jira-importer

**[Michael Osipov](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=michael-o)** commented There is no consent whether this is OK from ASF's point of view because this is a change in license and the license needs to be retained...

**[Damiano Albani](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=dalbani)** commented Speaking of license file/header, does it make sense to add this header at the top of `maven-wrapper.properties` when letting Maven Wrapper generate it with `mvn wrapper:wrapper`? I...

**[Lars Bruun-Hansen](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=lbruun)** commented [Damiano Albani](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=dalbani) (OT) You are right. It doesn't make sense for that header. I've created MWRAPPER-158 to address this.

**[Michael Osipov](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=michael-o)** commented Why not use `Invoke-WebRequest` and bundled `bsdtar` on Windows to install Maven. Wrapper is a constant pain.

**[Lars Bruun-Hansen](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=lbruun)** commented [Jeremy Landis](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hazendaz): Maybe executing with `MVNW_VERBOSE=true` will give you some clue as to what is going on. Like you, I'm also using Maven Wrapper to test out...

**[Michael Osipov](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=michael-o)** commented Checksums are not designed to protect against RCEs. Too much Log4J2?

**[Marcin Zajaczkowski](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=szpak)** commented Checksums can mitigate some risk with a the wrapper downloaded from local mirror (e.g. on a public CI server) which could be tempered by a malicious party...

**[Hervé Boutemy](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=hboutemy)** commented PR welcome :)

**[Premek Vyhnal](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=premek)** commented https://github.com/apache/maven-wrapper/blob/efba2bde13feeabfb42e9dc120e8a35c127baf0d/maven-wrapper-distribution/src/resources/mvnw#L207 Here I'd change the if from (pseudo code) ```java if command wget use wget elif command curl use curl else compile and use java fi ```...

**[Marcin Zajaczkowski](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=szpak)** commented Thanks [Premek Vyhnal](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=premek)  for taking a look at that! > We can use sha256sum but sha1 is being published (to see it's the same): https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.0/maven-wrapper-3.1.0.jar.sha1 In general,...