You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "simono (via GitHub)" <gi...@apache.org> on 2026/07/23 20:34:51 UTC

Re: [I] SHA-256 validation fails when unzip is unavailable because distribution format is silently changed to .tar.gz [maven-wrapper]

simono commented on issue #425:
URL: https://github.com/apache/maven-wrapper/issues/425#issuecomment-5063146758

   Thanks for the clear write-up, @rhusar — this made the root cause easy to pin down.
   
   I've opened #435 with a fix. Rather than silently downloading the `.tar.gz` and validating it against the `.zip`'s checksum, `only-mvnw` now fails fast when `unzip` is missing *and* a `distributionSha256Sum` is pinned, with an actionable message (install `unzip`, or drop the checksum to allow the `.tar.gz` fallback). The fallback is unchanged when no checksum is pinned.
   
   If you have a moment, a review on the PR would be very welcome — you know the reproduction best.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org