[
https://issues.apache.org/jira/browse/WW-5719?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18115437#comment-18115437
]
Lukasz Lenart commented on WW-5719:
-----------------------------------
Reviewed PR #1942 and requested changes there — summarising here so the ticket
carries the decision.
Verification of the proposal itself is fine: both pins match SHA-256 digests
recomputed from Maven Central bytes, the PGP signatures on the Maven 3.9.16 zip
and the wrapper 3.3.4 jar verify against the Maven KEYS file, and the submitted
launchers are byte-identical to the upstream 3.3.4 {{script}} release.
The switch of wrapper variant is not needed for the goal, though. The
{{only-script}} launchers already on {{main}} support
{{distributionSha256Sum}}: {{mvnw}} verifies with {{sha256sum}}/{{shasum}}
before unzipping, and {{mvnw.cmd}} verifies with {{Get-FileHash}} before
{{Expand-Archive}}. Both fail closed on a mismatch. Pinning the distribution
therefore needs a single line in {{.mvn/wrapper/maven-wrapper.properties}}:
{code}distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce
{code}
Staying on {{only-script}} keeps one pin to maintain instead of three, avoids
downloading and executing a wrapper jar before Maven runs, keeps the
{{java}}-on-{{PATH}} fallback on Windows (the {{script}} variant requires
{{JAVA_HOME}}), and keeps {{MVNW_REPOURL}} effective for every download — with
the {{script}} variant, the explicit {{wrapperUrl}} property overrides
{{MVNW_REPOURL}} on POSIX while {{mvnw.cmd}} applies them in the opposite
order, so a mirror-only Linux/macOS host cannot bootstrap.
The {{.tar.gz}} fallback on POSIX hosts without {{unzip}} would fail the zip
pin; that path fails closed with a clear message, {{unzip}} is present on every
runner we build on, and Windows is unaffected.
Requested rework: revert {{mvnw}} and {{mvnw.cmd}} to the versions on {{main}},
keep {{distributionType=only-script}}, and add only the
{{distributionSha256Sum}} line above.
> Verify pinned Maven wrapper bootstrap artifacts
> -----------------------------------------------
>
> Key: WW-5719
> URL: https://issues.apache.org/jira/browse/WW-5719
> Project: Struts 2
> Issue Type: Improvement
> Components: Build Management
> Reporter: Cameron Crippen
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Propose SHA-256 verification for the pinned Maven distribution and Maven
> Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
> distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
> {{only-script}} variant's ZIP/tar.gz checksum discrepancy.
> This is optional build-maintenance and integrity hardening. The check
> compares freshly downloaded bytes with repository-pinned expectations;
> existing cached Maven installations are not revalidated. It does not
> independently authenticate publisher identity or claim a framework
> vulnerability. The variant adds a wrapper-JAR download and requires
> coordinated URL/checksum maintenance.
> Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
> including expected digest mismatches rejected before Maven started. The full
> 28-module package build passed 4,449 tests with no failures, errors or skips
> under a verified task-local UTF-8 startup environment. This was an
> incremental build; clean/integration, native Linux/macOS and remote CI remain
> unverified.
> Would the project consider this wrapper-variant change and associated
> checksum maintenance? A three-file patch is prepared for a linked PR if the
> approach is appropriate.
> AI disclosure: this proposal, patch preparation and description used OpenAI
> Codex assistance. Launcher scripts were generated from the official Apache
> Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
