Repository navigation
[Retrospective · 2026-08-13 03:30 +08:00] Recover release governance for Java 1.527 through 1.536 #71
Description
Retrospective notice
Created after publication. Keep open until release evidence gaps are repaired.
Affected releases
1.527-RELEASE through 1.536-RELEASE, including the intermediate runtime, telemetry, checker, and ID-generator releases actually published in this period.
Known gaps
- No issue-first release record for each release.
- Release notes and compatibility summaries are incomplete.
- Signed tag and clean-consumer evidence are not consistently linked.
- Generator adoption and conformance evidence are distributed across repositories.
Recovery checklist
- Inventory exact published versions and release commits.
- Add human-readable release notes and vulnerability statements.
- Verify/publish cryptographically signed tags where evidence permits.
- Link Maven clean-consumer, CI, generator adoption, and conformance results.
- Record unrecoverable gaps explicitly without inventing evidence.
Activity
philipgreat commentedon Sep 23, 2026
2026-09-23 recovery checkpoint: PR #163 retains a per-version evidence inventory for 1.527–1.536. Public parent/core POM+JAR are present for 1.527–1.531, 1.533, 1.535, 1.536; 1.532 and 1.534 currently return 404. All eight extant runtime versions passed a fresh empty-cache Maven transitive dependency resolution today, which is narrower than an historical runtime smoke test. Only 1.534–1.536 have remote annotated tags; none is PGP-signed. The original tag-triggered release runs for those three versions all failed parent-POM upload with HTTP 401. 1.535/1.536 artifacts are present now, but those failed runs do not establish their later uploader or source-to-binary provenance. PR #163 records core-JAR SHA-256 fingerprints and leaves missing release notes, security clearance, exact source commits, and signed-attestation policy explicitly open. Do not close #71 from this inventory alone.
Inventory Java 1.527-1.536 release evidence (#163)
philipgreat commentedon Sep 23, 2026
Inventory document is now merged via PR #163 (7eb2838). Exact-head Build and Test, examples, and postgres-mysql checks all passed. The issue stays open: this document deliberately does not claim that missing historical signatures, per-version compatibility notes, vulnerability decisions, or exact source-to-JAR provenance were recovered.