-
Notifications
You must be signed in to change notification settings - Fork 69
[MWRAPPER-117] added distributionSha512Sum and wrapperSha512Sum #398
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -108,11 +108,12 @@ trim() { | |
| scriptDir="$(dirname "$0")" | ||
| scriptName="$(basename "$0")" | ||
|
|
||
| # parse distributionUrl and optional distributionSha256Sum, requires .mvn/wrapper/maven-wrapper.properties | ||
| # parse distributionUrl and optional distributionSha256Sum or distributionSha512Sum, requires .mvn/wrapper/maven-wrapper.properties | ||
| while IFS="=" read -r key value; do | ||
| case "${key-}" in | ||
| distributionUrl) distributionUrl=$(trim "${value-}") ;; | ||
| distributionSha256Sum) distributionSha256Sum=$(trim "${value-}") ;; | ||
| distributionSha512Sum) distributionSha512Sum=$(trim "${value-}") ;; | ||
| esac | ||
| done <"$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ||
| [ -n "${distributionUrl-}" ] || die "cannot read distributionUrl property in $scriptDir/.mvn/wrapper/maven-wrapper.properties" | ||
|
|
@@ -249,6 +250,33 @@ if [ -n "${distributionSha256Sum-}" ]; then | |
| fi | ||
| fi | ||
|
|
||
| # If specified, validate the SHA-512 sum of the Maven distribution zip file | ||
| if [ -n "${distributionSha512Sum-}" ]; then | ||
| distributionSha512Result=false | ||
| if [ "$MVN_CMD" = mvnd.sh ]; then | ||
| echo "Checksum validation is not supported for maven-mvnd." >&2 | ||
| echo "Please disable validation by removing 'distributionSha512Sum' from your maven-wrapper.properties." >&2 | ||
| exit 1 | ||
| elif command -v sha512sum >/dev/null; then | ||
| if echo "$distributionSha512Sum $TMP_DOWNLOAD_DIR/$distributionUrlName" | sha512sum -c - >/dev/null 2>&1; then | ||
| distributionSha512Result=true | ||
| fi | ||
| elif command -v shasum >/dev/null; then | ||
| if echo "$distributionSha512Sum $TMP_DOWNLOAD_DIR/$distributionUrlName" | shasum -a 512 -c >/dev/null 2>&1; then | ||
| distributionSha512Result=true | ||
| fi | ||
| else | ||
| echo "Checksum validation was requested but neither 'sha512sum' or 'shasum' are available." >&2 | ||
| echo "Please install either command, or disable validation by removing 'distributionSha512Sum' from your maven-wrapper.properties." >&2 | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. no Please |
||
| exit 1 | ||
| fi | ||
| if [ $distributionSha512Result = false ]; then | ||
| echo "Error: Failed to validate Maven distribution SHA-512, your Maven distribution might be compromised." >&2 | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. run-on sentence |
||
| echo "If you updated your Maven version, you need to update the specified distributionSha512Sum property." >&2 | ||
| exit 1 | ||
| fi | ||
| fi | ||
|
|
||
| # unzip and move | ||
| if command -v unzip >/dev/null; then | ||
| unzip ${__MVNW_QUIET_UNZIP:+"$__MVNW_QUIET_UNZIP"} "$TMP_DOWNLOAD_DIR/$distributionUrlName" -d "$TMP_DOWNLOAD_DIR" || die "failed to unzip" | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -146,6 +146,18 @@ if ($distributionSha256Sum) { | |
| } | ||
| } | ||
|
|
||
| # If specified, validate the SHA-512 sum of the Maven distribution zip file | ||
| $distributionSha512Sum = (Get-Content -Raw "$scriptDir/.mvn/wrapper/maven-wrapper.properties" | ConvertFrom-StringData).distributionSha512Sum | ||
| if ($distributionSha512Sum) { | ||
| if ($USE_MVND) { | ||
| Write-Error "Checksum validation is not supported for maven-mvnd. `nPlease disable validation by removing 'distributionSha512Sum' from your maven-wrapper.properties." | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. remove nPlease |
||
| } | ||
| Import-Module $PSHOME\Modules\Microsoft.PowerShell.Utility -Function Get-FileHash | ||
| if ((Get-FileHash "$TMP_DOWNLOAD_DIR/$distributionUrlName" -Algorithm SHA512).Hash.ToLower() -ne $distributionSha512Sum) { | ||
| Write-Error "Error: Failed to validate Maven distribution SHA-512, your Maven distribution might be compromised. If you updated your Maven version, you need to update the specified distributionSha512Sum property." | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. run-on sentence |
