Merge branch 'main' into dependabot/github_actions/github/super-linter-6

.github/workflows/blog-validator.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         persist-credentials: false
 
@@ -30,7 +30,7 @@ jobs:
         # shellcheck disable=2043
         for added_file in ${{ steps.files.outputs.added }}; do
           if [[ ${added_file} =~ ^content/blog.*.md ]]; then
-            blog_date=$(grep 'date:' "${added_file}" | sed -n -e 's/^.*date: //p' | tr -d '"')
+            blog_date=$(grep '^date:' "${added_file}" | sed -n -e 's/^.*date: //p' | tr -d '"')
             # Return difference in days between today and blog date
             diff=$(( ($(date +%s) - $(date --date "${blog_date}" +%s)) / (60*60*24) ))
             if [[ ${diff} -gt 0 ]]; then
@@ -53,6 +53,8 @@ jobs:
               "security"
               "announcement"
               "release-notes"
+              "docker"
+              "containers"
             )
             invalid_tags=()
             IFS=", " read -r -a tag_array <<< "$tags"

.github/workflows/check-adopters.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         persist-credentials: false
 

.github/workflows/check-contributors.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/ci.yml

@@ -15,9 +15,9 @@ jobs:
     name: Run CI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
-      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: 20
           cache: npm
@@ -27,6 +27,6 @@ jobs:
       - run: npm run coverage
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@6d798873df2b1b8e5846dba6fb86631229fbcb17 # v4.4.0
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -41,11 +41,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
+      uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
+      uses: github/codeql-action/autobuild@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
+      uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2

.github/workflows/linter.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/locale-checker.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
           fetch-depth: 0

.github/workflows/ossf-scorecard.yml

@@ -22,19 +22,19 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         persist-credentials: false
-    - uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
+    - uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
       with:
         results_file: results.sarif
         results_format: sarif
         publish_results: true
-    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+    - uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
-    - uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.1.34
+    - uses: github/codeql-action/upload-sarif@429e1977040da7a23b6822b13c129cd1ba93dbb2 # v3.26.2
       with:
         sarif_file: results.sarif

.github/workflows/update_snapshot.yml

@@ -10,14 +10,14 @@ jobs:
     if: startsWith(github.event.comment.body, '/update-snapshot')
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           ref: ${{ github.event.issue.head_ref }}
           repository: ${{ github.event.issue.repository.full_name }}
           fetch-depth: 0
 
       - name: Set up Node.js
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: 20
           cache: npm

