This is an automated email from the ASF dual-hosted git repository.
paulk-asert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/groovy.git
The following commit(s) were added to refs/heads/master by this push:
new 031dc822e7 bump to JDK27 build 35
031dc822e7 is described below
commit 031dc822e7c6b347ed53f99e4354974c6919a897
Author: Paul King <[email protected]>
AuthorDate: Mon Sep 7 11:12:26 2026 +1000
bump to JDK27 build 35
---
.github/workflows/groovy-build-test.yml | 14 ++++++++++----
THREAT_MODEL.md | 1 +
2 files changed, 11 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/groovy-build-test.yml
b/.github/workflows/groovy-build-test.yml
index 50965f6917..73660a3cc3 100644
--- a/.github/workflows/groovy-build-test.yml
+++ b/.github/workflows/groovy-build-test.yml
@@ -313,21 +313,27 @@ jobs:
# *test target*, then set up a stable LTS JDK afterwards so Gradle itself
# runs on a GA build. `fail-fast: false` keeps EA breakage from failing the
# rest of the matrix. NOTE: the EA build number bumps ~weekly, so the URL
- # below goes stale โ refresh it (and java-version) from
https://jdk.java.net/27/.
+ # below goes stale โ refresh it (and java-version and jdk-sha256) from
+ # https://jdk.java.net/27/. The checksum is pinned here rather than fetched
+ # at download time so a compromised host cannot serve a matching one; take it
+ # from the published .sha256 beside the tarball when you bump the build.
ea:
if: github.event_name == 'push'
strategy:
fail-fast: false
matrix:
include:
- - jdk-url:
"https://download.java.net/java/early_access/jdk27/33/GPL/openjdk-27-ea+33_linux-x64_bin.tar.gz";
- jdk-version: "27.0.0-ea.33"
+ - jdk-url:
"https://download.java.net/java/early_access/jdk27/35/GPL/openjdk-27-ea+35_linux-x64_bin.tar.gz";
+ jdk-version: "27.0.0-ea.35"
+ jdk-sha256:
"95fc37eb3a18a27a26d5904c2d89d52bace8dafa9a078ca27f4747fbc4bf070b"
runs-on: ubuntu-latest
steps:
- name: "๐ฅ Checkout repository"
uses: actions/[email protected]
- name: "โฌ๏ธ Download EA JDK"
- run: wget -nv -O "$RUNNER_TEMP/java_package.tar.gz" "${{
matrix.jdk-url }}"
+ run: |
+ wget -nv -O "$RUNNER_TEMP/java_package.tar.gz" "${{ matrix.jdk-url
}}"
+ echo "${{ matrix.jdk-sha256 }} $RUNNER_TEMP/java_package.tar.gz" |
sha256sum -c -
- name: "โ๏ธ Setup EA JDK (test target)"
uses: actions/[email protected]
with:
diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md
index 23edfa739f..3497f24959 100644
--- a/THREAT_MODEL.md
+++ b/THREAT_MODEL.md
@@ -703,6 +703,7 @@ vulnerabilities** unless a concrete, in-model data-boundary
crossing
| `Eval` / `GroovyShell` inside Groovy's tools, tests, and
`groovysh`/`groovyConsole` | By design โ `BY-DESIGN: property-disclaimed` |
| `@Grab`/Grape fetching and loading artifacts | By design dependency
resolution โ `OUT-OF-MODEL` |
| Dependency-verification config that trusts by checksum or by group rather
than per-artifact signature โ `verify-metadata=false`, group-scoped `<trust>`
entries, or an `ignored-key` with a checksum fallback
(`gradle/verification-metadata.xml`) | Deliberate, scoped dial-downs, each
recorded in-file: metadata enforcement is off while jar integrity still holds
via `verify-signatures` + checksums; self-resolved baselines
(`org.apache.groovy`, `org.codehaus.groovy`) and the doc toolchain (`o [...]
+| A CI canary/test job downloading a pre-release toolchain (the `ea` OpenJDK
job in `.github/workflows/groovy-build-test.yml`) | Push-only (`if:
github.event_name == 'push'` โ no fork/PR path), read-only `GITHUB_TOKEN`, and
test-only: the EA JDK runs the suite but never builds or signs a release
artifact (Gradle itself runs on a GA JDK), and the tarball is checksum-pinned.
`KNOWN-NON-FINDING` unless the job gains write/publish permissions or a release
build consumes the pre-release toolchain |
| Temp-file/dir creation, and other artifacts tooling writes | Owner-only or
least-exposure (P4); path-contained (P4b) โ `KNOWN-NON-FINDING` unless a
*default-config* case widens exposure or escapes its tree, which is
`VALID-HARDENING` |
| Regex, `BigInteger`/`BigDecimal` parsing, hash-collision flooding (JDK
treeifies heavily-collided `String`-keyed buckets since Java 8) | DoS bounded
by developer-chosen input โ `OUT-OF-MODEL: downstream-responsibility` |
| Deep recursion / unbounded input in Groovy's *own* data parsers
(`JsonSlurper`, `XmlSlurper`/`XmlParser`, `groovy-yaml`/`-toml`/`-csv`) |
Robustness of code meant to consume untrusted input โ **`VALID-HARDENING`**
*(maintainer)*; nesting depth is now bounded by default in all of them (JSON
via the 6.0.0 `maxNestingDepth` cap, GROOVY-12064; XML via the 6.0.0
`jdk.xml.maxElementDepth` bound, GROOVY-12331), per-parser exposure in
[ยง6](#6-assumptions-about-inputs) |
