CCR review #1319 — Azul Payara Community (Web Profile) 7.2026.4 (Jakarta EE 11 Web Profile)

[Copilot]

Review of the compatibility certification request for Azul Payara Community (Web Profile) 7.2026.4 against Jakarta EE 11 Web Profile, following the CCR Review Guidance. This is a review-only task; no repository files are modified.

Recommendation: changes required — not ready for approval.

Each TCK SHA‑256 was verified against the official …​.zip.sha256 sidecars on download.eclipse.org, and the required TCK set cross‑checked against accepted reference CCR #1290 (Open Liberty EE 11 Web Profile).

Blocking findings

• Missing required Web Profile TCKs: Jakarta Data (data-tck-1.0.1, 92babb60…) and Jakarta Debugging Support for Other Languages (jakarta-debugging-tck-2.0.0, 71999815…).
• SHA‑256 mismatches vs. official published TCKs:
  • Annotations 3.0.0 — CCR 8b916f1b… / official 9421c6ca…
  • Authentication 3.1.0 — CCR 9421c6ca… (this is actually the Annotations hash) / official 6ab2e521…
  • Concurrency 3.1.1 — CCR 22728d72… / official b064e189…
  • CDI 4.1.0 — CCR 566c547e… / official 446029ee…
• Broken / non‑standard links (must use download.eclipse.org/jakartaee/ base): Annotations link uses singular jakarta-annotation-tck-… (404 → correct is plural jakarta-annotations-tck-3.0.0.zip); CDI and Dependency Injection links use …/ee4j/cdi/… (404).

To double‑check

• Specification reference names "Jakarta EE Platform 11.0" / platform/11; a Web Profile cert should reference Jakarta EE Web Profile 11 (jakarta.ee/specifications/webprofile/11).
• TCK Results Summary URL is malformed (broken markdown link); needs a single permanent, login‑free, Payara‑hosted page showing all‑passing results. payara.fish hosts were not resolvable from the review environment, so the product download and results pages still need manual confirmation.
• Jakarta Tags 3.0.1 is listed but is not a required Web Profile standalone TCK (harmless).

Verified correct

• Platform TCK 11.0.1 (b2c0ad6d…), plus Faces 4.1.1, EL 6.0.0, RESTful WS 4.0.0, Servlet 6.1.0, Pages 4.0.0, Security 4.0.0, WebSocket 2.2.0, JSON Binding 3.0.0, JSON Processing 2.1.1, Validation 3.1.1, Dependency Injection 2.0.2 — all SHA‑256 values match the official TCKs.
• Both final attestation check‑boxes are checked.

[ivargrimstad]

See PR text and issue comment

[Copilot]

See PR text and issue comment

The review stands as posted (blocking findings: missing Data + Debugging TCKs; SHA‑256 mismatches for Annotations, Authentication, Concurrency, CDI; broken/non‑standard download links). This is review-only, so there are no repository changes to commit. The only items I still can't confirm are the Payara‑hosted pages — the docs.payara.fish and nexus.payara.fish hosts remain unresolvable from my environment, so the product download and TCK Results Summary URL still need manual verification.