[
https://issues.apache.org/jira/browse/MWRAPPER-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17875027#comment-17875027
]
James Z.M. Gao commented on MWRAPPER-97:
----------------------------------------
[~Marcono1234] yes, this snip selects a proper url for downloading and
uncompressing.
> sha256 checksum is not well supported for distributionType=only-script
> ----------------------------------------------------------------------
>
> Key: MWRAPPER-97
> URL: https://issues.apache.org/jira/browse/MWRAPPER-97
> Project: Maven Wrapper
> Issue Type: Improvement
> Components: Maven Wrapper Scripts
> Affects Versions: 3.2.0
> Reporter: James Z.M. Gao
> Priority: Normal
>
> The entry scripts for distributionType=only-script may change the base name
> of the distribution url, then the fixed sha256 checksum in
> maven-wrapper.properties becomes invalid. These cases are:
>
> * maven, type .zip: verify OK
> * maven, type .tar.gz: verify FAIL
> * mvnd: always FAIL, since the url is dynamic decided based on OS and ARCH,
> the extension may also fallback to .tar.gz
>
> To fix the issue, we need store all possible checksums in the config file,
> and better to have an easy and secure way to generate these checksums from
> the distribution url or from the apache site.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
