From 6cd5a64cb437670fcf1ec19b82697e5244ffc744 Mon Sep 17 00:00:00 2001 From: Simon Olofsson Date: Thu, 23 Jul 2026 22:14:53 +0200 Subject: [PATCH] Fail fast when unzip is missing but a distribution checksum is pinned only-mvnw silently rewrites the distributionUrl from .zip to .tar.gz when 'unzip' is unavailable. The pinned distributionSha256Sum is computed for the .zip only, so validation then compared the downloaded .tar.gz against the .zip's checksum and always failed with a misleading "your Maven distribution might be compromised" error (e.g. on minimal images such as eclipse-temurin that lack unzip). When a checksum is pinned and 'unzip' is missing, refuse up front with an actionable message instead of downloading the wrong artifact. The .tar.gz fallback is unchanged for the common case where no checksum is pinned. Fixes #425 Co-Authored-By: Claude Opus 4.8 (1M context) --- maven-wrapper-distribution/src/resources/only-mvnw | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maven-wrapper-distribution/src/resources/only-mvnw b/maven-wrapper-distribution/src/resources/only-mvnw index 6d8e3f8d..9ee3b167 100755 --- a/maven-wrapper-distribution/src/resources/only-mvnw +++ b/maven-wrapper-distribution/src/resources/only-mvnw @@ -172,6 +172,12 @@ mkdir -p -- "${MAVEN_HOME%/*}" # select .zip or .tar.gz if ! command -v unzip >/dev/null; then + if [ -n "${distributionSha256Sum-}" ]; then + die "Cannot validate the pinned distributionSha256Sum: it is computed for the .zip +distribution, but 'unzip' is not available so mvnw would fall back to the .tar.gz. +Install 'unzip', or remove 'distributionSha256Sum' from +.mvn/wrapper/maven-wrapper.properties to allow the .tar.gz fallback." + fi distributionUrl="${distributionUrl%.zip}.tar.gz" distributionUrlName="${distributionUrl##*/}" fi