[Supply chain] Bind Maven Wrapper distribution to reviewed SHA-256

[seonghobae]

Buyer / supply-chain gap

Protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4 currently uses Maven Wrapper 3.3.4 in only-script mode and downloads Maven 3.9.11 from the fixed HTTPS Maven Central URL, but .mvn/wrapper/maven-wrapper.properties contains no distributionSha256Sum. A clean build can therefore trust whatever bytes are returned for the configured distribution URL without repository-bound integrity verification.

This is distinct from closed #50, which added/restored Maven Wrapper availability for RHDA, and from current container/OpenCode pinning work. No open PR was found for distributionSha256Sum or maven-wrapper.properties; the old chore/issue-50-maven-wrapper branch is 58 commits behind current protected develop and zero commits ahead.

RCA

• Immediate cause: distributionUrl is configured but its matching distributionSha256Sum is absent.
• Technical root cause: wrapper bootstrap availability was established without making the downloaded Maven distribution checksum part of the repository build-input contract.
• Systemic control gap: there is no deterministic repository test requiring an exact reviewed distribution URL/checksum pair, so a future wrapper regeneration or Maven bump could silently omit the integrity property again.
• Impact: build bootstrap is a pre-compilation supply-chain boundary; corrupted or substituted Maven distribution bytes could execute before project tests, SBOM, or application security controls provide useful assurance.

Apache Maven Wrapper documents distributionSha256Sum specifically for verification of the downloaded Maven distribution and describes checksum verification as protection against supply-chain attacks. Apache Hadoop and Apache Amoro both record the Maven 3.9.11 ZIP SHA-256 for this exact Maven Central URL as:

0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb

Primary references:

• https://maven.apache.org/tools/wrapper/#checksum-verification-of-downloaded-binaries
• https://www.mail-archive.com/common-commits@hadoop.apache.org/msg97843.html
• https://www.mail-archive.com/commits@amoro.apache.org/msg06262.html

Distinct remedies / feasibility

1. Preferred — exact URL/checksum pair in wrapper properties plus a repository contract test. execute_now. Add a fail-first test that requires the current fixed Maven 3.9.11 URL to be paired with the reviewed lowercase SHA-256, then add distributionSha256Sum only after valid RED proof. No secret, external service, dependency update, database migration, or cross-repository mutation is required.
2. Checksum-only property without a regression test. Feasible but rejected as incomplete because wrapper regeneration can remove the property later without failing CI.
3. PGP/signature verification implemented by custom bootstrap code. Technically possible but materially larger and less portable than the Maven Wrapper's maintained checksum facility; reconsider only if repository policy later requires signature verification in addition to checksum binding.
4. Rely on HTTPS/Maven Central alone. Rejected because transport authenticity does not make the downloaded artifact bytes an immutable repository-reviewed build input.
5. Switch wrapper distribution type or Maven version as part of the same change. Rejected for this bounded repair; it expands blast radius without addressing a cause that requires such migration.

TDD acceptance

1. On an exact protected-base descendant, add only a fail-first deterministic test that reads .mvn/wrapper/maven-wrapper.properties and requires the reviewed Maven 3.9.11 distributionUrl / distributionSha256Sum pair.
2. RED must fail because protected production lacks distributionSha256Sum, not because of path discovery, parsing, compilation, network, or unrelated setup failure.
3. GREEN changes only the wrapper property needed to bind the same distribution URL to SHA-256 0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb unless fresh primary evidence disproves that value.
4. Preserve Maven 3.9.11, Wrapper 3.3.4, only-script, cross-platform mvnw / mvnw.cmd, and existing build semantics.
5. The permanent test must fail if the URL changes without its reviewed checksum, the checksum is absent/malformed, or the pair no longer matches the approved build-input record.
6. Require focused/full exact-source CI, dependency/SBOM/SAST/security gates, zero valid unresolved findings, and qualifying independent non-author exact-head approval before protected integration. Synthetic-merge-only or stale-head evidence is not merge authority.

Writer / integration boundary

Keep this slice path-disjoint from active source/configuration/documentation writers. If protected develop, the wrapper-properties blob, or another writer targeting this branch/path moves before mutation, freeze this branch for the invocation and rebuild from fresh state later. Do not weaken shared coverage/scanner/review gates to merge this supply-chain repair.

[seonghobae]

Fresh traceability correction: the stale-base implementation lane has been replaced. Draft PR #266 is closed; current live implementation is Draft PR #281 from exact protected develop@106add38465937f6eb4e4accc185fd30aab4446f, branch security/maven-wrapper-checksum-106add, exact head ff937c3db1c6affb474664c63debf3bade54846b. Its live diff contains both distributionSha256Sum=0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb and MavenWrapperIntegrityTest; current exposed CI, Dependency Review, CycloneDX SBOM, SAST Semgrep, and Security Scan aggregates are terminal-success on that exact source head. This is still active_pr, not shipped truth: current PR workflows use synthetic merge execution where applicable, shared non-vacuous coverage/scanner-completeness gates remain independent, and qualifying independent non-author formal approval has not been established here. The #281 branch moved during another writer's work earlier in this invocation and remains writer-owned/frozen; no source mutation or predecessor-evidence transfer is performed from this issue-maintenance lane.