[
https://issues.apache.org/jira/browse/WW-5719?focusedWorklogId=1042202&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042202
]
ASF GitHub Bot logged work on WW-5719:
--------------------------------------
Author: ASF GitHub Bot
Created on: 17/Sep/26 06:01
Start Date: 17/Sep/26 06:01
Worklog Time Spent: 10m
Work Description: lukaszlenart merged PR #1942:
URL: https://github.com/apache/struts/pull/1942
Issue Time Tracking
-------------------
Worklog Id: (was: 1042202)
Time Spent: 0.5h (was: 20m)
> Verify pinned Maven wrapper bootstrap artifacts
> -----------------------------------------------
>
> Key: WW-5719
> URL: https://issues.apache.org/jira/browse/WW-5719
> Project: Struts 2
> Issue Type: Improvement
> Components: Build Management
> Reporter: Cameron Crippen
> Priority: Minor
> Fix For: 7.4.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Propose SHA-256 verification for the pinned Maven distribution and Maven
> Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
> distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
> {{only-script}} variant's ZIP/tar.gz checksum discrepancy.
> This is optional build-maintenance and integrity hardening. The check
> compares freshly downloaded bytes with repository-pinned expectations;
> existing cached Maven installations are not revalidated. It does not
> independently authenticate publisher identity or claim a framework
> vulnerability. The variant adds a wrapper-JAR download and requires
> coordinated URL/checksum maintenance.
> Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
> including expected digest mismatches rejected before Maven started. The full
> 28-module package build passed 4,449 tests with no failures, errors or skips
> under a verified task-local UTF-8 startup environment. This was an
> incremental build; clean/integration, native Linux/macOS and remote CI remain
> unverified.
> Would the project consider this wrapper-variant change and associated
> checksum maintenance? A three-file patch is prepared for a linked PR if the
> approach is appropriate.
> AI disclosure: this proposal, patch preparation and description used OpenAI
> Codex assistance. Launcher scripts were generated from the official Apache
> Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
