`distributionSha256Sum` property gets removed when upgrading/reinstalling
- Dominant language
- Java
- Stars
- 254
- Forks
- 78
- Avg merge
- 5h 26m
- Merged PRs (30d)
- 2
Description
### Affected version
3.3.3
### Bug description
When I upgrade/reinstall Maven Wrapper, the `distributionSha256Sum` property gets removed from `.mvn/wrapper/maven-wrapper.properties`.
To reproduce (using Maven 3.9.11 as `mvn`):
```
mkdir reproducer
cd reproducer
# Install Maven Wrapper 3.3.3
mvn wrapper:3.3.3:wrapper -Dmaven=3.9.11
# Set distributionSha256Sum to verify integrity of Maven distribution
echo "distributionSha256Sum=0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb" >> .mvn/wrapper/maven-wrapper.properties
# Install Maven Wrapper 3.3.3 again (no newer version available yet at this time)
./mvnw wrapper:3.3.3:wrapper
# This returns nothing, because distributionSha256Sum has been removed during the upgrade
grep distributionSha256Sum .mvn/wrapper/maven-wrapper.properties
```
I think the `distributionSha256Sum` should be retained when the Maven Wrapper version is changed (or the same version is reinstalled).
An open question is what should happen when the update command changes the Maven distribution (e.g. `-Dmaven=3.9.10`), because in that scenario retaining `distributionSha256Sum` with the existing value will cause Maven Wrapper to fail.
Could Maven Wrapper at least warn that the user should set `distributionSha256Sum` again for the new Maven version to not lose the integrity check protection? Or could the value even be updated automatically in a safe way? If so, it should probably also be set by default during an initial Maven Wrapper setup.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.