Re: [adoptium-pmc] Reproducible build verification for Eclipse Temurin

[Carmen Delgado <carmen.delgado@xxxxxxxxxxxxxxxxxxxxxx>]

Dear Adoptium PMC members,

Following our PMC meeting today, we noticed the email below was not delivered to the mailing list last week. I am forwarding it now for your review.

KR, 

Carmen Delgado

Adoptium Program Manager | Eclipse Foundation

eclipse.org | Twitter | LinkedIn | YouTube 

Eclipse Foundation: The Community for Open Innovation and Collaboration

My working day may not be your working day! Please don’t feel obliged to read or reply to this email outside of your normal working hours.

On Thu, 26 Feb 2026 at 19:34, Dennis Leung <dennis.leung@xxxxxxxxxxxxxxxxxxxxxx> wrote:

Dear Adoptium PMC members, 

I wanted to follow up on the Reproducible Builds Verification Project thread to refresh everyone’s memory of a previous discussion on this topic and provide some insight into the administrative steps required before the first public release.

As we understand the current status:

• Download Page: The verification mark has been implemented.

• GitHub: An attestation repository has been created.

• Documentation: How-to documentation is pending creation.

Last year, following concerns raised by the Eclipse Foundation Executive Director regarding the term “attestation” for project-issued claims, we reached an understanding in March 2025 not to use the term “attestation” in this context. The agreed upon approach satisfies both legal requirements and technical best practices:

• User-Facing Terminology: “Reproducibility Verified,” “Verified Reproducible,” or similar variations will be primarily used

• Technical Documentation: The term “attestation” will be reserved strictly for technical documentation (e.g., "CycloneDX Attestation"), where it is an established industry term for secure supply chain practices like SLSA.

Regarding the creation of the Verification mark, we provide a legal review service and process for trademarks to ensure the trademark can be properly protected and to enable the community to benefit from proper use of the trademark.

To complete this transition and mitigate legal exposure, we ask the PMC to take the following actions as soon as possible:

• GitHub Repository Update: Rename the existing temurin-attestations repository and any related issues/epics to align with the agreed user-facing terminology (e.g., temurin-reproducibility-verified or temurin-verified-reproducibility).

• Legal Review: Submit the new verification mark proposal to the EMO team for formal legal review and approval. This should include details on how the mark is obtained, the project workflow, and where it will be displayed (e.g., the release page)

We are happy to have a call with the PMC to answer any questions you may have and help get this over the finish line for reproducible build verifications. 

Regards,

Dennis

--

Dennis Leung

VP Program Management | Eclipse Foundation

dennis.leung@xxxxxxxxxxxxxxxxxxxxxx

+1.613.220.7818 (m)