The GitHub Actions job "Java SDK release verification" on 
airflow.git/ci/java-sdk/verify-build-inputs has failed.
Run started by GitHub user jason810496 (triggered by jason810496).

Head commit for run:
4b59d75cdae8cd5b4490a3332516fb7a44dd92da / LIU ZHE YOU <[email protected]>
Verify Java SDK build dependencies

The Java SDK build trusted whatever its configured repositories returned, so a
replaced or shadowed artifact could execute during a build -- including in the
buildSrc code that configures every published module -- without anything
failing. Pinning checksums turns that substitution into a build error, and
declaring repositories in one place gives reviewers a single spot to audit
where bytes may come from.

Checksums alone are trust-on-first-use: they prove an artifact has not changed
since it was recorded, not that it was ever trustworthy. The README therefore
documents the independent cross-check required when regenerating the metadata,
and names the inputs this deliberately does not cover -- the auto-provisioned
JDK toolchain and the downloaded Supervisor Schema -- so the guarantee is not
read as broader than it is.

Report URL: https://github.com/apache/airflow/actions/runs/31460941315

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to