In CR6 jws-maven-repo should have been rebuilt as tomcats were updated to contain CVE fixes. While looking in the CR6 bits that staged to the candidates place, I've verified that md5sum of jws-maven-repo zip matches the one from CR5