[I] mvnw silently continues when no download mechanism is available (missing final else) [maven-wrapper]

["waylog-marcus (via GitHub)" <gi...@apache.org>]

waylog-marcus opened a new issue, #441:
URL: https://github.com/apache/maven-wrapper/issues/441

   ## Description
   
   In the `mvnw` script generated by maven-wrapper 3.3.4 (`distributionType=only-script`), the download dispatch is a three-branch chain with no final `else`:
   
   ```sh
   if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
     wget ... || die "wget: Failed to fetch $distributionUrl"
   elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
     curl ... || die "curl: Failed to fetch $distributionUrl"
   elif set_java_home; then
     # compile and run Downloader.java
   fi
   ```
   
   If all three conditions are false — no `wget`, no `curl`, and `set_java_home` fails (no `JAVA_HOME`, no `java`/`javac` on `PATH`) — the block is a no-op. Execution continues, the SHA-256 validation block is skipped when `distributionSha256Sum` is unset, and the script then attempts to unzip/untar a file that was never downloaded.
   
   The user sees an `unzip`/`tar` failure about a missing or corrupt archive rather than the actual cause, which is that no download mechanism was available.
   
   ## Steps to reproduce
   
   Run `./mvnw -v` on a machine where `wget` and `curl` are absent from `PATH`, `JAVA_HOME` is unset, and neither `java` nor `javac` is on `PATH`, with no distribution yet cached under `${MAVEN_USER_HOME}/wrapper/dists`.
   
   ## Suggested fix
   
   Add a final `else` that fails with a clear message, and/or assert the archive exists before extraction:
   
   ```sh
   else
     die "No download mechanism available: install wget or curl, or make a JDK available on PATH / via JAVA_HOME"
   fi
   
   [ -f "$TMP_DOWNLOAD_DIR/$distributionUrlName" ] || die "Distribution was not downloaded: $distributionUrl"
   ```
   
   ## Related question
   
   The `wget` and `curl` branches are both gated on `[ -z "${MVNW_USERNAME-}" ]`, so when `MVNW_USERNAME` is set they are skipped even if available, and the script always falls through to the Java downloader. Earlier jar-based wrapper scripts passed credentials directly (`wget --http-user=… --http-password=…`, `curl --user …`). If that is deliberate — because `Downloader.java` centralises auth via `java.net.Authenticator` — it may be worth a comment, since it means a machine with `curl` but no JDK cannot perform an authenticated download.
   
   ## Environment
   
   maven-wrapper 3.3.4, `distributionType=only-script`, Maven 3.9.16.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] mvnw silently continues when no download mechanism is available (missing final else) [maven-wrapper]

["AzazelSensei (via GitHub)" <gi...@apache.org>]

AzazelSensei commented on issue #441:
URL: https://github.com/apache/maven-wrapper/issues/441#issuecomment-5303933701

   Opened #443 for this.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org