From f8253eace9d231b276024dd66406d890c1d954e1 Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: pin the exact JDK release

The Adoptium "latest 17 GA" endpoint floats while versions promises
never to float. Pin the full Temurin build and fetch it by version.
---
 ci/setup-toolchain.sh | 7 ++++---
 versions              | 2 ++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/ci/setup-toolchain.sh b/ci/setup-toolchain.sh
index c832708..7aeaa42 100755
--- a/ci/setup-toolchain.sh
+++ b/ci/setup-toolchain.sh
@@ -12,10 +12,11 @@ dir=${TOOLCHAIN_DIR:-$HOME/toolchains}
 sdk="$dir/android-sdk"
 mkdir -p "$dir/dl"
 
-# JDK 17 (Temurin).
+# JDK (Temurin, exact pinned release; + must be %2B in the URL).
 if [ ! -x "$dir/jdk17/bin/java" ]; then
-	echo "setup: JDK $JDK_VERSION"
-	curl -fsSL "https://api.adoptium.net/v3/binary/latest/${JDK_VERSION}/ga/linux/x64/jdk/hotspot/normal/eclipse" -o "$dir/dl/jdk.tar.gz"
+	echo "setup: JDK $JDK_RELEASE"
+	rel=$(printf '%s' "$JDK_RELEASE" | sed 's/+/%2B/')
+	curl -fsSL "https://api.adoptium.net/v3/binary/version/jdk-${rel}/linux/x64/jdk/hotspot/normal/eclipse" -o "$dir/dl/jdk.tar.gz"
 	mkdir -p "$dir/jdk17"
 	tar xzf "$dir/dl/jdk.tar.gz" -C "$dir/jdk17" --strip-components=1
 fi
diff --git a/versions b/versions
index bb4987a..ad2e9ca 100644
--- a/versions
+++ b/versions
@@ -12,6 +12,7 @@ RSYNC_URL=https://download.samba.org/pub/rsync/src/rsync-${RSYNC_VERSION}.tar.gz
 GO_VERSION=1.25.0
 
 # Android toolchain. ANDROID_NDK is the sdkmanager package revision.
+# JDK_RELEASE is the exact Temurin GA build; JDK_VERSION its major.
 ANDROID_NDK=27.2.12479018
 ANDROID_CMDLINE_TOOLS=11076708
 ANDROID_BUILD_TOOLS=35.0.0
@@ -22,6 +23,7 @@ AGP_VERSION=8.7.3
 GRADLE_VERSION=8.9
 KOTLIN_VERSION=2.0.21
 JDK_VERSION=17
+JDK_RELEASE=17.0.19+10
 
 # Native ABIs to build. arm64-v8a ships on the phone; x86_64 is for host and
 # emulator tests. Add armeabi-v7a to support 32-bit phones.
-- 
cgit v1.2.3