fix(ci): patch pip verifier and document published cache 5.7.6

.github/workflows/codeql-verification.yml

@@ -50,8 +50,7 @@ jobs:
       - name: Verify Python packaging and CA tools
         run: |
           set -euo pipefail
-          python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: -r scripts/ci-python-requirements.lock
-          python -c "import sys, pip, certifi, pip._vendor.certifi as bundled; assert sys.version_info[:3] == (3,14,9); assert pip.__version__ == '26.2.2'; assert certifi.__version__ == '2026.10.19'; assert bundled.__version__ == '2026.10.19'; print(sys.version, pip.__version__, certifi.__version__, bundled.__version__)"
+          bash scripts/setup-ci-python-tools
 
       - name: Verify source and wrapper integrity
         shell: bash

.github/workflows/security-release-gate.yml

@@ -64,8 +64,7 @@ jobs:
       - name: Verify Python packaging and CA tools
         run: |
           set -euo pipefail
-          python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: -r scripts/ci-python-requirements.lock
-          python -c "import sys, pip, certifi, pip._vendor.certifi as bundled; assert sys.version_info[:3] == (3,14,9); assert pip.__version__ == '26.2.2'; assert certifi.__version__ == '2026.10.19'; assert bundled.__version__ == '2026.10.19'; print(sys.version, pip.__version__, certifi.__version__, bundled.__version__)"
+          bash scripts/setup-ci-python-tools
 
       - name: Verify candidate identity and supply-chain pins
         id: candidate

README.md

@@ -3,27 +3,30 @@
 > [!IMPORTANT]
 > This repository is a narrowly scoped PastureStack fork of Hazelcast 5.7.0. It preserves the upstream Git history, copyright notices, license files, and authorship. PastureStack does not claim ownership of upstream work and is not affiliated with or endorsed by Hazelcast, Inc.
 
-Current source prepares `5.7.6` using the official Temurin `25.0.5+8`
-security update. CI uses Python `3.14.9`, pip `26.2.2`, and certifi
-`2026.10.19`. These are build and verification tools; the delivered JAR does
+Release `5.7.6` uses the official Temurin `25.0.5+8`
+security update. CI uses Python `3.14.9`, the internal pip
+`26.2.2+pasturestack.1` rebuild with patched urllib3 `2.8.0`, and certifi
+`2026.10.19`. A frozen upstream-vendoring helper verifies input/wheel hashes
+and streaming/TLS behavior in an isolated CI environment. This CI-only update
+does not replace the existing release artifact. These are verification tools; the delivered JAR does
 not contain a JRE or Python runtime. The optional OCI build retains Ubuntu
 24.04 and installs its matching CA security update before the verified JDK.
 The generated Hazelcast cluster version remains `5.7.3`.
 
 Earlier public Maven artifacts remain immutable historical evidence. The
 current public GitHub Release is
-[`v5.7.5`](https://github.com/PastureStack/distributed-cache-runtime/releases/tag/v5.7.5).
-It publishes the exact reviewed `hazelcast-5.7.5.jar` from source
-`a9aea563870201462dc24f778a06279a08ed5841`, with SHA-256
-`0f536a9c7bcd00f2369586fb6ca1606f7e45f3225e24795d10d38397051c8715`.
-See [5.7.5 release notes](RELEASE-NOTES-5.7.5.md) for its focused tests,
+[`v5.7.6`](https://github.com/PastureStack/distributed-cache-runtime/releases/tag/v5.7.6).
+It publishes the exact reviewed `hazelcast-5.7.6.jar` from signed source
+`bd071c12bc11808a5f91e8b5d0308decd79e5af9`, with SHA-256
+`825b5fc9526a10549bcb580f2d6c03bf1f5667625661722c0406ea6f796e83f2`.
+See [5.7.6 release notes](RELEASE-NOTES-5.7.6.md) for its focused tests,
 embedded Jackson versions and verification boundaries. The Engine consumes
 this GitHub release asset; no new OCI/GHCR carrier is published by this release.
 Source dependency-management floors are LZ4 `1.11.4` for optional Kafka
 connectors and RabbitMQ Java client `5.37.0` for JMS integration tests.
-Both are absent from the published `5.7.5` core JAR, its resolved runtime tree,
-and its release SBOM; this source-only maintenance does not require a new core
-artifact or downstream Engine release. See the dependency assessments in
+Both are absent from the core JAR, its resolved runtime tree,
+and release SBOM; they do not drive the JDK rebuild in this release.
+See the dependency assessments in
 [SECURITY-MAINTENANCE.md](SECURITY-MAINTENANCE.md#lz4-source-floor-and-release-impact).
 Every current and future PastureStack publication
 uses a pure numeric version, while

RELEASE-NOTES-5.7.6.md

@@ -1,6 +1,6 @@
-# Distributed Cache Runtime 5.7.6 candidate
+# Distributed Cache Runtime 5.7.6
 
-This candidate rebuilds the maintained core JAR with the official Temurin
+This release rebuilds the maintained core JAR with the official Temurin
 25.0.5+8 security release. Maven artifact coordinates and filenames move to
 5.7.6; the cluster protocol and generated runtime version remain 5.7.3.
 Managed application dependencies and public Java APIs are unchanged.
@@ -11,6 +11,15 @@ artifact-carrier build keeps its pinned Ubuntu 24.04 base, installs the
 matching CA update, and verifies official JDK archives before replacing the
 old build JDK. The final carrier contains the JAR and license files only.
 