content/asciidoc-pages/about/index.es.adoc

@@ -0,0 +1,61 @@
+= About Eclipse Adoptium(R)
+:page-authors: Thebyren, karianna
+
+La misión del proyecto de alto nivel Eclipse Adoptium es producir entornos
+de ejecución de alta calidad y la tecnología asociada para su uso en el ecosistema
+de Java. Logramos esto a través de un conjunto de proyectos bajo el Adoptium PMC
+y una estrecha colaboración con proyectos externos, especialmente con OpenJDK, 
+que proporciona la implementación del entorno de ejecución Java SE. Nuestro 
+objetivo es satisfacer las necesidades tanto de la comunidad Eclipse como de los
+usuarios generales de los entornos de ejecución, proporcionando un conjunto 
+completo de tecnologías para aplicaciones Java que operan conforme a los 
+estándares existentes, infraestructuras y plataformas en la nube.
+
+El proyecto AdoptOpenJDK fue establecido en 2017 luego de años de discusiones
+sobre la falta general de un sistema abierto de compilación y prueba para el 
+código fuente de OpenJDK en múltiples plataformas. Desde entonces
+ha crecido hasta convertirse en un proveedor líder de 
+software de alta calidad basado en los binarios de OpenJDK
+utilizados por empresas en sistemas integrados, escritorios, servidores
+tradicionales, plataformas modernas en la nube,
+y grandes computadores centrales. El proyecto Eclipse Adoptium es la continuación de la misión original de AdoptOpenJDK.
+
+== Alcance
+
+Eclipse Adoptium provee binarios del entorno de ejecución de un alto rendimiento,
+calibre empresarial, multiplataforma, con licencia de código abierto, aprobados por Java SE
+TCK y compatible para uso general en el ecosistema de Java.
+Eclipse Adoptium también provee recursos incluyendo infraestructura de código libre, 
+un completo sistema de integración continua de compilación  y
+pruebas, y extensas pruebas de control de calidad. Estos recursos pueden ser utilizados
+por proyectos de Eclipse Adoptium y otros constructores de tecnología de entornos de ejecución
+para asegurar la provisión de entornos de ejecución seguros, probados y conformes con Java SE TCK, listos para producción.
+
+El alcance del proyecto incluye el desarrollo, gestión, promoción
+y tecnologías de soporte como:
+
+* Kits de desarrollo y entornos de ejecución: respaldado por la amplia gama de API
+especificadas por las versiones de Java SE, disponibles en diversas de combinaciones de arquitectura de procesador y sistema operativo.
+* Infraestructura de pruebas TCK: Proporcionar infraestructura para ejecutar pruebas
+de conformidad y la compatibilidad de Java SE.
+* Control de misión JDK: herramientas de diagnóstico y perfilado de bajo consumo para la suite JVM.
+* instaladores y repositorios: varios mecanismos para obtener y
+manejar la instalación de la  tecnología del entorno ejecución, como instaladores nativos
+de la plataforma, contenedores de imágenes, servidores de descarga, un sitio web
+y repositorios de recursos.
+
+además de proporcionar una fuente confiable de los binarios contemporáneos del
+entorno de ejecución de Java, el proyecto Eclipse Adoptium es una plataforma para la experimentación de desarrolladores, académicos e investigadores. Esto proporciona
+un lugar para probar nuevas ideas de infraestructura, 
+desarrollo, compilación, pruebas y infraestructura de ideas. ejemplos de
+proyectos que se incluyen en este proyecto de alto nivel "jlink.online"
+para ofrecer entornos de ejecución del tamaño adecuado a los desarrolladores de aplicaciones,
+"Github actions" para obtener y probar tiempos de ejecución dentro de Git workflow,
+"TKG" el framework de generación de kits de prueba, "Bumblebench" el framework de microbenchmarking, y más.
+
+== Licencia(s)
+
+* construir scripts y otros códigos para producir los binarios, el sitio web y
+otras infraestructuras de construcción bajo licencia https://www.apache.org/licenses/LICENSE-2.0[Apache License, Version 2.0].
+* El código OpenJDK bajo licencia  https://openjdk.java.net/legal/gplv2+ce.html[GPL v2 with Classpath Exception] (GPLv2+CE) y https://openjdk.java.net/legal/assembly-exception.html[GPL v2 with Assembly Exception] (GPLv2+Assembly).
+

content/asciidoc-pages/docs/faq/index.adoc

@@ -1,5 +1,5 @@
 = Frequently Asked Questions
-:page-authors: gdams, karianna, sxa555, aahlenst, sxa, tellison, kemitix, Fishbowler
+:page-authors: gdams, karianna, sxa555, aahlenst, sxa, tellison, kemitix, Fishbowler, Saurabh-Daware, xavierfacq
 
 We have gathered together a few frequently asked questions (FAQs) into
 this document.
@@ -8,6 +8,39 @@ the best place is via
 https://adoptium.net/slack.html[Slack] or by raising an issue in the
 https://github.com/adoptium/adoptium-support[support channel].
 
