Skip to content

Add checksum verification across additional Java distributions - #6

Draft
johnoliver with Copilot wants to merge 4 commits into
signature-4from
copilot/verify-package-checksum-implementation
Draft

Add checksum verification across additional Java distributions#6
johnoliver with Copilot wants to merge 4 commits into
signature-4from
copilot/verify-package-checksum-implementation

Conversation

CopilotAI commented Jun 24, 2026

Copy link
Copy Markdown

Description:
This extends archive integrity verification beyond Temurin by wiring checksum validation into the other distributions that already expose checksum metadata, and by surfacing checksum data for Zulu, Liberica, and Oracle.

  • Shared verification path

    • Added a common checksum verification helper in JavaBase so installers use the same logging, warning, and error-wrapping behavior.
  • Distributions now verifying checksums

    • Adopt legacy fallback, Semeru, Dragonwell, SapMachine, and Corretto now pass release checksum data through to download verification.
    • Zulu and Liberica now map checksum fields from their release APIs into installer metadata.
    • Oracle now fetches the published .sha256 sidecar for the selected archive and verifies against it when available.
  • Model / API updates

    • Extended Zulu and Liberica release models to carry checksum fields.
    • Updated Liberica release queries to request sha256 explicitly.
  • Test coverage

    • Added assertions that checksum metadata is propagated correctly and that shared checksum verification behavior is exercised across installers.
awaitthis.verifyDownloadedArchiveChecksum(javaArchivePath,javaRelease);

Related issue:
N/A

Check list:

  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.

CopilotAI changed the title Add verify-signature plumbing and Temurin verification supportAdd GPG signature verification for Temurin with bundled Adoptium public keyJun 24, 2026
CopilotAI requested a review from johnoliverJune 24, 2026 11:30
CopilotAI changed the title Add GPG signature verification for Temurin with bundled Adoptium public keyAdd SHA-256 checksum verification for Temurin downloadsJun 24, 2026
CopilotAI changed the title Add SHA-256 checksum verification for Temurin downloadsAdd checksum verification across additional Java distributionsJun 24, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@johnoliver