[MWRAPPER-117] Wrapper distributions and jars sha256 checksums should be published

[jira-importer]

Alexis Tual opened MWRAPPER-117 and commented

The Maven wrapper supports setting the sha256 for both the distribution and the wrapper jars: https://maven.apache.org/wrapper/#checksum-verification-of-downloaded-binaries.
However those sha256 checksums are not published in https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/ nor https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper making this feature harder to use.

---

Issue Links:

• MWRAPPER-79 Automatically add sha256 to maven-wrapper.properties

1 votes, 4 watchers

[jira-importer]

Slawomir Jaranowski commented

There is a similar issue: MWRAPPER-79

[jira-importer]

Alexis Tual commented

Can we expect the sha256 to be published ? If not then have a distributionSha512Sum and wrapperSha512Sum supported by the wrapper instead ?

[jira-importer]

Alexis Tual commented

sjaranowski, do you know if it's on the roadmap ?

[jira-importer]

Slawomir Jaranowski commented

Alexis Tual as it is Open Source project you can try implement such feature.
There is no roadmap - simply new features/bug fixes are implemented by contributors.

[jira-importer]

Andreas Sewe commented

As https://maven.apache.org/download.cgi publishes easily obtainable SHA512 sums at least for the Maven distribution (if not for the wrapper JARs), simply introducing a <distributionSha512Sum> and using a <distributionType> of only-script may be the most pragmatic way forward. WDYT? Worth a separate feature ticket?

[erik-meuwese-topicus]

I made a pr #398 to address this issue. I have added a wrapperSha512Sum and distributionSha512SUm since Maven only publishes the SHA-512 checksum.