Skip to content

MWRAPPER-117 - added distributionSha512Sum and wrapperSha512Sum#384

Closed
erik-meuwese-topicus wants to merge 16 commits intoapache:masterfrom
erik-meuwese-topicus:MWRAPPER-117-add-sha512-checksum
Closed

MWRAPPER-117 - added distributionSha512Sum and wrapperSha512Sum#384
erik-meuwese-topicus wants to merge 16 commits intoapache:masterfrom
erik-meuwese-topicus:MWRAPPER-117-add-sha512-checksum

Conversation

@erik-meuwese-topicus
Copy link

@erik-meuwese-topicus erik-meuwese-topicus commented Nov 13, 2025 •
edited
Loading

added distributionSha512Sum and wrapperSha512Sum for verification with SHA-512 since Maven only publishes the SHA-512 checksum and not the SHA-256 checksum.

The wrapper SHA-512 is pulished on https://maven.apache.org/tools/wrapper/download.cgi
The distribution SHA-512 is published on https://maven.apache.org/download.cgi

The SHA-256 option is still available for backward compatibility. However this could be marked deprecated and removed in future versions since Maven doesn't publish the SHA-256 checksums.

Following this checklist to help us incorporate your
contribution quickly and easily:

  • Your pull request should address just one issue, without pulling in other changes.
  • Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
  • Each commit in the pull request should have a meaningful subject line and body.
    Note that commits might be squashed by a maintainer on merge.
  • Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied.
    This may not always be possible but is a best-practice.
  • Run mvn verify to make sure basic checks pass.
    A more thorough check will be performed on your pull request automatically.
  • You have run the integration tests successfully (mvn -Prun-its verify).

If your pull request is about ~20 lines of code you don't need to sign an
Individual Contributor License Agreement if you are unsure
please ask on the developers list.

To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

@erik-meuwese-topicus
MWRAPPER-117 - added distributionSha512Sum and wrapperSha512Sum for v…
1564fbb 
…erification with SHA-512 since Maven only publishes the SHA-512 checksum and not the SHA-256 checksum
@erik-meuwese-topicus erik-meuwese-topicus mentioned this pull request Nov 13, 2025
Open
dependabot bot added 3 commits November 23, 2025 10:10
@dependabot
Bump actions/checkout from 5 to 6 (apache#386)
93c507d 
Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.apache.maven.resolver:maven-resolver-api from 1.9.24 to 1.9.…
64dce35 
…25 (apache#387)

Bumps [org.apache.maven.resolver:maven-resolver-api](https://github.com/apache/maven-resolver) from 1.9.24 to 1.9.25.
- [Release notes](https://github.com/apache/maven-resolver/releases)
- [Commits](apache/maven-resolver@maven-resolver-1.9.24...maven-resolver-1.9.25)

---
updated-dependencies:
- dependency-name: org.apache.maven.resolver:maven-resolver-api
  dependency-version: 1.9.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump mavenVersion from 3.9.11 to 3.9.12 (apache#388)
ecfa913 
Bumps `mavenVersion` from 3.9.11 to 3.9.12.

Updates `org.apache.maven:maven-core` from 3.9.11 to 3.9.12

Updates `org.apache.maven:maven-plugin-api` from 3.9.11 to 3.9.12
- [Release notes](https://github.com/apache/maven/releases)
- [Commits](apache/maven@maven-3.9.11...maven-3.9.12)

Updates `org.apache.maven:maven-settings` from 3.9.11 to 3.9.12

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-core
  dependency-version: 3.9.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven:maven-plugin-api
  dependency-version: 3.9.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.apache.maven:maven-settings
  dependency-version: 3.9.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mnk mnk mentioned this pull request Dec 17, 2025
Open
dependabot bot and others added 9 commits December 22, 2025 06:42
@dependabot
Bump org.codehaus.mojo:exec-maven-plugin from 3.6.2 to 3.6.3 (apache#389
2c78a23 
)

