cameroncrippen opened a new pull request, #1942: URL: https://github.com/apache/struts/pull/1942
Fixes [WW-5719](https://issues.apache.org/jira/browse/WW-5719). Verify freshly downloaded Maven distribution and wrapper-JAR bytes against repository-pinned SHA-256 values. Regenerate the launchers using Maven Wrapper 3.3.4's supported `script` variant, which keeps the ZIP fixed when `unzip` is unavailable and avoids the `only-script` variant's ZIP/tar.gz checksum discrepancy. This optional build-maintenance change adds a wrapper-JAR download and coordinated URL/checksum maintenance. Windows requires `JAVA_HOME`; a fresh POSIX bootstrap requires `curl` or `wget`, plus `sha256sum` or `shasum` for wrapper verification. Existing cached Maven installations are not revalidated. This does not claim a framework vulnerability. Provenance: artifacts came from official Maven Central HTTPS URLs. The Maven ZIP matched its published SHA-512; the wrapper JAR matched its published SHA-1. SHA-256 pins were computed from those bytes. PGP signatures were not verified, so the checks do not independently authenticate publisher identity. Validation: seven ordinary bootstrap checks passed, including expected-digest mismatch rejection before Maven started. The full 28-module `mvnw.cmd --batch-mode --no-transfer-progress package -DskipAssembly` build on Windows Java 17 passed 4,449 tests with zero failures, errors or skips. It used a task-local UTF-8 startup environment verified by a parent/child charset probe. This was an incremental package build; clean/integration tests, native Linux/macOS and remote CI remain unverified. Earlier Windows-default-charset failures also occurred with unmodified direct Maven and were resolved by the verified UTF-8 startup setting. A plain `test` run lacked the bridge JARs needed by Tiles; the successful `package` run generated those artifacts. No test or application source was changed or disabled. AI disclosure: patch preparation, validation and this description used OpenAI Codex assistance. Launcher scripts were generated from the official Apache Maven Wrapper 3.3.4 release with line endings normalized for the patch. No prior human technical review is claimed; maintainer review is requested. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