+
+== What is Eclipse Temurin?
+
+*Eclipse Adoptium* (Earlier known as AdoptOpenJDK) Project was started as a means to  promote and support free and open-source high-quality runtimes and associated technology for use across the Java ecosystem. +
+*Eclipse Temurin* (/ˈtɛmjərɪn/), are certified high quality binary builds of OpenJDK.
+
+The name Temurin is an anagram of runtime. Interestingly Temurin is also a chemical component (also known as Theacrine) that is structurally similar to caffeine but is safer for humans to consume (non-habituating effects). So a small nod to Java as well.
+
+This is the project and brand name for the binaries that the Eclipse
+Foundation produces.
+While we appreciate that the Adoptium/Temurin name split
+is more confusing than just "Adoptium", this is similar to how other
+vendors brand their binaries, e.g. Amazon has Corretto, Azul has Zulu
+(and others). The "Adoptium" project and working group will deal with
+more than just Temurin so the distinction is important to maintain.
+
+== What happened to AdoptOpenJDK?
+
+The AdoptOpenJDK builds are now known as "Eclipse Temurin by
+Adoptium"(https://adoptium.net/blog/2021/08/adoptium-celebrates-first-release/[read the blog post]).
+Don’t worry though - despite the branding changes it is the same open build processes,
+AQAvit test suites and primarily the same team producing them as before, but
+there are link:/members[more larger companies] bringing their expertise
+to the working group.
+
+To ensure a smooth transition we have left the old site active, however,
+the links to latest builds on the old site will now bring you to the
+Temurin builds. In time the old website will be fully retired.
+
+Some items, such as the https://adoptopenjdk.net/upstream.html[Upstream builds]
+and https://adoptopenjdk.net/icedtea-web.html[IcedTea-WEB] remain only available
+via AdoptOpenJDK.
+
 == Where are the latest Adoptium(R) JDKs?
 
 Adoptium's JDKs are called Eclipse Temurin, and the releases we recommend for
@@ -145,33 +178,6 @@ https://github.com/adoptium/api.adoptium.net/blob/main/docs/cookbook.adoc#exampl
 in the
 https://github.com/adoptium/api.adoptium.net/blob/main/docs/cookbook.adoc#adoptium-api-cookbook[Adoptium API cookbook].
 
-== What is this "Eclipse Temurin" name?
-
-This is the project and brand name for the binaries that the Eclipse
-Foundation produces.
-While we appreciate that the Adoptium/Temurin name split
-is more confusing than just "Adoptium", this is similar to how other
-vendors brand their binaries, e.g. Amazon has Corretto, Azul has Zulu
-(and others). The "Adoptium" project and working group will deal with
-more than just Temurin so the distinction is important to maintain.
-
-== What happened to AdoptOpenJDK?
-
-The AdoptOpenJDK builds are now known as "Eclipse Temurin by
-Adoptium"(https://adoptium.net/blog/2021/08/adoptium-celebrates-first-release/[read the blog post]).
-Don’t worry though - despite the branding changes it is the same open build processes,
-AQAvit test suites and primarily the same team producing them as before, but
-there are link:/members[more larger companies] bringing their expertise
-to the working group.
-
-To ensure a smooth transition we have left the old site active, however,
-the links to latest builds on the old site will now bring you to the
-Temurin builds. In time the old website will be fully retired.
-
-Some items, such as the https://adoptopenjdk.net/upstream.html[Upstream builds]
-and https://adoptopenjdk.net/icedtea-web.html[IcedTea-WEB] remain only available
-via AdoptOpenJDK.
-
 == Where are the OpenJ9 builds?
 
 The transition to Adoptium means we have unfortunately not been able to

content/asciidoc-pages/docs/reproducible-verification-builds/index.adoc

@@ -0,0 +1,17 @@
+= Third Party Reproducible Verification Build Instructions
+:description: Instructions for independently reproducing an Eclipse Temurin release as part of a reproducible verification build
+:keywords: Reproducible Builds SLSA Security Supply Chain
+:orgname: Eclipse Adoptium
+:lang: en
+:page-authors: andrew-m-leonard
+
+To perform your own reproducible verification build of an Eclipse Temurin JDK 21+ official release, we have prepared a set of instructions for each platform that will guide you through the process of re-building the selected JDK 21+ Eclipse Temurin builds from upstream OpenJDK community source and with your own securely built toolchains and dependencies.
+
+Select your required platform instructions for the Eclipse Temurin release you wish to reproduce:
+
+- link:/docs/reproducible-verification-builds/reproduce-linux-x64[JDK 21+ Linux x64]
+- link:/docs/reproducible-verification-builds/reproduce-linux-aarch64[JDK 21+ Linux aarch64]
+- link:/docs/reproducible-verification-builds/reproduce-windows-x64[JDK 21+ Windows x64]
+
+link:/blog/2024/08/adoptium-reproducible-verification-builds[Eclipse Temurin Reproducible Verification Builds for Secure Supply Chain Validation]
+