Cameron Crippen created WW-5719:
-----------------------------------
Summary: Verify pinned Maven wrapper bootstrap artifacts
Key: WW-5719
URL: https://issues.apache.org/jira/browse/WW-5719
Project: Struts 2
Issue Type: Improvement
Reporter: Cameron Crippen
Propose SHA-256 verification for the pinned Maven distribution and Maven
Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
{{only-script}} variant's ZIP/tar.gz checksum discrepancy.
This is optional build-maintenance and integrity hardening. The check compares
freshly downloaded bytes with repository-pinned expectations; existing cached
Maven installations are not revalidated. It does not independently authenticate
publisher identity or claim a framework vulnerability. The variant adds a
wrapper-JAR download and requires coordinated URL/checksum maintenance.
Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
including expected digest mismatches rejected before Maven started. The full
28-module package build passed 4,449 tests with no failures, errors or skips
under a verified task-local UTF-8 startup environment. This was an incremental
build; clean/integration, native Linux/macOS and remote CI remain unverified.
Would the project consider this wrapper-variant change and associated checksum
maintenance? A three-file patch is prepared for a linked PR if the approach is
appropriate.
AI disclosure: this proposal, patch preparation and description used OpenAI
Codex assistance. Launcher scripts were generated from the official Apache
Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
