[MWRAPPER-50] Verify checksum when downloading maven-wrapper.jar  

**[Premek Vyhnal](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=premek)** opened **[MWRAPPER-50](https://issues.apache.org/jira/browse/MWRAPPER-50?redirect=false)** and commented

Hi,

Sorry if I just cannot find it

but it seems the checksum is not checked of the `maven-wrapper.jar` downloaded here:

https://github.com/apache/maven-wrapper/blob/efba2bde13feeabfb42e9dc120e8a35c127baf0d/maven-wrapper-distribution/src/resources/mvnw#L207

Checksum of the downloaded file should be checked before executing it to avoid a remote code execution attack on the developer machine.

---

**Affects:** 3.1.0

**Issue Links:**
- [MWRAPPER-79](https://issues.apache.org/jira/browse/MWRAPPER-79) Automatically add sha256 to maven-wrapper.properties

- [MWRAPPER-75](https://issues.apache.org/jira/browse/MWRAPPER-75) Allow for sha256 checksum verification of downloaded artifacts.

1 votes, 6 watchers