-Publication requires the existing focused regression, artifact identity,
-SBOM, and vulnerability gates. Candidate source is not proof of a published
-or deployed artifact. Previous release tags and assets remain immutable.
+Signed producer `bd071c12bc11808a5f91e8b5d0308decd79e5af9` produced the
+23,852,245-byte JAR with SHA-256
+`825b5fc9526a10549bcb580f2d6c03bf1f5667625661722c0406ea6f796e83f2`.
+The anonymous release download matches those bytes and embeds the same source.
+[CI](https://github.com/PastureStack/distributed-cache-runtime/actions/runs/39949973022)
+passed 510 tests in 40 suites with zero failures, errors or skips, artifact
+identity checks, and source/JAR/dependency scans with zero Critical/High findings.
+The CycloneDX 1.6 SBOM's 15 components and 16 dependency nodes match Maven.
+All required CodeQL checks passed before protected PR #18 merged the same tree.
+These are the original CI artifacts; no release-time rebuild occurred.
+No new OCI carrier, downstream deployment or full historical matrix is implied.
+Previous release tags and assets remain immutable.

SECURITY-MAINTENANCE.md

@@ -4,7 +4,7 @@
 
 The PastureStack maintenance delta intentionally preserves the Hazelcast 5.7.0 API while updating reviewed runtime and build-time dependencies with published security fixes:
 
-The current published Maven artifact is `5.7.5`, from signed tag `v5.7.5` and source `a9aea563870201462dc24f778a06279a08ed5841`; it is based on upstream `5.7.0`, not an upstream Hazelcast release. Public `v5.7.4` remains immutable historical evidence. Hazelcast's cluster protocol parser accepts numeric product versions only, so generated runtime metadata deliberately reports `5.7.3`. The artifact version must be used by Maven coordinates, filenames, any artifact carrier, SBOM, and release evidence; the numeric runtime version must be used by cluster/member compatibility code. See [5.7.5 release notes](RELEASE-NOTES-5.7.5.md) for the narrow Jackson update, exact artifact and validation boundaries.
+The current published Maven artifact is `5.7.6`, from signed tag `v5.7.6` and source `bd071c12bc11808a5f91e8b5d0308decd79e5af9`; it is based on upstream `5.7.0`, not an upstream Hazelcast release. Public `v5.7.4` and `v5.7.5` remain immutable historical evidence. Hazelcast's cluster protocol parser accepts numeric product versions only, so generated runtime metadata deliberately reports `5.7.3`. The artifact version must be used by Maven coordinates, filenames, any artifact carrier, SBOM, and release evidence; the numeric runtime version must be used by cluster/member compatibility code. See [5.7.6 release notes](RELEASE-NOTES-5.7.6.md) for the patched build toolchains, exact artifact and validation boundaries.
 
 | Component | Upstream 5.7.0 | PastureStack maintained version | Scope |
 | --- | --- | --- | --- |
@@ -24,7 +24,7 @@ The current published Maven artifact is `5.7.5`, from signed tag `v5.7.5` and so
 | Checkstyle | 12.3.1 | 14.0.0 | Build-time source policy |
 | gRPC Java / Python | 1.73.0 | 1.83.1 / 1.83.0 | gRPC and cloud extension dependencies |
 | Aircompressor | 2.0.2 | 2.0.3 | Current Parquet 1.18 byte-array codec dependency; Aircompressor v3 uses a different artifact/package and MemorySegment API |
-| Hazelcast test-job dependency | 5.0.5 | 5.7.5 | Command-line integration test fixtures |
+| Hazelcast test-job dependency | 5.0.5 | 5.7.6 | Command-line integration test fixtures |
 | Maven Compiler Plugin | implicit | 3.15.0 | Reproducible test-fixture builds |
 | Maven JAR Plugin | 3.1.2 | 3.5.1 | Reproducible test-fixture packaging |
 | Maven Install Plugin | implicit | 3.1.4 | Latest stable Maven 3-compatible install lifecycle |

scripts/ci-python-requirements.lock

@@ -1,5 +1,5 @@
 # CI verification tools; these packages are not included in product artifacts.
-pip==26.2.2 \
-    --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70
+pip==26.2.2+pasturestack.1 \
+    --hash=sha256:be5f63d537bbe611dc422fabb6740a44b5997888b592888df5091727f023802a
 certifi==2026.10.19 \
     --hash=sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b

scripts/setup-ci-python-tools

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Install only CI verification tools; shipped browser/JAR artifacts are unchanged.
+set -Eeuo pipefail
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+work=$(mktemp -d "${RUNNER_TEMP:-/tmp}/pasturestack-ci-python.XXXXXX")
+python "$root/tools/pip-security-overlay/build-pip-overlay.py" --work "$work/build" --output "$work/dist"
+python -m venv --without-pip "$work/env"
+export PATH="$work/env/bin:$PATH"
+PYTHONPATH="$work/dist/pip-26.2.2+pasturestack.1-py3-none-any.whl" \
+  python -m pip install --no-index --no-deps "$work/dist/pip-26.2.2+pasturestack.1-py3-none-any.whl"
+python -m pip install --disable-pip-version-check --require-hashes --only-binary=:all: \
+  --find-links "$work/dist" -r "$root/scripts/ci-python-requirements.lock"
+python -c "import sys,pip,certifi,pip._vendor.certifi as bundled; assert sys.version_info[:3]==(3,14,9); assert pip.__version__=='26.2.2+pasturestack.1'; assert certifi.__version__==bundled.__version__=='2026.10.19'; print(sys.version,pip.__version__,certifi.__version__,bundled.__version__)"
+python "$root/tools/pip-security-overlay/test-pip-overlay.py"
+printf '%s\n' "$work/env/bin" >>"${GITHUB_PATH:?GitHub Actions path file is required}"