Sangkyoon Nam created FLINK-41492:
-------------------------------------
Summary: ./mvnw fails the Maven distribution SHA-256 check on
macOS in release-1.20, release-2.2 and release-2.3
Key: FLINK-41492
URL: https://issues.apache.org/jira/browse/FLINK-41492
Project: Flink
Issue Type: Bug
Components: Build System / CI
Affects Versions: 2.3.1, 2.2.2, 1.20.6
Reporter: Sangkyoon Nam
On macOS 15, {{./mvnw}} from release-1.20, release-2.2 and release-2.3 fails on
its first run, before Maven starts:
{noformat}
Error: Failed to validate Maven distribution SHA-256, your Maven distribution
might be compromised.
{noformat}
This is the macOS {{sha256sum}} problem from FLINK-37181 again, now on these
three branches. FLINK-41049 replaced {{mvnw}} with the stock only-script
wrapper. On master (5a7cb81fe9e) and release-2.4 that's wrapper 3.3.4, which
includes the MWRAPPER-150 fix from 3.3.3 and pipes the checksum to {{sha256sum
-c -}}. The backports (cd3c65d50a4 on release-1.20, aef3f71890b on release-2.2,
3dc40a2a33c on release-2.3) took the stock 3.3.2 script, which predates that
fix and uses {{sha256sum -c}}. With {{-c}} and no file argument, the macOS
{{/sbin/sha256sum}} prints its usage and exits 1 instead of reading stdin, so
the check always fails. On release-2.2 the properties file says
{{wrapperVersion=3.3.4}} (and keeps a stale {{wrapperUrl}}), but the {{mvnw}}
script is the 3.3.2 one.
Reproduced on macOS 15.3.1 (arm64) with an empty {{MAVEN_USER_HOME}}, running
{{./mvnw -v}}:
* release-1.20.6-rc3, release-2.2.2-rc2, release-2.3.1-rc2: fails every run
* master, release-2.4, release-2.3.0, release-2.2.1, release-1.20.5: prints the
Maven version
* release-2.3.1-rc2 with {{sha256sum -c -}} on that line: prints the Maven
version
This hits the source releases in the current 1.20.6, 2.2.2 and 2.3.1 votes,
which ask for a build with the bundled {{./mvnw}}. An existing Maven cache
doesn't help: the old wrapper cached Maven under
{{wrapper/dists/apache-maven-3.8.6-bin}}, and the only-script wrapper looks
under {{wrapper/dists/apache-maven-3.8.6}}, so the first run downloads and
checks. Linux isn't affected, since GNU and uutils {{sha256sum -c}} read stdin
without {{-}}. Taking {{/sbin}} off {{PATH}} (so {{shasum}} is used) works
around it.
I'd fix it by moving the three branches to wrapper 3.3.4 like master. Adding
the {{-}} to that one line in the 3.3.2 script also works if you'd rather keep
the diff minimal. I haven't checked macOS versions other than 15.3.1 or Intel
Macs.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
