please increase version information on releasing new debian packages

[harridu]

Apparently the Debian packages for Temurin 7, 11 and 17 have been changed a few days ago without increasing the version information (both package file name and internal version number visible in apt-cache). This leads to problems with reproducibility. Binaries that ought to be identical have different MD5SUMs. It makes Temurin literally unusable for any software escrow service.

[karianna]

@gdams - I think you had a work around for this? (permanent fix in next release cycle)

[harridu]

No

[sxa]

@gdams Can you confirm what the permanent fix for this will be going forward so we can ensure it is documented in the release guide please?

[gdams]

Closing as we have a permanent fix now. The bot will no longer be able to forcefully overwrite existing packages

[sxa]

I'm going to re-open this as @steelhead31 found that he was able to overwrite some files during the January release cycle so it looks like there are cases where they can be overwritten.

(Scott, can you confirm whether that was an overwrite performed as the bot user ID or by something you were doing manually?)

[gdams]

it shouldn't be possible with the token we use