[
https://issues.apache.org/jira/browse/WW-5719?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5719:
------------------------------
Component/s: Build Management
> Verify pinned Maven wrapper bootstrap artifacts
> -----------------------------------------------
>
> Key: WW-5719
> URL: https://issues.apache.org/jira/browse/WW-5719
> Project: Struts 2
> Issue Type: Improvement
> Components: Build Management
> Reporter: Cameron Crippen
> Priority: Minor
>
> Propose SHA-256 verification for the pinned Maven distribution and Maven
> Wrapper JAR. Maven Wrapper 3.3.4's supported {{script}} variant keeps the
> distribution ZIP fixed when {{unzip}} is unavailable, avoiding the
> {{only-script}} variant's ZIP/tar.gz checksum discrepancy.
> This is optional build-maintenance and integrity hardening. The check
> compares freshly downloaded bytes with repository-pinned expectations;
> existing cached Maven installations are not revalidated. It does not
> independently authenticate publisher identity or claim a framework
> vulnerability. The variant adds a wrapper-JAR download and requires
> coordinated URL/checksum maintenance.
> Local validation on Windows Java 17: seven ordinary bootstrap checks passed,
> including expected digest mismatches rejected before Maven started. The full
> 28-module package build passed 4,449 tests with no failures, errors or skips
> under a verified task-local UTF-8 startup environment. This was an
> incremental build; clean/integration, native Linux/macOS and remote CI remain
> unverified.
> Would the project consider this wrapper-variant change and associated
> checksum maintenance? A three-file patch is prepared for a linked PR if the
> approach is appropriate.
> AI disclosure: this proposal, patch preparation and description used OpenAI
> Codex assistance. Launcher scripts were generated from the official Apache
> Maven Wrapper 3.3.4 release. No prior human technical review is claimed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
