[bpamiri]

Summary

The Lucee 5, 6 and 7 test images (tools/docker/lucee{5,6,7}/Dockerfile) download sqlite-jdbc-3.50.3.0.jar with wget. That fails the build on an HTTP error, but never checked the bytes, so a damaged or substituted jar would be baked into the image and only show up at test time.

Each image now pipes the downloaded jar through sha256sum -c - against Maven Central's published SHA-256. It's the same pin tools/ci/fetch-sqlite-jdbc.sh uses (#4594), and a mismatch fails the image build.

Fixes #4595 for the SQLite JDBC jar. The H2 and Oracle .lex extensions the images also fetch are unchanged.

Verification

In the pinned ortussolutions/commandbox base image, I ran the exact RUN commands (wget download, then sha256sum -c -):

Hash	Result
Real hash	/opt/wheels-lib/sqlite-jdbc-3.50.3.0.jar: OK, exit 0
Wrong hash	FAILED, exit 1, which fails the RUN step

The images themselves are built by the compat matrix.

🤖 Generated with Claude Code

[github-actions]

Wheels Test Results

14 924 tests   14 625 ✅  3m 51s ⏱️
 1 200 suites     299 💤
     2 files         0 ❌

Results for commit a81f053.

[bpamiri]

rev1-r3 review @ a81f053: APPROVE

The hash matches. All three Dockerfiles pin a3f53a2a…cf08, the SHA-256 of sqlite-jdbc-3.50.3.0.jar. That is the same value as tools/ci/fetch-sqlite-jdbc.sh, and I verified it on #4594 against Maven Central's published .sha256 and a fresh download. Each sha256sum -c line names exactly the file its wget -O writes:

• lucee5 / lucee6: /usr/local/lib/serverHome/WEB-INF/lucee-server/context/lib/sqlite-jdbc.jar;
• lucee7: /opt/wheels-lib/sqlite-jdbc-3.50.3.0.jar.

A mismatch fails the build. The check is the last command of the RUN's && chain. /bin/sh takes the pipeline's status from sha256sum. In an Ubuntu container under /bin/sh, the same echo "<hash> <file>" | sha256sum -c - form exits 1 (FAILED) for a wrong hash and 0 for the right one. So a damaged or substituted jar stops the image build.

Lucee 5 (not in the matrix), read: the change is identical in shape to lucee6, with the same path and the same line. Its base is ortussolutions/commandbox:latest, the same Ubuntu-based image family as the digest-pinned base of lucee6/7, so sha256sum (coreutils) is available.

Matrix 38543017972 (lucee6 and lucee7 × sqlite): both images built, and the build logs show the check passing:

• …/context/lib/sqlite-jdbc.jar: OK (lucee6);
• /opt/wheels-lib/sqlite-jdbc-3.50.3.0.jar: OK (lucee7).

Both legs ran 7462 tests, 0 fail, 0 error.

PR CI: 17 pass, 3 skipping, 0 fail, cold-start adobe2023/2025/boxlang/lucee7 included. Up to date with develop, MERGEABLE.