This is an automated email from the ASF dual-hosted git repository. FreeAndNil pushed a commit to branch Feature/security-audit-hardening in repository https://gitbox.apache.org/repos/asf/logging-log4net.git
commit 28d411a53b7f61b0da7f9324181e6a23f926cd39 Author: Jan Friedrich <[email protected]> AuthorDate: Tue Aug 18 00:02:34 2026 +0200 pin the Maven wrapper and distribution downloads mvnw and MavenWrapperDownloader both refuse to run when a download does not match a checksum, but neither wrapperSha256Sum nor distributionSha256Sum was set, so the enforcement never ran and whatever the URLs returned was executed. wrapperSha256Sum is of the maven-wrapper.jar committed next to the properties, which is byte identical to the published maven-wrapper-3.2.0.jar. distributionSha256Sum is of apache-maven-3.9.0-bin.zip from archive.apache.org, whose SHA-512 matches the published value, which is byte identical to the copy on Maven Central, and whose PGP signature verifies against https://downloads.apache.org/maven/KEYS. Both enforcement paths were exercised: with the checksums correct mvnw runs Maven 3.9.0, and with either one altered it refuses. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .mvn/wrapper/maven-wrapper.properties | 7 +++++++ src/changelog/3.4.0/309-pin-maven-wrapper-checksums.xml | 14 ++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties index 08ea486a..09c1213c 100644 --- a/.mvn/wrapper/maven-wrapper.properties +++ b/.mvn/wrapper/maven-wrapper.properties @@ -16,3 +16,10 @@ # under the License. distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.0/apache-maven-3.9.0-bin.zip wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar +# mvnw and MavenWrapperDownloader refuse to run when a download does not match these. +# distributionSha256Sum is of apache-maven-3.9.0-bin.zip as published on archive.apache.org, whose +# PGP signature verifies against https://downloads.apache.org/maven/KEYS and whose bytes are +# identical to the Maven Central copy above. wrapperSha256Sum is of the maven-wrapper.jar committed +# next to this file, which is identical to the published maven-wrapper-3.2.0.jar. +distributionSha256Sum=68e5a1745a5f5e4b0dfae051f83297e2ea40912b2c3b84d3b7420f463f39260d +wrapperSha256Sum=e63a53cfb9c4d291ebe3c2b0edacb7622bbc480326beaa5a0456e412f52f066a diff --git a/src/changelog/3.4.0/309-pin-maven-wrapper-checksums.xml b/src/changelog/3.4.0/309-pin-maven-wrapper-checksums.xml new file mode 100644 index 00000000..b4ce40cb --- /dev/null +++ b/src/changelog/3.4.0/309-pin-maven-wrapper-checksums.xml @@ -0,0 +1,14 @@ +<?xml version="1.0" encoding="UTF-8"?> +<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; + xmlns="https://logging.apache.org/xml/ns"; + xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"; + type="added"> + <issue id="309" link="https://github.com/apache/logging-log4net/pull/309"/> + <description format="asciidoc"> + pin the Maven wrapper and the Maven distribution it downloads with + `wrapperSha256Sum` and `distributionSha256Sum`. `mvnw` and `MavenWrapperDownloader` already refuse + to run when a download does not match, but neither property was set, so whatever the URLs returned + was executed (CWE-494). Both values were taken from artifacts whose PGP signature verifies against + the Apache Maven KEYS (audit 1231d72-f023) + </description> +</entry>
