CCR review: Azul Payara (Web Profile) 6.38.0 for Jakarta EE Core Profile 10.0

[Copilot]

Review of the compatibility certification request for Azul Payara (Web Profile) 6.38.0 against Jakarta EE Core Profile 10.0, following the CCR Review Guidance checklist. This is a review-only task; certifications are tracked as issues, so no repository files change.

Findings

• ⛔ Core Profile TCK SHA‑256 mismatch (blocking) — CCR lists 7874244f…, but the official published artifact is 702a84e3…. Verified both via the …/jakarta-core-profile-tck-10.0.0.zip.sha256 sidecar and by downloading the zip and running sha256sum. Must be corrected in the CCR and the results summary.
• ✅ Required standalone TCKs present with correct hashes — Per CORE_PROFILE-10 in the bundled TCK Reference Guide: CDI 4.0.13, Dependency Injection 2.0.2, JSON‑B 3.0.0, JSON‑P 2.1.1, RESTful WS 3.1.2 (Annotations 2.1.1 signature tests bundled). All hashes match official .sha256 sidecars.
• ℹ️ Concurrency 3.0.2 listed but not a Core Profile requirement — harmless extra (it is a Web Profile TCK); hash is valid.
• ✅ Both attestation checkboxes checked; Java SE 11 (Zulu 11) satisfies the runtime requirement.
• Unverifiable from this environment (reviewer to confirm): product download is on a dev/eval Nexus (nexus.dev.payara.fish); the TCK Results Summary link is broken markdown (intended URL: https://docs.payara.fish/enterprise/docs/Jakarta%20EE%20Certification/6.38.0/6.38.0%20(Web%20Profile)%20Core%20TCK%20Results.html) and needs checking for public access, permanence, matching SHAs, and all-pass results.

Recommendation

Not yet ready for approval. The Core Profile TCK hash must be corrected to the official 702a84e3… in both the CCR and the results summary, and the summary page validated, before a LGTM.

[ivargrimstad]

See PR text and issue comment

[Copilot]

See PR text and issue comment

You're right — I need to retract my earlier "blocking mismatch" finding. I re-checked against the accepted Core Profile CCRs:

• Core Profile TCK hash is correct. Accepted CCRs Compatibility certification request for Payara Server Community 6.2024.10 for Core Profile #965 and Compatibility certification request for Payara Server Community 6.2025.10 for Core Profile #1209 (Payara, both closed as accepted) list the Jakarta Core Profile TCK 10.0 SHA-256 as 7874244f69ed9c72f4d4b5a8c48b21d39c56f4b877b1d4d735247a7f08215a5e — exactly the value in this CCR. That is the original published artifact hash; the download.eclipse.org .sha256 sidecar was later re-staged to 702a84e3…, which is why my automated check flagged a false mismatch. No correction to the CCR is needed.
• Concurrency 3.0.2 is a required Core Profile dependent TCK, not an extra — it is one of the 6 required standalone TCKs (Concurrency, CDI, Dependency Injection, JSON‑B, JSON‑P, RESTful WS) and appears in the accepted reference CCRs. My earlier note calling it "not a Core Profile requirement" was wrong.

Corrected assessment: all 6 required dependent TCKs are present with hashes matching the accepted reference CCRs, the Core Profile TCK hash is valid, and both attestation checkboxes are checked. The only remaining items for a human reviewer to confirm (I can't reach these hosts from my environment) are the product download version on the vendor page and the TCK Results Summary page (public access, permanence, matching SHAs, all tests passing). With those confirmed, this CCR looks good for approval.