||
| } | ||
| } | ||
|
|
||
| # unzip and move | ||
| Expand-Archive "$TMP_DOWNLOAD_DIR/$distributionUrlName" -DestinationPath "$TMP_DOWNLOAD_DIR" | Out-Null | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| <?xml version='1.0' encoding='UTF-8'?> | ||
|
|
||
| <!-- | ||
| Licensed to the Apache Software Foundation (ASF) under one | ||
| or more contributor license agreements. See the NOTICE file | ||
| distributed with this work for additional information | ||
| regarding copyright ownership. The ASF licenses this file | ||
| to you under the Apache License, Version 2.0 (the | ||
| "License"); you may not use this file except in compliance | ||
| with the License. You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, | ||
| software distributed under the License is distributed on an | ||
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| KIND, either express or implied. See the License for the | ||
| specific language governing permissions and limitations | ||
| under the License. | ||
| --> | ||
|
|
||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
|
|
||
| <groupId>org.apache.maven.plugins.it.wrapper</groupId> | ||
| <artifactId>extension</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| <packaging>pom</packaging> | ||
|
|
||
| <properties> | ||
| <cmd></cmd> | ||
| </properties> | ||
|
|
||
| <build> | ||
| <pluginManagement> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.codehaus.mojo</groupId> | ||
| <artifactId>exec-maven-plugin</artifactId> | ||
| <version>@version.exec-maven-plugin@</version> | ||
| <configuration> | ||
| <executable>mvnw${cmd}</executable> | ||
| <successCodes> | ||
| <successCode>1</successCode> | ||
| </successCodes> | ||
| <arguments> | ||
| <argument>-v</argument> | ||
| </arguments> | ||
| <environmentVariables> | ||
| <MVNW_VERBOSE>true</MVNW_VERBOSE> | ||
| </environmentVariables> | ||
| </configuration> | ||
| </plugin> | ||
| </plugins> | ||
| </pluginManagement> | ||
| </build> | ||
|
|
||
| <profiles> | ||
| <profile> | ||
| <id>windows</id> | ||
| <activation> | ||
| <os><family>windows</family></os> | ||
| </activation> | ||
| <properties> | ||
| <cmd>.cmd</cmd> | ||
| </properties> | ||
| </profile> | ||
| </profiles> | ||
| </project> |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| # Licensed to the Apache Software Foundation (ASF) under one | ||
| # or more contributor license agreements. See the NOTICE file | ||
| # distributed with this work for additional information | ||
| # regarding copyright ownership. The ASF licenses this file | ||
| # to you under the Apache License, Version 2.0 (the | ||
| # "License"); you may not use this file except in compliance | ||
| # with the License. You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, | ||
| # software distributed under the License is distributed on an | ||
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| # KIND, either express or implied. See the License for the | ||
| # specific language governing permissions and limitations | ||
| # under the License. | ||
|
|
||
| alwaysUnpack=true | ||
| type=bin | ||
| distributionSha512Sum=256cdc53261371d6f6fefd92e99d85df5295d1f83ab826106768094a34e6f1b0eb4f7c30e75ada80218ed5bb384bdce334a6697354eef561f50adfc2113c881d |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
|
|
||
| /* | ||
| * Licensed to the Apache Software Foundation (ASF) under one | ||
| * or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information | ||
| * regarding copyright ownership. The ASF licenses this file | ||
| * to you under the Apache License, Version 2.0 (the | ||
| * "License"); you may not use this file except in compliance | ||
| * with the License. You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, | ||
| * software distributed under the License is distributed on an | ||
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| * KIND, either express or implied. See the License for the | ||
| * specific language governing permissions and limitations | ||
| * under the License. | ||
| */ | ||
|
