-
Notifications
You must be signed in to change notification settings - Fork 68
Description
Affected version
3.3.3
Bug description
When I upgrade/reinstall Maven Wrapper, the distributionSha256Sum property gets removed from .mvn/wrapper/maven-wrapper.properties.
To reproduce (using Maven 3.9.11 as mvn):
mkdir reproducer
cd reproducer
# Install Maven Wrapper 3.3.3
mvn wrapper:3.3.3:wrapper -Dmaven=3.9.11
# Set distributionSha256Sum to verify integrity of Maven distribution
echo "distributionSha256Sum=0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb" >> .mvn/wrapper/maven-wrapper.properties
# Install Maven Wrapper 3.3.3 again (no newer version available yet at this time)
./mvnw wrapper:3.3.3:wrapper
# This returns nothing, because distributionSha256Sum has been removed during the upgrade
grep distributionSha256Sum .mvn/wrapper/maven-wrapper.properties
I think the distributionSha256Sum should be retained when the Maven Wrapper version is changed (or the same version is reinstalled).
An open question is what should happen when the update command changes the Maven distribution (e.g. -Dmaven=3.9.10), because in that scenario retaining distributionSha256Sum with the existing value will cause Maven Wrapper to fail.
Could Maven Wrapper at least warn that the user should set distributionSha256Sum again for the new Maven version to not lose the integrity check protection? Or could the value even be updated automatically in a safe way? If so, it should probably also be set by default during an initial Maven Wrapper setup.