Repository navigation
Recover Java 1.527–1.536 release evidence inventory - #163
Merged
Merged
Conversation
Refs #71. Separate public artifacts, tag provenance, historical CI failures, and new empty-cache resolution without inventing release commits or vulnerability clearance.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #71.
Records the present public Maven parent/core artifact status, transitive empty-cache resolution, remote tag/signature state, original Actions runs, and SHA-256 fingerprints for 1.527–1.536. It explicitly distinguishes first source commit declaring a version from a proven release commit. 1.532/1.534 are absent from the public core/parent repository today; 1.534–1.536 historical tags are unsigned, and their original tag-triggered deploy runs failed HTTP 401. Public 1.535/1.536 artifacts exist now, but the uploader/source chain is not proven by those failed runs.
No vulnerability-free or historical clean-consumer claim is made. The document leaves #71 open for provenance and compatibility follow-up.
Verification: public Maven HEAD probes, empty-cache
maven-dependency-plugin:getfor each extant runtime version, tag object andgit verify-taginspection, Actions run logs, downloaded core-JAR SHA-256,git diff --check.