[MNG-6887] Provide a Github Action to check the validity of the Maven Wrapper

**[Fred Bricon](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=fbricon)** opened **[MNG-6887](https://issues.apache.org/jira/browse/MNG-6887?redirect=false)** and commented

The Gradle project provides a "Gradle Wrapper Validation" [Github Action](https://github.com/marketplace/actions/gradle-wrapper-validation)

> This action validates the checksums of [Gradle Wrapper](https://docs.gradle.org/current/userguide/gradle_wrapper.html) JAR files present in the source tree and fails if unknown Gradle Wrapper JAR files are found.
>
> ...
>
> A fairly simple social engineering supply chain attack against open source would be contribute a helpful “Updated to Gradle xxx” PR that contains malicious code hidden inside this binary JAR. A malicious `gradle-wrapper.jar` could execute, download, or install arbitrary code while otherwise behaving like a completely normal `gradle-wrapper.jar`.

Since the Maven wrapper is coming to the mothership, it'd make sense for the Maven Project to provide a similar Github action, and advertise about it in the official doc, similar to [Gradle|#automatically_verifying_the_gradle_wrapper_jar_on_github].

Forking https://github.com/gradle/wrapper-validation-action to adapt it to the Maven wrapper should be fairly straightforward.

Although anybody could provide such Github action, I feel it being provided by the Maven Project itself would make it much more legitimate.

---

4 votes, 8 watchers

Start by reviewing the linked Gradle wrapper-validation-action and the Maven wrapper documentation, then compare how the Maven wrapper is distributed and verified. Done means a Maven Project GitHub Action validates wrapper JAR checksums and the official documentation advertises how to use it.

Written by the indexing model from the issue text.