[MWRAPPER-97] sha256 checksum is not well supported for distributionType=only-script

**[James Z.M. Gao](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=gzm55)** opened **[MWRAPPER-97](https://issues.apache.org/jira/browse/MWRAPPER-97?redirect=false)** and commented

The entry scripts for distributionType=only-script may change the base name of the distribution url, then the fixed sha256 checksum in maven-wrapper.properties becomes invalid. These cases are:

 
* maven, type .zip: verify OK
* maven, type .tar.gz: verify FAIL
* mvnd: always FAIL, since the url is dynamic decided based on OS and ARCH, the extension may also fallback to .tar.gz

To fix the issue, we need store all possible checksums in the config file, and better to have an easy and secure way to generate these checksums from the distribution url or from the apache site.

---

**Affects:** 3.2.0

1 votes, 4 watchers

Inspect the entry scripts and maven-wrapper.properties, then compare checksum verification for Maven .zip, Maven .tar.gz, and mvnd URLs across OS and ARCH combinations. Done means the configuration supports every possible distribution checksum and provides a secure way to generate them from the distribution URL or Apache site.

Written by the indexing model from the issue text.