Bumps [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) from 3.6.2 to 3.6.3.
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](mojohaus/exec-maven-plugin@3.6.2...3.6.3)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.apache.maven:maven-parent from 45 to 46 (apache#390)
bb62ef7 
Bumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 45 to 46.
- [Release notes](https://github.com/apache/maven-parent/releases)
- [Commits](https://github.com/apache/maven-parent/commits)

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-parent
  dependency-version: '46'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.codehaus.plexus:plexus-archiver from 4.10.4 to 4.11.0 (apach…
e0f41e5 
…e#391)

Bumps [org.codehaus.plexus:plexus-archiver](https://github.com/codehaus-plexus/plexus-archiver) from 4.10.4 to 4.11.0.
- [Release notes](https://github.com/codehaus-plexus/plexus-archiver/releases)
- [Changelog](https://github.com/codehaus-plexus/plexus-archiver/blob/master/ReleaseNotes.md)
- [Commits](codehaus-plexus/plexus-archiver@plexus-archiver-4.10.4...plexus-archiver-4.11.0)

---
updated-dependencies:
- dependency-name: org.codehaus.plexus:plexus-archiver
  dependency-version: 4.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Bump org.apache.maven:maven-parent from 46 to 47 (apache#392)
5d65ea1 
Bumps [org.apache.maven:maven-parent](https://github.com/apache/maven-parent) from 46 to 47.
- [Release notes](https://github.com/apache/maven-parent/releases)
- [Commits](https://github.com/apache/maven-parent/commits)

---
updated-dependencies:
- dependency-name: org.apache.maven:maven-parent
  dependency-version: '47'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@emilime93 @slachiewicz
Add --strict flag to sha256sum verification
4ab5304 
Without it, the macOS implementation exits with code 0 for malformed input, triggering a false positive
@marshalhayes @slachiewicz
Allow m2 path to be hidden on Windows
7443d4e
@idiotcult @slachiewicz
Fix premature output of distribution URL
df87075
@gnodet @slachiewicz
Also test with Maven 4
eb05003
@hazendaz
Normalization: Ensure end of file markers per git standards and tabs …
3254015 
…as spaces (apache#361)
@slawekjaranowski slawekjaranowski linked an issue Jan 18, 2026 that may be closed by this pull request
[MWRAPPER-117] Wrapper distributions and jars sha256 checksums should be published #316
Open
@slawekjaranowski
Copy link
Member

slawekjaranowski commented Jan 18, 2026

@erik-meuwese-topicus can you try to rebase ... there no build was triggered on GH

dependabot bot and others added 3 commits January 19, 2026 07:38
@dependabot
Bump org.codehaus.mojo:mrm-maven-plugin from 1.7.0 to 1.7.1 (apache#394)
92da30c 
Bumps [org.codehaus.mojo:mrm-maven-plugin](https://github.com/mojohaus/mrm) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/mojohaus/mrm/releases)
- [Commits](mojohaus/mrm@1.7.0...mrm-1.7.1)

---
updated-dependencies:
- dependency-name: org.codehaus.mojo:mrm-maven-plugin
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@erik-meuwese-topicus
MWRAPPER-117 - added distributionSha512Sum and wrapperSha512Sum for v…
335b1fd 
…erification with SHA-512 since Maven only publishes the SHA-512 checksum and not the SHA-256 checksum
@erik-meuwese-topicus
Merge remote-tracking branch 'origin/MWRAPPER-117-add-sha512-checksum…
fcd8156 
…' into MWRAPPER-117-add-sha512-checksum
@erik-meuwese-topicus erik-meuwese-topicus deleted the MWRAPPER-117-add-sha512-checksum branch January 28, 2026 20:06
@erik-meuwese-topicus
Copy link
Author

erik-meuwese-topicus commented Jan 28, 2026

replaced by #398

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[MWRAPPER-117] Wrapper distributions and jars sha256 checksums should be published

7 participants

@erik-meuwese-topicus @slawekjaranowski @emilime93 @marshalhayes @idiotcult @gnodet @hazendaz