SHA-256 validation fails when unzip is unavailable because distribution format is silently changed to .tar.gz

[rhusar]

When unzip is not installed, mvnw silently rewrites the distributionUrl from .zip to .tar.gz

if ! command -v unzip >/dev/null; then
  distributionUrl="${distributionUrl%.zip}.tar.gz"
  distributionUrlName="${distributionUrl##*/}"
fi

(from # Apache Maven Wrapper startup batch script, version 3.3.4)

However, the distributionSha256Sum validation on still runs against the configured checksum, which was computed for the .zip file. The .tar.gz has a different checksum, so validation always fails with:

Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised.
If you updated your Maven version, you need to update the specified distributionSha256Sum property.

This appears to be to be a design issue – the distibution is either zip or tar.gz but there is only ever a single distributionSha256Sum property. What is the reasong for this design? There inevitably need to be a sha sum configured for each downloadable distribution.

Steps to reproduce

1. Configure maven-wrapper.properties with distributionSha256Sum for the .zip distribution
2. Run ./mvnw in an environment without unzip (e.g. eclipse-temurin Docker image)
3. Build fails with SHA-256 validation error

Expected behavior

Described above.

Environment

• Maven Wrapper 3.3.4
• eclipse-temurin:25 Docker image (Ubuntu 26.04, no unzip, no wget/curl)

Workaround

Install unzip in the environment before running mvnw, e.g. in Containerfile

# Install unzip required by Maven Wrapper to download the .zip distribution;
# without it, mvnw downloads .tar.gz which doesn't match distributionSha256Sum
RUN apt-get update && apt-get install -y unzip

[simono]

Thanks for the clear write-up, @rhusar — this made the root cause easy to pin down.

I've opened #435 with a fix. Rather than silently downloading the .tar.gz and validating it against the .zip's checksum, only-mvnw now fails fast when unzip is missing and a distributionSha256Sum is pinned, with an actionable message (install unzip, or drop the checksum to allow the .tar.gz fallback). The fallback is unchanged when no checksum is pinned.

If you have a moment, a review on the PR would be very welcome — you know the reproduction best.