Skip to content

Commit 4d4477e

Browse files
wing328wing328
authoredMay 31, 2023
update maven wrapper to 3.9.0 (OpenAPITools#15694)
1 parent 1ad8316 commit 4d4477e

File tree

5 files changed

+133
-241
lines changed

5 files changed

+133
-241
lines changed
 

‎.mvn/wrapper/MavenWrapperDownloader.java

-117
This file was deleted.

‎.mvn/wrapper/maven-wrapper.jar

3.73 KB
Binary file not shown.

‎.mvn/wrapper/maven-wrapper.properties

+4-4
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@
55
# to you under the Apache License, Version 2.0 (the
66
# "License"); you may not use this file except in compliance
77
# with the License. You may obtain a copy of the License at
8-
#
8+
#
99
# http://www.apache.org/licenses/LICENSE-2.0
10-
#
10+
#
1111
# Unless required by applicable law or agreed to in writing,
1212
# software distributed under the License is distributed on an
1313
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
1414
# KIND, either express or implied. See the License for the
1515
# specific language governing permissions and limitations
1616
# under the License.
17-
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.4/apache-maven-3.8.4-bin.zip
18-
wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar
17+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.0/apache-maven-3.9.0-bin.zip
18+
wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar

‎mvnw

+105-113
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,14 @@
1919
# ----------------------------------------------------------------------------
2020

2121
# ----------------------------------------------------------------------------
22-
# Maven Start Up Batch script
22+
# Apache Maven Wrapper startup batch script, version 3.2.0
2323
#
2424
# Required ENV vars:
2525
# ------------------
2626
# JAVA_HOME - location of a JDK home dir
2727
#
2828
# Optional ENV vars
2929
# -----------------
30-
# M2_HOME - location of maven2's installed home dir
3130
# MAVEN_OPTS - parameters passed to the Java VM when running Maven
3231
# e.g. to debug Maven itself, use
3332
# set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
@@ -54,86 +53,56 @@ fi
5453
cygwin=false;
5554
darwin=false;
5655
mingw=false
57-
case "`uname`" in
56+
case "$(uname)" in
5857
CYGWIN*) cygwin=true ;;
5958
MINGW*) mingw=true;;
6059
Darwin*) darwin=true
6160
# Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home
6261
# See https://developer.apple.com/library/mac/qa/qa1170/_index.html
6362
if [ -z "$JAVA_HOME" ]; then
6463
if [ -x "/usr/libexec/java_home" ]; then
65-
export JAVA_HOME="`/usr/libexec/java_home`"
64+
JAVA_HOME="$(/usr/libexec/java_home)"; export JAVA_HOME
6665
else
67-
export JAVA_HOME="/Library/Java/Home"
66+
JAVA_HOME="/Library/Java/Home"; export JAVA_HOME
6867
fi
6968
fi
7069
;;
7170
esac
7271

7372
if [ -z "$JAVA_HOME" ] ; then
7473
if [ -r /etc/gentoo-release ] ; then
75-
JAVA_HOME=`java-config --jre-home`
74+
JAVA_HOME=$(java-config --jre-home)
7675
fi
7776
fi
7877

79-
if [ -z "$M2_HOME" ] ; then
80-
## resolve links - $0 may be a link to maven's home
81-
PRG="$0"
82-
83-
# need this for relative symlinks
84-
while [ -h "$PRG" ] ; do
85-
ls=`ls -ld "$PRG"`
86-
link=`expr "$ls" : '.*-> \(.*\)$'`
87-
if expr "$link" : '/.*' > /dev/null; then
88-
PRG="$link"
89-
else
90-
PRG="`dirname "$PRG"`/$link"
91-
fi
92-
done
93-
94-
saveddir=`pwd`
95-
96-
M2_HOME=`dirname "$PRG"`/..
97-
98-
# make it fully qualified
99-
M2_HOME=`cd "$M2_HOME" && pwd`
100-
101-
cd "$saveddir"
102-
# echo Using m2 at $M2_HOME
103-
fi
104-
10578
# For Cygwin, ensure paths are in UNIX format before anything is touched
10679
if $cygwin ; then
107-
[ -n "$M2_HOME" ] &&
108-
M2_HOME=`cygpath --unix "$M2_HOME"`
10980
[ -n "$JAVA_HOME" ] &&
110-
JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
81+
JAVA_HOME=$(cygpath --unix "$JAVA_HOME")
11182
[ -n "$CLASSPATH" ] &&
112-
CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
83+
CLASSPATH=$(cygpath --path --unix "$CLASSPATH")
11384
fi
11485

