Skip to content

1.5.0-central-publication.md

Latest commit

 

History

History
81 lines (66 loc) · 4.77 KB

1.5.0-central-publication.md

File metadata and controls

81 lines (66 loc) · 4.77 KB
Raw

OWASP Java Encoder 1.5.0 publication

Published 2026-09-28 UTC. Jim Manico uploaded the retained signed bundle and confirmed Central Portal status Published for deployment b448a073-7b5a-4442-bbcc-e4e1ee8fa04c.

Immutable release identities

  • Exact tested source: 3fbc5da5bcdc49a6e2b4f39d3df7410b7c13d07d.
  • Signed tag: v1.5.0; annotated object a5628da0f1586f904e6702e544c84022a0425466.
  • Signing fingerprint: 1C5F632B86809F2F5DB25092BEA0075F94074A9B.
  • Central bundle SHA-256: 107b0e4e1f459087d6bbd1e37222c05c7c4630fa55d52bc1e7c99c0077897590.
  • Source timestamp: 2026-09-28T13:21:37Z.

PR #229 was squash-merged as 030c137fc14f277afc5fbe303d2ca8a149f8068b. That commit and the tagged tested source have the identical tree 3b1c1acbc4a706175f7b8107f8c2a16503004b73, but distinct commit identities. The signed tag deliberately preserves the tested source. Do not move it to the squash commit or rebuild/re-sign the published artifacts.

Download verification

At 20:09:39 UTC, all nine binary/source/Javadoc JARs, four POMs and thirteen detached signatures were downloaded from public Maven Central. All 26 files matched the retained signed files byte for byte. All thirteen signatures verified against the full expected project fingerprint in a fresh public-only keyring.

Artifact Published files
encoder 1.5.0
encoder-jsp 1.5.0
encoder-jakarta-jsp 1.5.0
encoder-parent 1.5.0

Neither the optional test WAR nor encoder-esapi is published in 1.5.0.

All 32 uploaded GitHub assets were downloaded and matched the retained files before the GitHub release was published at 20:17:53 UTC. Public asset digests were checked again afterward. The assets include the exact bundle, thirteen payloads and their signatures, public KEYS, and signed SHA256SUMS and SHA512SUMS. Authenticate the manifests' detached signatures before checking their entries; see VERIFYING.md.

The tag's cryptographic signature verified against the same project key. GitHub's unknown_key account-association status is distinct from that successful signature verification; the dedicated project key was not added to a personal GitHub account merely to change the badge.

GHSA-g8p6-7r8f-qrpv was published at 20:18:27 UTC, after the fixed artifacts became available. The three retained libraries are fixed in 1.5.0. The retired ESAPI adapter has no fixed adapter release; follow its migration guide.

Build and compatibility evidence

The retained artifacts used Eclipse Temurin 17.0.20.1+1, committed Maven wrapper 3.9.16, UTC and the recorded source timestamp. The clean local reactor passed 2,287 tests, with zero failures, errors or skips. All thirteen unsigned payload files matched two fresh source-export builds. Public API compatibility was checked against 1.4.1 for all three retained libraries.

Post-merge Java CI, packaged consumers and CodeQL passed, including the browser and Java 8 gates. Packaged consumers passed on Java 8, 11, 17, 21 and 25. The complete open-issue, pull-request and Dependabot inventories were empty at 20:19:55 UTC; no alert was dismissed.

Publication is complete. Main resumes at 1.5.1-SNAPSHOT with the immutable 1.5.0 compatibility baseline. Javadoc indexing was refreshed and the rendered 1.5.0 core, JSP and Jakarta API pages were checked. Website maintenance remains separate from artifact publication. Pre-publication notices in the immutable source tag remain historical; this later record confirms publication without altering those sources or their signatures.