oscerd opened a new pull request, #9063: URL: https://github.com/apache/camel-quarkus/pull/9063
Fixes #9060. `.mvn/wrapper/maven-wrapper.properties` declared `distributionUrl` and `wrapperUrl` but neither of the checksum properties the wrapper supports, so whatever those URLs returned was accepted. **How the checksums were derived.** Maven Central publishes no `.sha256` for either artifact, so each was downloaded and verified against what *is* published before its SHA-256 was computed: | Artifact | Verified against | Result | |---|---|---| | `apache-maven-3.9.16-bin.zip` | published `.sha512` | match | | `maven-wrapper-3.3.4.jar` | published `.sha1` | match | As a side check, the `maven-wrapper.jar` committed in `.mvn/wrapper/` is byte-identical to the published 3.3.4 jar. **Verification** - Clean download with `MAVEN_USER_HOME` pointed at an empty directory succeeds, so the pin does not break a cold build. - Substituting a deliberately wrong `distributionSha256Sum` fails the build with `Failed to validate Maven distribution SHA-256`, confirming the properties are actually enforced rather than silently ignored. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
