[MWRAPPER-75] Allow for sha256 checksum verification of downloaded artifacts.

• Type: New Feature
• Status: Closed
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.2.0
• Component/s: Maven Wrapper Jar, Maven Wrapper Plugin, Maven Wrapper Scripts
• Assignee: Slawomir Jaranowski
• Reporter: Rafael Winterhalter
• Created: 03/Aug/22 07:06
• Updated: 08/Mar/23 22:59
• Resolved: 05/Oct/22 19:44

Description

Maven Wrapper is downloading binary artifacts that are later executed. To prevent from an attack where a vulnerable repository could distribute malicious Maven (wrapper) artifacts, the downloaded artifacts should be verified against a secure checksum. If the expected checksum does not match, execution could be aborted before the potentially compromised artifact is executed.

In my PR, i chose SHA-256 as it is cheaper to compute than SHA-512 but still impossible to replicate with a corrupted binary.

Issue Links

• relates to: MWRAPPER-50 Verify checksum when downloading maven-wrapper.jar
• relates to: MWRAPPER-79 Automatically add sha256 to maven-wrapper.properties
• links to: GitHub Pull Request #58