The GitHub Actions job "Java SDK release verification" on airflow.git/ci/java-sdk/verify-build-inputs has failed. Run started by GitHub user jason810496 (triggered by jason810496).
Head commit for run: 4b59d75cdae8cd5b4490a3332516fb7a44dd92da / LIU ZHE YOU <[email protected]> Verify Java SDK build dependencies The Java SDK build trusted whatever its configured repositories returned, so a replaced or shadowed artifact could execute during a build -- including in the buildSrc code that configures every published module -- without anything failing. Pinning checksums turns that substitution into a build error, and declaring repositories in one place gives reviewers a single spot to audit where bytes may come from. Checksums alone are trust-on-first-use: they prove an artifact has not changed since it was recorded, not that it was ever trustworthy. The README therefore documents the independent cross-check required when regenerating the metadata, and names the inputs this deliberately does not cover -- the auto-provisioned JDK toolchain and the downloaded Supervisor Schema -- so the guarantee is not read as broader than it is. Report URL: https://github.com/apache/airflow/actions/runs/31460941315 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
