Skip to content

[MWRAPPER-103] Failed to validate Maven Wrapper SHA-256 on Windows #292

Description

@jira-importer

Jorge Solórzano opened MWRAPPER-103 and commented

When wrapperSha256Sum is set on GitHub Actions for the Windows platform, the script fails as is unable to validate the wrapper jar.

I don't currently have access to a Windows machine, but this is failing for the following GH Actions configuration:
 

Operating System: Microsoft Windows Server 2022 10.0.20348
Datacenter
Image: windows-202
Version: 20230307.2
Included Software: https://github.com/actions/runner-images/blob/win22/20230307.2/images/win/Windows2022-Readme.md
Image Release: https://github.com/actions/runner-images/releases/tag/win22%2F20230307.2  
  ./mvnw $COMMON_MAVEN_ARGS $JVM_TEST_MAVEN_ARGS install -pl 'integration-tests/devtools'
      shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
      env:
        LANG: en_US.UTF-8
        COMMON_MAVEN_ARGS: -e -B --settings .github/mvn-settings.xml --fail-at-end
        NATIVE_TEST_MAVEN_ARGS: -Dtest-containers -Dstart-containers -Dquarkus.native.native-image-xmx=5g -Dnative -Dnative.surefire.skip -Dformat.skip -Dno-descriptor-tests install -DskipDocs
        JVM_TEST_MAVEN_ARGS: -Dtest-containers -Dstart-containers -Dformat.skip -DskipDocs -Dquarkus.test.hang-detection-timeout=60
        JAVA_HOME: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\11.0.18-10\x64
        JAVA_HOME_11_X64: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\11.0.18-10\x64

    Get-FileHash : The term 'Get-FileHash' is not recognized as the name of a cmdlet, function, script file, or operable 
    program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
    At line:1 char:13
    + &{ $hash = (Get-FileHash "D:\a\quarkus\quarkus\.mvn\wrapper\maven-wra ...
    +             ~~~~~~~~~~~~    
        + CategoryInfo          : ObjectNotFound: (Get-FileHash:String) [], CommandNotFoundException
        + FullyQualifiedErrorId : CommandNotFoundException
    Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised.
    Investigate or delete D:\a\quarkus\quarkus\.mvn\wrapper\maven-wrapper.jar to attempt a clean download.
    If you updated your Maven version, you need to update the specified wrapperSha256Sum property.

Also, using when using Git Bash:
 

 ./mvnw $COMMON_MAVEN_ARGS install -Dsurefire.timeout=1200 -pl !integration-tests/gradle -pl !integration-tests/maven -pl !integration-tests/devtools -pl !docs -DskipDocs -Dformat.skip -Dincremental -Dgib.disableSelectedProjectsHandling -Dgib.untracked=false -Dgib.uncommitted=false -Dgib.referenceBranch=origin/main -Dgib.disableIfReferenceBranchMatches='origin/\d+\.\d+'

shell: C:\Program Files\Git\bin\bash.EXE --noprofile --norc -e -o pipefail {0}         env:          LANG: en_US.UTF-8          COMMON_MAVEN_ARGS: -e -B --settings .github/mvn-settings.xml --fail-at-end          NATIVE_TEST_MAVEN_ARGS: -Dtest-containers -Dstart-containers -Dquarkus.native.native-image-xmx=5g -Dnative -Dnative.surefire.skip -Dformat.skip -Dno-descriptor-tests install -DskipDocs          JVM_TEST_MAVEN_ARGS: -Dtest-containers -Dstart-containers -Dformat.skip -DskipDocs -Dquarkus.test.hang-detection-timeout=60
MAVEN_OPTS: -Xmx2g -XX:MaxMetaspaceSize=1g -Xlog:gc*=debug:file=windows-java-17.txt
JAVA_HOME: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.6-10\x64    JAVA_HOME_17_X64: C:\hostedtoolcache\windows\Java_Temurin-Hotspot_jdk\17.0.6-10\x64

Error: Failed to validate Maven wrapper SHA-256, your Maven wrapper might be compromised.        Investigate or delete /d/a/quarkus/quarkus/.mvn/wrapper/maven-wrapper.jar to attempt a clean download.     
If you updated your Maven version, you need to update the specified wrapperSha256Sum property.

 


Affects: 3.2.0

Remote Links:

Activity

  1. jira-importer commented on Oct 25, 2023

    @jira-importer
    Author

    Marcono1234 commented

    I am also experiencing this issue with Get-FileHash when running the wrapper locally on my Windows machine. The underlying issue might be PowerShell/PowerShell#18108. At least the situation seems similar: The mvnw.cmd probably launches cmd which then launches powershell, which causes this bug.

    This can for example also be seen when running the following:

    cmd /c powershell -Command { Get-FileHash "some file" -Algorithm SHA256 }
    

    (From Windows Terminal running PowerShell 7)

    With the cmd /c it fails to find Get-FileHash; without cmd, it works.

    Adding the workaround proposed in PowerShell/PowerShell#18108 (comment) right before the Get-FileHash call seems to fix the issue for the Maven Wrapper (script wrapper type). Though I am not sure how reliable this is, or if it can cause other issues.

  2. jira-importer commented on Feb 8, 2024

    @jira-importer
    Author

    Guillaume Smet commented

    We got hit by this problem in the Quarkus project as the OpenRewrite recipe updating the Maven wrapper is pushing the maven-wrapper.jar checksum to the property file which causes problem on Windows.

    Not sure exactly how this could be fixed but one workable option for now could be to turn the error into a warning if the checksum cannot be checked on Windows because Get-File-Hash is not available.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't workingpriority:majorMajor loss of function

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions