In depth comparison of released artefacts
The build creds were compromised, see https://alfresco.atlassian.net/wiki/spaces/CTO/pages/297797557/2021+-+04+-+Codecov
Compare the artifacts released after Jan 31 with locally built versions:
The artifacts include:
nexus (enterprise and community)
s3 release bucket
In order to compare Docker images I built locally the alfresco-elasticsearch-connector images and I compared how local and remote were built, but I didn’t get any valuable result. I have attached an example to this issue.
>> All these artifacts have been verified locally comparing generated ZIP files with a simple “diff”. Only differences related to build date has been observed, but the integrity of the artifacts can be asserted.
18.104.22.168 version was built with JDK 11.0.2
Building locally the ZIP Distribution files and Docker Images from Mac OS doesn’t produce the same artifacts, but this is related with the host OS and not with the issue itself.