[
https://issues.apache.org/jira/browse/WW-5719?focusedWorklogId=1041513&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041513
]
ASF GitHub Bot logged work on WW-5719:
--------------------------------------
Author: ASF GitHub Bot
Created on: 14/Sep/26 22:50
Start Date: 14/Sep/26 22:50
Worklog Time Spent: 10m
Work Description: cameroncrippen opened a new pull request, #1942:
URL: https://github.com/apache/struts/pull/1942
Fixes [WW-5719](https://issues.apache.org/jira/browse/WW-5719).
Verify freshly downloaded Maven distribution and wrapper-JAR bytes against
repository-pinned SHA-256 values. Regenerate the launchers using Maven Wrapper
3.3.4's supported `script` variant, which keeps the ZIP fixed when `unzip` is
unavailable and avoids the `only-script` variant's ZIP/tar.gz checksum
discrepancy.
This optional build-maintenance change adds a wrapper-JAR download and
coordinated URL/checksum maintenance. Windows requires `JAVA_HOME`; a fresh
POSIX bootstrap requires `curl` or `wget`, plus `sha256sum` or `shasum` for
wrapper verification. Existing cached Maven installations are not revalidated.
This does not claim a framework vulnerability.
Provenance: artifacts came from official Maven Central HTTPS URLs. The Maven
ZIP matched its published SHA-512; the wrapper JAR matched its published SHA-1.
SHA-256 pins were computed from those bytes. PGP signatures were not verified,
so the checks do not independently authenticate publisher identity.
Validation: seven ordinary bootstrap checks passed, including
expected-digest mismatch rejection before Maven started. The full 28-module
`mvnw.cmd --batch-mode --no-transfer-progress package -DskipAssembly` build on
Windows Java 17 passed 4,449 tests with zero failures, errors or skips. It used
a task-local UTF-8 startup environment verified by a parent/child charset
probe. This was an incremental package build; clean/integration tests, native
Linux/macOS and remote CI remain unverified.
Earlier Windows-default-charset failures also occurred with unmodified
direct Maven and were resolved by the verified UTF-8 startup setting. A plain
`test` run lacked the bridge JARs needed by Tiles; the successful `package` run
generated those artifacts. No test or application source was changed or
disabled.
AI disclosure: patch preparation, validation and this description used
OpenAI Codex assistance. Launcher scripts were generated from the official
Apache Maven Wrapper 3.3.4 release with line endings normalized for the patch.
No prior human technical review is claimed; maintainer review is requested.
Issue Time Tracking
-------------------
Worklog Id: (was: 1041513)
Remaining Estimate: 0h
Time Spent: 10m
> Verify pinned Maven wrapper bootstrap artifacts
> -----------------------------------------------
>
> Key: WW-5719
> URL: https://issues.apache.org/jira/browse/WW-5719
> Project: Struts 2
> Issue Type: Improvement
> Components: Build Management
> Reporter: Cameron Crippen
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Propose SHA-256 verification for the pinned Maven distribution and Maven
> Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
> distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
> {{only-script}} variant's ZIP/tar.gz checksum discrepancy.
> This is optional build-maintenance and integrity hardening. The check
> compares freshly downloaded bytes with repository-pinned expectations;
> existing cached Maven installations are not revalidated. It does not
> independently authenticate publisher identity or claim a framework
> vulnerability. The variant adds a wrapper-JAR download and requires
> coordinated URL/checksum maintenance.
> Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
> including expected digest mismatches rejected before Maven started. The full
> 28-module package build passed 4,449 tests with no failures, errors or skips
> under a verified task-local UTF-8 startup environment. This was an
> incremental build; clean/integration, native Linux/macOS and remote CI remain
> unverified.
> Would the project consider this wrapper-variant change and associated
> checksum maintenance? A three-file patch is prepared for a linked PR if the
> approach is appropriate.
> AI disclosure: this proposal, patch preparation and description used OpenAI
> Codex assistance. Launcher scripts were generated from the official Apache
> Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
