oscerd opened a new pull request, #9063:
URL: https://github.com/apache/camel-quarkus/pull/9063

   Fixes #9060.
   
   `.mvn/wrapper/maven-wrapper.properties` declared `distributionUrl` and 
`wrapperUrl` but neither of the checksum properties the wrapper supports, so 
whatever those URLs returned was accepted.
   
   **How the checksums were derived.** Maven Central publishes no `.sha256` for 
either artifact, so each was downloaded and verified against what *is* 
published before its SHA-256 was computed:
   
   | Artifact | Verified against | Result |
   |---|---|---|
   | `apache-maven-3.9.16-bin.zip` | published `.sha512` | match |
   | `maven-wrapper-3.3.4.jar` | published `.sha1` | match |
   
   As a side check, the `maven-wrapper.jar` committed in `.mvn/wrapper/` is 
byte-identical to the published 3.3.4 jar.
   
   **Verification**
   
   - Clean download with `MAVEN_USER_HOME` pointed at an empty directory 
succeeds, so the pin does not break a cold build.
   - Substituting a deliberately wrong `distributionSha256Sum` fails the build 
with `Failed to validate Maven distribution SHA-256`, confirming the properties 
are actually enforced rather than silently ignored.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to