google / guava

It is possible to specify the expected checksums for the Maven wrapper and the Maven distribution using wrapperSha256Sum and distributionSha256Sum in the maven-wrapper.properties file, see https://maven.apache.org/wrapper/index.html#checksum-verification-of-downloaded-binaries.

Do you think it would make sense to specify these checksums for Guava? This could cause issues though if the user does not have the needed packages installed locally, see for example:

guava/mvnw

Lines 271 to 272 in 050f89f

    
           echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available." 
        
           echo "Please install either command, or disable validation by removing 'wrapperSha256Sum' from your maven-wrapper.properties."

(As side note, if the files had already been downloaded before, their checksums are apparently not checked anymore, see MWRAPPER-93)

Thanks. I'd say that it's probably worth doing. In the worst case, users can use plain old mvn directly. (Now is probably the best time to do it, even, since users are unlikely to have come to rely on mvnw yet.)

Do you want to send a PR, or should I take care of it?

Have created #6807

	echo "Checksum validation was requested but neither 'sha256sum' or 'shasum' are available."
	echo "Please install either command, or disable validation by removing 'wrapperSha256Sum' from your maven-wrapper.properties."

Add checksums for Maven wrapper