apache / apache/maven-wrapper

mvnw silently continues when no download mechanism is available (missing final else)

Open
#441 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
254
Forks
78
Avg merge
5h 26m
Merged PRs (30d)
2

Description

## Description

In the `mvnw` script generated by maven-wrapper 3.3.4 (`distributionType=only-script`), the download dispatch is a three-branch chain with no final `else`:

```sh
if [ -z "${MVNW_USERNAME-}" ] && command -v wget >/dev/null; then
wget ... || die "wget: Failed to fetch $distributionUrl"
elif [ -z "${MVNW_USERNAME-}" ] && command -v curl >/dev/null; then
curl ... || die "curl: Failed to fetch $distributionUrl"
elif set_java_home; then
# compile and run Downloader.java
fi
```

If all three conditions are false — no `wget`, no `curl`, and `set_java_home` fails (no `JAVA_HOME`, no `java`/`javac` on `PATH`) — the block is a no-op. Execution continues, the SHA-256 validation block is skipped when `distributionSha256Sum` is unset, and the script then attempts to unzip/untar a file that was never downloaded.

The user sees an `unzip`/`tar` failure about a missing or corrupt archive rather than the actual cause, which is that no download mechanism was available.

## Steps to reproduce

Run `./mvnw -v` on a machine where `wget` and `curl` are absent from `PATH`, `JAVA_HOME` is unset, and neither `java` nor `javac` is on `PATH`, with no distribution yet cached under `${MAVEN_USER_HOME}/wrapper/dists`.

## Suggested fix

Add a final `else` that fails with a clear message, and/or assert the archive exists before extraction:

```sh
else
die "No download mechanism available: install wget or curl, or make a JDK available on PATH / via JAVA_HOME"
fi

[ -f "$TMP_DOWNLOAD_DIR/$distributionUrlName" ] || die "Distribution was not downloaded: $distributionUrl"
```

## Related question

The `wget` and `curl` branches are both gated on `[ -z "${MVNW_USERNAME-}" ]`, so when `MVNW_USERNAME` is set they are skipped even if available, and the script always falls through to the Java downloader. Earlier jar-based wrapper scripts passed credentials directly (`wget --http-user=… --http-password=…`, `curl --user …`). If that is deliberate — because `Downloader.java` centralises auth via `java.net.Authenticator` — it may be worth a comment, since it means a machine with `curl` but no JDK cannot perform an authenticated download.

## Environment

maven-wrapper 3.3.4, `distributionType=only-script`, Maven 3.9.16.

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate the maven-wrapper 3.3.4 only-script template that emits mvnw and inspect the download dispatch around wget, curl, and set_java_home. Reproduce ./mvnw -v without those mechanisms, then verify the script reports the missing downloader before extraction instead of reaching unzip or tar.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, shell
Domain
build-system, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.