certification archive lacks sha256sum line in json file

[judovana]

where

"package": {
                        "name": "java-17-openjdk-17.0.3.0.7-4.portable.jdk.el.x86_64.tar.xz",
                        "link": "https://openjdk-sources.osci.io/marketplace/17/java-17-openjdk-17.0.3.0.7-4.portable.jdk.el.x86_64.tar.xz",
                        "sha265sum": "47156f0eaba955602c9249054aa7e69a32e71de91d96359a0a3b672980d0f10d"
                    },

Allow marketplace to identify change in LINK by changing sum, the

 "aqavit_results_link": "https://openjdk-sources.osci.io/marketplace/17/java-17-openjdk-17.0.3.0.7-4.portable.jdk.el.x86_64.cert.tar.gz"

Is lacking this, and thus not allow the marektpalce to recognize the change in the aqavit_results_link, even allows to forge the results.

Can we have aqavit_results_sha265sum field and appropriate logic, which allows updating the results if overwritten?

[smlambert]

Transferring to api repo, where I believe the change will need to take place to add this to the schema.

[smlambert]

@karianna - are you able to transfer this to https://github.com/adoptium/api.adoptium.net, as I appear not to have the correct permissions for the api repository to do so...

[smlambert]

There will also be associated documentation updates to be done in https://github.com/adoptium/website-v2/blob/main/src/asciidoc-pages/docs/aqavit-verification.adoc which I can take care of, upon the updated schema being available.

[tellison]

Agreed, and we'll need to add the checksum field to the schema and let publishers catch up before making it required. So expect multiple phases of implementation.