|
||
| assert new File(basedir,'mvnw').exists() | ||
| assert new File(basedir,'mvnw.cmd').exists() | ||
| assert !(new File(basedir,'mvnwDebug').exists()) | ||
| assert !(new File(basedir,'mvnwDebug.cmd').exists()) | ||
|
|
||
| properties = new File(basedir,'.mvn/wrapper/maven-wrapper.properties') | ||
| assert properties.exists() | ||
| assert properties.text.contains('distributionSha512Sum=256cdc53261371d6f6fefd92e99d85df5295d1f83ab826106768094a34e6f1b0eb4f7c30e75ada80218ed5bb384bdce334a6697354eef561f50adfc2113c881d') | ||
|
|
||
| log = new File(basedir, 'build.log').text | ||
| // check "mvn wrapper:wrapper" output | ||
| assert log.contains('Failed to validate Maven distribution SHA-512, your Maven distribution might be compromised.') | ||
|
|
||
| // check "mvnw -v" output | ||
| assert log.contains('Apache Maven ') |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| <?xml version='1.0' encoding='UTF-8'?> | ||
|
|
||
| <!-- | ||
| Licensed to the Apache Software Foundation (ASF) under one | ||
| or more contributor license agreements. See the NOTICE file | ||
| distributed with this work for additional information | ||
| regarding copyright ownership. The ASF licenses this file | ||
| to you under the Apache License, Version 2.0 (the | ||
| "License"); you may not use this file except in compliance | ||
| with the License. You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, | ||
| software distributed under the License is distributed on an | ||
| "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| KIND, either express or implied. See the License for the | ||
| specific language governing permissions and limitations | ||
| under the License. | ||
| --> | ||
|
|
||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
|
|
||
| <groupId>org.apache.maven.plugins.it.wrapper</groupId> | ||
| <artifactId>extension</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| <packaging>pom</packaging> | ||
|
|
||
| <properties> | ||
| <cmd></cmd> | ||
| </properties> | ||
|
|
||
| <build> | ||
| <pluginManagement> | ||
| <plugins> | ||
| <plugin> | ||
| <groupId>org.codehaus.mojo</groupId> | ||
| <artifactId>exec-maven-plugin</artifactId> | ||
| <version>@version.exec-maven-plugin@</version> | ||
| <configuration> | ||
| <executable>mvnw${cmd}</executable> | ||
| <successCodes> | ||
| <successCode>1</successCode> | ||
| </successCodes> | ||
| <arguments> | ||
| <argument>-v</argument> | ||
| </arguments> | ||
| <environmentVariables> | ||
| <MVNW_VERBOSE>true</MVNW_VERBOSE> | ||
| <HOME>${project.build.directory}</HOME> | ||
| <USERPROFILE>${project.build.directory}</USERPROFILE> | ||
| </environmentVariables> | ||
| </configuration> | ||
| </plugin> | ||
| </plugins> | ||
| </pluginManagement> | ||
| </build> | ||
|
|
||
| <profiles> | ||
| <profile> | ||
| <id>windows</id> | ||
| <activation> | ||
| <os><family>windows</family></os> | ||
| </activation> | ||
| <properties> | ||
| <cmd>.cmd</cmd> | ||
| </properties> | ||
| </profile> | ||
| </profiles> | ||
| </project> |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # Licensed to the Apache Software Foundation (ASF) under one | ||
| # or more contributor license agreements. See the NOTICE file | ||
| # distributed with this work for additional information | ||
| # regarding copyright ownership. The ASF licenses this file | ||
| # to you under the Apache License, Version 2.0 (the | ||
| # "License"); you may not use this file except in compliance | ||
| # with the License. You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, | ||
| # software distributed under the License is distributed on an | ||
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | ||
| # KIND, either express or implied. See the License for the | ||
| # specific language governing permissions and limitations | ||
| # under the License. | ||
|
|
||
| type=only-script | ||
| distributionSha512Sum=256cdc53261371d6f6fefd92e99d85df5295d1f83ab826106768094a34e6f1b0eb4f7c30e75ada80218ed5bb384bdce334a6697354eef561f50adfc2113c881d |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
or --> nor