0 → 9421c6ca66274d32dfb408848f75a42d57f120599fe0d8403c5c5c1141d5ac4d
• Annotations download URL 404s: jakarta-annotation-tck-3.0.0.zip (singular) → not found; correct artifact is jakarta-annotations-tck-3.0.0.zip (plural).

Needs re-verification

• Hashes for Activation 2.1.2, Batch 2.1.5, Concurrency 3.1.1, CDI 4.1.0, Dependency Injection 2.0.2, Faces 4.1.1, Authorization 3.0.0 do not match the current published .sha256 files. Filer should regenerate all SHA-256 values from the official .sha256 sources.

Verified OK

• Platform TCK link (base URL, HTTP 200) and hash; both attestation checkboxes checked; required TCK set matches accepted CCR Compatibility certification request for Payara Server Community 7.2026.3 for Platform #1274; hashes correct for Debugging, JSON-B, JSON-P, Mail, RESTful WS, Security, Tags, Validation, WebSocket, Pages, Servlet, Persistence, Expression Language, Data.

Not verifiable from sandbox (payara.fish unreachable — manual check needed)

• Product download URL / vendor version match.
• TCK Results Summary page: login-free, permanent, product-hosted, restates required detail, all tests passing.

Recommendation

Not yet ready for approval — correct the Annotations/Authentication hashes and URL, refresh the remaining mismatched hashes, and confirm the results-summary page, then re-review.

[ivargrimstad]

See PR text and issue comment

[Copilot]

See PR text and issue comment

Re-verified against the live download.eclipse.org .sha256 sidecars, which refines the review:

Genuine blocker (confirmed): The 8b916f1b…2dd22cd54 value listed for both Annotations 3.0.0 and Authentication 3.1.0 matches no official sidecar for either spec (Authentication 3.1.0=6ab2e521…, 3.1.1=54647e8d…, 3.1.2=10ce29dd…; Annotations 3.0.0=9421c6ca…). It is a bogus/duplicate hash and must be corrected. The Annotations download URL also 404s — jakarta-annotation-tck-3.0.0.zip (singular) should be jakarta-annotations-tck-3.0.0.zip (plural).

Not filer errors — please disregard my earlier "needs re-verification" flag: The 7 hashes I flagged (Activation, Batch, Concurrency, CDI, Dependency Injection, Faces, Authorization) are character-identical to accepted CCR #1274 and differ only from the current sidecars, i.e. the artifacts were re-staged/rebuilt on download.eclipse.org after #1274 was accepted. Those values were valid at TCK-run time and should not be treated as defects.

Net: the only substantive item to fix is the Annotations/Authentication hash + the Annotations URL typo. Product page and TCK Results Summary still need a manual check (payara.fish is unreachable from this sandbox).