[MWRAPPER-97] sha256 checksum is not well supported for distributionType=only-script
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- java
- Domain
- build-system
Research direction
Inspect the entry scripts and maven-wrapper.properties, then compare checksum verification for Maven .zip, Maven .tar.gz, and mvnd URLs across OS and ARCH combinations. Done means the configuration supports every possible distribution checksum and provides a secure way to generate them from the distribution URL or Apache site.
Written by the indexing model from the issue text.
Description
James Z.M. Gao opened MWRAPPER-97 and commented
The entry scripts for distributionType=only-script may change the base name of the distribution url, then the fixed sha256 checksum in maven-wrapper.properties becomes invalid. These cases are:
- maven, type .zip: verify OK
- maven, type .tar.gz: verify FAIL
- mvnd: always FAIL, since the url is dynamic decided based on OS and ARCH, the extension may also fallback to .tar.gz
To fix the issue, we need store all possible checksums in the config file, and better to have an easy and secure way to generate these checksums from the distribution url or from the apache site.
Affects: 3.2.0
1 votes, 4 watchers
- Dominant language
- Java
- Stars
- 254
- Forks
- 78
- Avg merge
- 23h 36m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/maven-wrapper
-
mvnw.cmd selects the last matching extracted directory while mvnw selects the firstPossibly taken @tanvir-ux claimed this 36 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/maven-wrapper#442 ·
Maintainers usually reply within 1 day
-
priority:trivial
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
apache/maven-wrapper#280 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 3/5 1-2 days Newbie friendliness 68/100
apache/maven-wrapper#454 ·
Maintainers usually reply within 1 day
-
mvnw silently continues when no download mechanism is available (missing final else)May be free again A pull request for this issue was closed without being merged. Open
Difficulty 3/5 1-2 days Newbie friendliness 68/100
apache/maven-wrapper#441 · 1 comment ·
Maintainers usually reply within 1 day
-
SHA-256 validation fails when unzip is unavailable because distribution format is silently changed to .tar.gzPossibly taken @simono claimed this 76 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 48/100
apache/maven-wrapper#425 · 1 comment · 4 reactions ·
Maintainers usually reply within 1 day
All issues in apache/maven-wrapper
Similar issues
-
GeminiUtil placeholder user turn ("Continue output. DO NOT look at this line ...") is flagged by prompt injection filtersPossibly taken @innoprej claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
salesforce/multicloudj#667 ·
Maintainers usually reply within 1 day
-
Add ZammadPossibly taken @Arslan-TR claimed this today. Openrequest
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
endoflife-date/endoflife.date#11298 · 1 comment ·
Maintainers usually reply within 1 day
-
bug documentation
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
electron tech debt
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day