11586
# For Mingw, ensure paths are in UNIX format before anything is touched
11687
if $mingw ; then
117-
[ -n "$M2_HOME" ] &&
118-
M2_HOME="`(cd "$M2_HOME"; pwd)`"
119-
[ -n "$JAVA_HOME" ] &&
120-
JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`"
88+
[ -n "$JAVA_HOME" ] && [ -d "$JAVA_HOME" ] &&
89+
JAVA_HOME="$(cd "$JAVA_HOME" || (echo "cannot cd into $JAVA_HOME."; exit 1); pwd)"
12190
fi
12291

12392
if [ -z "$JAVA_HOME" ]; then
124-
javaExecutable="`which javac`"
125-
if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '\([^ ]*\)'`" = "no" ]; then
93+
javaExecutable="$(which javac)"
94+
if [ -n "$javaExecutable" ] && ! [ "$(expr "\"$javaExecutable\"" : '\([^ ]*\)')" = "no" ]; then
12695
# readlink(1) is not available as standard on Solaris 10.
127-
readLink=`which readlink`
128-
if [ ! `expr "$readLink" : '\([^ ]*\)'` = "no" ]; then
96+
readLink=$(which readlink)
97+
if [ ! "$(expr "$readLink" : '\([^ ]*\)')" = "no" ]; then
12998
if $darwin ; then
130-
javaHome="`dirname \"$javaExecutable\"`"
131-
javaExecutable="`cd \"$javaHome\" && pwd -P`/javac"
99+
javaHome="$(dirname "\"$javaExecutable\"")"
100+
javaExecutable="$(cd "\"$javaHome\"" && pwd -P)/javac"
132101
else
133-
javaExecutable="`readlink -f \"$javaExecutable\"`"
102+
javaExecutable="$(readlink -f "\"$javaExecutable\"")"
134103
fi
135-
javaHome="`dirname \"$javaExecutable\"`"
136-
javaHome=`expr "$javaHome" : '\(.*\)/bin'`
104+
javaHome="$(dirname "\"$javaExecutable\"")"
105+
javaHome=$(expr "$javaHome" : '\(.*\)/bin')
137106
JAVA_HOME="$javaHome"
138107
export JAVA_HOME
139108
fi
@@ -149,7 +118,7 @@ if [ -z "$JAVACMD" ] ; then
149118
JAVACMD="$JAVA_HOME/bin/java"
150119
fi
151120
else
152-
JAVACMD="`\\unset -f command; \\command -v java`"
121+
JAVACMD="$(\unset -f command 2>/dev/null; \command -v java)"
153122
fi
154123
fi
155124

@@ -163,12 +132,9 @@ if [ -z "$JAVA_HOME" ] ; then
163132
echo "Warning: JAVA_HOME environment variable is not set."
164133
fi
165134

166-
CLASSWORLDS_LAUNCHER=org.codehaus.plexus.classworlds.launcher.Launcher
167-
168135
# traverses directory structure from process work directory to filesystem root
169136
# first directory with .mvn subdirectory is considered project base directory
170137
find_maven_basedir() {
171-
172138
if [ -z "$1" ]
173139
then
174140
echo "Path not specified to find_maven_basedir"
@@ -184,96 +150,99 @@ find_maven_basedir() {
184150
fi
185151
# workaround for JBEAP-8937 (on Solaris 10/Sparc)
186152
if [ -d "${wdir}" ]; then
187-
wdir=`cd "$wdir/.."; pwd`
153+
wdir=$(cd "$wdir/.." || exit 1; pwd)
188154
fi
189155
# end of workaround
190156
done
191-
echo "${basedir}"
157+
printf '%s' "$(cd "$basedir" || exit 1; pwd)"
192158
}
193159

