[
https://issues.apache.org/jira/browse/WW-5719?focusedWorklogId=1041578&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041578
]
ASF GitHub Bot logged work on WW-5719:
--------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 07:15
Start Date: 15/Sep/26 07:15
Worklog Time Spent: 10m
Work Description: cameroncrippen commented on PR #1942:
URL: https://github.com/apache/struts/pull/1942#issuecomment-5676304563
Thanks for the review. I have restored both launchers to `main`, kept
`distributionType=only-script`, and reduced the final diff to the single
requested `distributionSha256Sum` line. The wrapper-JAR settings and added
comment are removed.
Two fresh-cache Windows Java 17 checks passed: the correct checksum starts
Maven 3.9.16, and an intentionally incorrect expected checksum rejects the
ordinary download before Maven starts. The launcher bytes match the reviewed
base exactly. I have retained the documented POSIX limitation for systems
without `unzip`. This revision and reply were prepared with OpenAI Codex
assistance.
Issue Time Tracking
-------------------
Worklog Id: (was: 1041578)
Time Spent: 20m (was: 10m)
> Verify pinned Maven wrapper bootstrap artifacts
> -----------------------------------------------
>
> Key: WW-5719
> URL: https://issues.apache.org/jira/browse/WW-5719
> Project: Struts 2
> Issue Type: Improvement
> Components: Build Management
> Reporter: Cameron Crippen
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Propose SHA-256 verification for the pinned Maven distribution and Maven
> Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
> distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
> {{only-script}} variant's ZIP/tar.gz checksum discrepancy.
> This is optional build-maintenance and integrity hardening. The check
> compares freshly downloaded bytes with repository-pinned expectations;
> existing cached Maven installations are not revalidated. It does not
> independently authenticate publisher identity or claim a framework
> vulnerability. The variant adds a wrapper-JAR download and requires
> coordinated URL/checksum maintenance.
> Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
> including expected digest mismatches rejected before Maven started. The full
> 28-module package build passed 4,449 tests with no failures, errors or skips
> under a verified task-local UTF-8 startup environment. This was an
> incremental build; clean/integration, native Linux/macOS and remote CI remain
> unverified.
> Would the project consider this wrapper-variant change and associated
> checksum maintenance? A three-file patch is prepared for a linked PR if the
> approach is appropriate.
> AI disclosure: this proposal, patch preparation and description used OpenAI
> Codex assistance. Launcher scripts were generated from the official Apache
> Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
