Fail fast when unzip is missing but a distribution checksum is pinned (#425)

[simono]

What / Why

Fixes #425.

On systems without unzip (e.g. minimal images such as eclipse-temurin), the only-script mvnw silently rewrites the distributionUrl from -bin.zip to -bin.tar.gz. But distributionSha256Sum in maven-wrapper.properties is computed for the .zip — the wrapper plugin only ever writes the zip's checksum. The script then validates the downloaded .tar.gz against the .zip's checksum, which always fails with:

Error: Failed to validate Maven distribution SHA-256, your Maven distribution might be compromised.

This is confusing to debug: the archive is genuine, and nothing is compromised — the checksum simply belongs to a different artifact than the one downloaded. There is no second property to hold the tar's checksum, so the fallback and checksum pinning are fundamentally incompatible.

How

When unzip is unavailable and a distributionSha256Sum is pinned, refuse up front with an actionable message instead of downloading the .tar.gz and failing validation against the wrong checksum:

Cannot validate the pinned distributionSha256Sum: it is computed for the .zip
distribution, but 'unzip' is not available so mvnw would fall back to the .tar.gz.
Install 'unzip', or remove 'distributionSha256Sum' from
.mvn/wrapper/maven-wrapper.properties to allow the .tar.gz fallback.

The .tar.gz fallback is unchanged for the common case where no checksum is pinned. This never validates the wrong artifact and never skips validation, so it does not weaken the integrity guarantee — it fails safe, earlier and more clearly.

Only the POSIX only-mvnw is affected; only-mvnw.cmd handles .zip only and has no such fallback.

---

Following this checklist to help us incorporate your contribution quickly and easily:

• Your pull request should address just one issue, without pulling in other changes.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible but is a best-practice.
  • The bug only manifests when unzip is absent, which the existing JUnit + Invoker IT harness cannot easily simulate; I kept this PR to the minimal fix. Happy to add a test if maintainers prefer a particular approach.
• Run mvn verify to make sure basic checks pass.
• You have run the integration tests successfully (mvn -Prun-its verify).
• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004.

🤖 Generated with Claude Code