194160
# concatenates all lines of a file
195161
concat_lines() {
196162
if [ -f "$1" ]; then
197-
echo "$(tr -s '\n' ' ' < "$1")"
163+
# Remove \r in case we run on Windows within Git Bash
164+
# and check out the repository with auto CRLF management
165+
# enabled. Otherwise, we may read lines that are delimited with
166+
# \r\n and produce $'-Xarg\r' rather than -Xarg due to word
167+
# splitting rules.
168+
tr -s '\r\n' ' ' < "$1"
169+
fi
170+
}
171+
172+
log() {
173+
if [ "$MVNW_VERBOSE" = true ]; then
174+
printf '%s\n' "$1"
198175
fi
199176
}
200177

201-
BASE_DIR=`find_maven_basedir "$(pwd)"`
178+
BASE_DIR=$(find_maven_basedir "$(dirname "$0")")
202179
if [ -z "$BASE_DIR" ]; then
203180
exit 1;
204181
fi
205182

183+
MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}; export MAVEN_PROJECTBASEDIR
184+
log "$MAVEN_PROJECTBASEDIR"
185+
206186
##########################################################################################
207187
# Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
208188
# This allows using the maven wrapper in projects that prohibit checking in binary data.
209189
##########################################################################################
210-
if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then
211-
if [ "$MVNW_VERBOSE" = true ]; then
212-
echo "Found .mvn/wrapper/maven-wrapper.jar"
213-
fi
190+
wrapperJarPath="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar"
191+
if [ -r "$wrapperJarPath" ]; then
192+
log "Found $wrapperJarPath"
214193
else
215-
if [ "$MVNW_VERBOSE" = true ]; then
216-
echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..."
217-
fi
194+
log "Couldn't find $wrapperJarPath, downloading it ..."
195+
218196
if [ -n "$MVNW_REPOURL" ]; then
219-
jarUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar"
197+
wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
220198
else
221-
jarUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar"
199+
wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
222200
fi
223-
while IFS="=" read key value; do
224-
case "$key" in (wrapperUrl) jarUrl="$value"; break ;;
201+
while IFS="=" read -r key value; do
202+
# Remove '\r' from value to allow usage on windows as IFS does not consider '\r' as a separator ( considers space, tab, new line ('\n'), and custom '=' )
203+
safeValue=$(echo "$value" | tr -d '\r')
204+
case "$key" in (wrapperUrl) wrapperUrl="$safeValue"; break ;;
225205
esac
226-
done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties"
227-
if [ "$MVNW_VERBOSE" = true ]; then
228-
echo "Downloading from: $jarUrl"
229-
fi
230-
wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar"
206+
done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
207+
log "Downloading from: $wrapperUrl"
208+
231209
if $cygwin; then
232-
wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"`
210+
wrapperJarPath=$(cygpath --path --windows "$wrapperJarPath")
233211
fi
234212

