You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by sl...@apache.org on 2026/10/12 20:42:54 UTC
(maven-gh-actions-shared) 01/01: Verify Maven 3.9.0 and older downloads with their SHA-1
This is an automated email from the ASF dual-hosted git repository.
slachiewicz pushed a commit to branch agent/maven-sha1-fallback
in repository https://gitbox.apache.org/repos/asf/maven-gh-actions-shared.git
commit 9e42fe6b9701658bb8043c592416ccc0eadecd13
Author: Sylwester Lachiewicz <sl...@apache.org>
AuthorDate: Mon Oct 12 20:42:46 2026 +0000
Verify Maven 3.9.0 and older downloads with their SHA-1
Central publishes .sha512 only from Maven 3.9.1 on, so a matrix entry for 3.9.0 failed on a 404.
---
.github/workflows/maven-verify.yml | 28 ++++++++++++++++++++++------
1 file changed, 22 insertions(+), 6 deletions(-)
diff --git a/.github/workflows/maven-verify.yml b/.github/workflows/maven-verify.yml
index 444150f..e5662b7 100644
--- a/.github/workflows/maven-verify.yml
+++ b/.github/workflows/maven-verify.yml
@@ -366,9 +366,17 @@ jobs:
mkdir -p ~/.m2/dists
archive="$HOME/.m2/dists/apache-maven-$MAVEN_VERSION-bin.tar.gz"
curl --fail --silent --show-error --location --retry 5 --retry-all-errors --output "$archive" "$url"
- expected="$(curl --fail --silent --show-error --location --retry 5 --retry-all-errors "$url.sha512" | cut -d ' ' -f 1)"
- actual="$(openssl dgst -sha512 -r "$archive" | cut -d ' ' -f 1)"
- [ "$expected" = "$actual" ] || { echo "::error::SHA-512 mismatch for $url"; exit 1; }
+ # Central has no .sha512 before Maven 3.9.1; fall back to .sha1 there
+ # (--retry without --retry-all-errors: a 404 is final)
+ if expected="$(curl --fail --silent --location --retry 5 "$url.sha512")"; then
+ algorithm=sha512
+ else
+ expected="$(curl --fail --silent --show-error --location --retry 5 --retry-all-errors "$url.sha1")"
+ algorithm=sha1
+ fi
+ expected="$(echo "$expected" | cut -d ' ' -f 1)"
+ actual="$(openssl dgst -$algorithm -r "$archive" | cut -d ' ' -f 1)"
+ [ "$expected" = "$actual" ] || { echo "::error::$algorithm mismatch for $url"; exit 1; }
tar -xzf "$archive" -C ~/.m2/dists
rm "$archive"
@@ -553,9 +561,17 @@ jobs:
mkdir -p ~/.m2/dists
archive="$HOME/.m2/dists/apache-maven-$MAVEN_VERSION-bin.tar.gz"
curl --fail --silent --show-error --location --retry 5 --retry-all-errors --output "$archive" "$url"
- expected="$(curl --fail --silent --show-error --location --retry 5 --retry-all-errors "$url.sha512" | cut -d ' ' -f 1)"
- actual="$(openssl dgst -sha512 -r "$archive" | cut -d ' ' -f 1)"
- [ "$expected" = "$actual" ] || { echo "::error::SHA-512 mismatch for $url"; exit 1; }
+ # Central has no .sha512 before Maven 3.9.1; fall back to .sha1 there
+ # (--retry without --retry-all-errors: a 404 is final)
+ if expected="$(curl --fail --silent --location --retry 5 "$url.sha512")"; then
+ algorithm=sha512
+ else
+ expected="$(curl --fail --silent --show-error --location --retry 5 --retry-all-errors "$url.sha1")"
+ algorithm=sha1
+ fi
+ expected="$(echo "$expected" | cut -d ' ' -f 1)"
+ actual="$(openssl dgst -$algorithm -r "$archive" | cut -d ' ' -f 1)"
+ [ "$expected" = "$actual" ] || { echo "::error::$algorithm mismatch for $url"; exit 1; }
tar -xzf "$archive" -C ~/.m2/dists
rm "$archive"