CCR review: Azul Payara Community 7.2026.4 for Jakarta EE Platform 11

[Copilot]

Review of the compatibility certification request for Azul Payara Community 7.2026.4 against Jakarta EE Platform 11, following the CCR Review Guidance. Each TCK SHA-256 was verified against the official .zip.sha256 sidecar on download.eclipse.org (or by downloading and hashing where no sidecar exists). This is an issue review with no repository source changes.

Findings

• SHA-256 mismatches (blocking) — 7 claimed fingerprints do not match the current official artifacts; each matches an older re-staged build of the same TCK version (the accepted BES CCR Compatibility certification request for BES Application Server v9.5 for Jakarta EE 11 Platform #1300 already uses the updated values):

  • Activation 2.1.2 → fdfbb2f8…
  • Authentication 3.1.0 → 6ab2e521…
  • Annotations 3.0.0 → 9421c6ca… (CCR value is a copy-paste of Authentication's 8b916f1b…)
  • Batch 2.1.5 → 4bba9ce9…
  • Concurrency 3.1.1 → b064e189…
  • Faces 4.1.1 → e2024aab…
  • CDI 4.1.0 → 446029ee…

• Broken download links (404):

  • Annotations — filename should be plural: jakarta-annotations-tck-3.0.0.zip
  • CDI — path should be ee4j/cdi/4.1/ (not 4.0)
  • Authorization — path should be authorization/3.0/ (not 4.0; SHA 70f2e153… is correct)

• Verified correct — Platform TCK 11.0.1 link + SHA; 16 remaining dependent TCK SHAs; all required standalone TCKs present (superset of Compatibility certification request for BES Application Server v9.5 for Jakarta EE 11 Platform #1300); both attestation checkboxes checked.

• Needs manual confirmation — payara.fish and jakarta.ee are blocked from the review sandbox, so the TCK Results Summary page (public access, permanence, matching detail, all tests passing), product download URL, and spec page were not independently verified.

Recommendation

Not yet ready for approval. Filer should correct the 7 SHA-256 values to match the current official artifacts (or clarify intentional certification against earlier builds) and fix the 3 broken links; results-summary page needs a human check.

[ivargrimstad]

See PR text and issue comment

[Copilot]

See PR text and issue comment

Re-verified against the official download.eclipse.org sidecars and links — all findings still hold:

• 7 SHA-256 mismatches confirmed (Activation fdfbb2f8…, Authentication 6ab2e521…, Annotations 9421c6ca…, Batch 4bba9ce9…, Concurrency b064e189…, Faces e2024aab…, CDI 446029ee…).
• Corrected links resolve (HTTP 200) while the originals 404: Annotations jakarta-annotations-tck-3.0.0.zip, CDI ee4j/cdi/4.1/, Authorization authorization/3.0/.

Still needs a human check (blocked from this sandbox): the TCK Results Summary page on payara.fish (public access, permanence, matching detail, all tests passing), the product download URL, and the jakarta.ee spec page.

This is a review-only issue — no repository source changes required.