235213
if command -v wget > /dev/null; then
236-
if [ "$MVNW_VERBOSE" = true ]; then
237-
echo "Found wget ... using wget"
238-
fi
214+
log "Found wget ... using wget"
215+
[ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--quiet"
239216
if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
240-
wget "$jarUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
217+
wget $QUIET "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
241218
else
242-
wget --http-user=$MVNW_USERNAME --http-password=$MVNW_PASSWORD "$jarUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
219+
wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath" || rm -f "$wrapperJarPath"
243220
fi
244221
elif command -v curl > /dev/null; then
245-
if [ "$MVNW_VERBOSE" = true ]; then
246-
echo "Found curl ... using curl"
247-
fi
222+
log "Found curl ... using curl"
223+
[ "$MVNW_VERBOSE" = true ] && QUIET="" || QUIET="--silent"
248224
if [ -z "$MVNW_USERNAME" ] || [ -z "$MVNW_PASSWORD" ]; then
249-
curl -o "$wrapperJarPath" "$jarUrl" -f
225+
curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
250226
else
251-
curl --user $MVNW_USERNAME:$MVNW_PASSWORD -o "$wrapperJarPath" "$jarUrl" -f
227+
curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L || rm -f "$wrapperJarPath"
252228
fi
253-
254229
else
255-
if [ "$MVNW_VERBOSE" = true ]; then
256-
echo "Falling back to using Java to download"
257-
fi
258-
javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java"
230+
log "Falling back to using Java to download"
231+
javaSource="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.java"
232+
javaClass="$MAVEN_PROJECTBASEDIR/.mvn/wrapper/MavenWrapperDownloader.class"
259233
# For Cygwin, switch paths to Windows format before running javac
260234
if $cygwin; then
261-
javaClass=`cygpath --path --windows "$javaClass"`
235+
javaSource=$(cygpath --path --windows "$javaSource")
236+
javaClass=$(cygpath --path --windows "$javaClass")
262237
fi
263-
if [ -e "$javaClass" ]; then
264-
if [ ! -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then
265-
if [ "$MVNW_VERBOSE" = true ]; then
266-
echo " - Compiling MavenWrapperDownloader.java ..."
267-
fi
268-
# Compiling the Java class
269-
("$JAVA_HOME/bin/javac" "$javaClass")
238+
if [ -e "$javaSource" ]; then
239+
if [ ! -e "$javaClass" ]; then
240+
log " - Compiling MavenWrapperDownloader.java ..."
241+
("$JAVA_HOME/bin/javac" "$javaSource")
270242
fi
271-
if [ -e "$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class" ]; then
272-
# Running the downloader
273-
if [ "$MVNW_VERBOSE" = true ]; then
274-
echo " - Running MavenWrapperDownloader.java ..."
275-
fi
276-
("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR")
243+
if [ -e "$javaClass" ]; then
244+
log " - Running MavenWrapperDownloader.java ..."
245+
("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$wrapperUrl" "$wrapperJarPath") || rm -f "$wrapperJarPath"
277246
fi
278247
fi
279248
fi
@@ -282,35 +251,58 @@ fi
282251
# End of extension
283252
##########################################################################################
284253

285-
export MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}
286-
if [ "$MVNW_VERBOSE" = true ]; then
287-
echo $MAVEN_PROJECTBASEDIR
254+
# If specified, validate the SHA-256 sum of the Maven wrapper jar file
255+
wrapperSha256Sum=""
256+
while IFS="=" read -r key value; do
257+
case "$key" in (wrapperSha256Sum) wrapperSha256Sum=$value; break ;;
258+
esac
259+
done < "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.properties"
260+
if [ -n "$wrapperSha256Sum" ]; then
261+
wrapperSha256Result=false
262+
if command -v sha256sum > /dev/null; then
263+
if echo "$wrapperSha256Sum $wrapperJarPath" | sha256sum -c > /dev/null 2>&1; then
264+
wrapperSha256Result=true
265+
fi
266+
elif command -v shasum > /dev/null; then
267+
if echo "$wrapperSha256Sum $wrapperJarPath" | shasum -a 256 -c > /dev/null 2>&1; then
268+
wrapperSha256Result=true
269+
fi
270+
else
271+
echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available."
272+
echo "Please install either command, or disable validation by removing 'wrapperSha256Sum' from your maven-wrapper.properties."
273+
exit 1
274+
fi
275+
if [ $wrapperSha256Result = false ]; then
276+
echo "Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised." >&2
277+
echo "Investigate or delete $wrapperJarPath to attempt a clean download." >&2
278+
echo "If you updated your Maven version, you need to update the specified wrapperSha256Sum property." >&2
279+
exit 1
280+
fi
288281
fi
282+
289283
MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS"
290284

291285
# For Cygwin, switch paths to Windows format before running java
292286
if $cygwin; then
293-
[ -n "$M2_HOME" ] &&
294-
M2_HOME=`cygpath --path --windows "$M2_HOME"`
295287
[ -n "$JAVA_HOME" ] &&
296-
JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"`
288+
JAVA_HOME=$(cygpath --path --windows "$JAVA_HOME")
297289
[ -n "$CLASSPATH" ] &&
298-
CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
290+
CLASSPATH=$(cygpath --path --windows "$CLASSPATH")
299291
[ -n "$MAVEN_PROJECTBASEDIR" ] &&
300-
MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"`
292+
MAVEN_PROJECTBASEDIR=$(cygpath --path --windows "$MAVEN_PROJECTBASEDIR")
301293
fi
302294

