Hi,
> As per the EFTL license implementations cannot submit compatibility certificate requests (CCR) based on a Maven artifact, they must use a TCK downloaded from the Eclipse downloads webpage.
If I'm not mistaken, this was labeled as an "urban myth" by Ed Bratt many moons ago. While it holds in principle, if the binary bits are identical, the distinction can not be made and is therefore tolerated. If I'm still not mistaken, Ivar confirmed this to be the practical truth indeed.
There is NO individual SHA posted for any jars that may be present inside a .zip TCK downloaded from the Eclipse downloads site (aka the "big zip), BUT... the uploaders (of the TCK) should ensure that when the big zip is unzipped and contains x.jar, that x.jar downloaded from Maven Central has the same SHA. The vendor can then implicitly use the x.jar downloaded from Maven Central.
Think of it in a different way (it's I think the example Ivar used), if you download the big zip, unpack it, put the jar files in your internal nexus, file server, or whatever, the TCK doesn't suddenly becomes invalid. Maven Central acts as such "internal nexus".
Kind regards,
Arjan Tijms