303295
# Provide a "standardized" way to retrieve the CLI args that will
304296
# work with both Windows and non-Windows executions.
305-
MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@"
297+
MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $*"
306298
export MAVEN_CMD_LINE_ARGS
307299

308300
WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
309301

302+
# shellcheck disable=SC2086 # safe args
310303
exec "$JAVACMD" \
311304
$MAVEN_OPTS \
312305
$MAVEN_DEBUG_OPTS \
313306
-classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \
314-
"-Dmaven.home=${M2_HOME}" \
315307
"-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \
316308
${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@"

‎mvnw.cmd

+24-7
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,12 @@
1818
@REM ----------------------------------------------------------------------------
1919

2020
@REM ----------------------------------------------------------------------------
21-
@REM Maven Start Up Batch script
21+
@REM Apache Maven Wrapper startup batch script, version 3.2.0
2222
@REM
2323
@REM Required ENV vars:
2424
@REM JAVA_HOME - location of a JDK home dir
2525
@REM
2626
@REM Optional ENV vars
27-
@REM M2_HOME - location of maven2's installed home dir
2827
@REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands
2928
@REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending
3029
@REM MAVEN_OPTS - parameters passed to the Java VM when running Maven
@@ -120,10 +119,10 @@ SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
120119
set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
121120
set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
122121

123-
set DOWNLOAD_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar"
122+
set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
124123

125124
FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
126-
IF "%%A"=="wrapperUrl" SET DOWNLOAD_URL=%%B
125+
IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
127126
)
128127

129128
@REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
@@ -134,26 +133,44 @@ if exist %WRAPPER_JAR% (
134133
)
135134
) else (
136135
if not "%MVNW_REPOURL%" == "" (
137-
SET DOWNLOAD_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar"
136+
SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar"
138137
)
139138
if "%MVNW_VERBOSE%" == "true" (
140139
echo Couldn't find %WRAPPER_JAR%, downloading it ...
141-
echo Downloading from: %DOWNLOAD_URL%
140+
echo Downloading from: %WRAPPER_URL%
142141
)
143142

144143
powershell -Command "&{"^
145144
"$webclient = new-object System.Net.WebClient;"^
146145
"if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^
147146
"$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^
148147
"}"^
149-
"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%DOWNLOAD_URL%', '%WRAPPER_JAR%')"^
148+
"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%WRAPPER_URL%', '%WRAPPER_JAR%')"^
150149
"}"
151150
if "%MVNW_VERBOSE%" == "true" (
152151
echo Finished downloading %WRAPPER_JAR%
153152
)
154153
)
155154
@REM End of extension
156155

156+
@REM If specified, validate the SHA-256 sum of the Maven wrapper jar file
157+
SET WRAPPER_SHA_256_SUM=""
158+
FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
159+
IF "%%A"=="wrapperSha256Sum" SET WRAPPER_SHA_256_SUM=%%B
160+
)
161+
IF NOT %WRAPPER_SHA_256_SUM%=="" (
162+
powershell -Command "&{"^
163+
"$hash = (Get-FileHash \"%WRAPPER_JAR%\" -Algorithm SHA256).Hash.ToLower();"^
164+
"If('%WRAPPER_SHA_256_SUM%' -ne $hash){"^
165+
" Write-Output 'Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised.';"^
166+
" Write-Output 'Investigate or delete %WRAPPER_JAR% to attempt a clean download.';"^
167+
" Write-Output 'If you updated your Maven version, you need to update the specified wrapperSha256Sum property.';"^
168+
" exit 1;"^
169+
"}"^
170+
"}"
171+
if ERRORLEVEL 1 goto error
172+
)
173+
157174
@REM Provide a "standardized" way to retrieve the CLI args that will
158175
@REM work with both Windows and non-Windows executions.
159176
set MAVEN_CMD_LINE_ARGS=%*

0 commit comments

Comments
 (0)
Please sign in to comment.