mirror of
https://github.com/actions/setup-java.git
synced 2026-06-29 18:40:33 +03:00
feat: Add verify-signature plumbing and Temurin+Microsoft verification support (#1060)
* Add verify-signature plumbing and Temurin verification support * Rebuild dist after signature verification changes * Refine signature verification errors and regenerate dist * refactor: make gpg.ts generic, move Adoptium-specific constant to temurin distribution * fix: mock renameWinArchive in temurin tests and add signature e2e job * refactor: bundle Adoptium public key, replace keyserver lookup with local import * feat: add verify-signature-public-key input to allow custom GPG key override * refactor: extract Adoptium public key to adoptium-key.ts; tighten gpg.ts cleanup scope * Add verify-signature plumbing and Temurin verification support * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Add Microsoft signature verification support * Regenerate dist bundles for Microsoft signature checks * Harden Microsoft signature URL handling * Add setup-java-microsoft-signature-verification e2e job * chore: regenerate dist files * Fix e2e-versions: remove duplicate job, update signature jobs to checkout@v7 with env vars * Fix Prettier formatting in test files * fix: mock renameWinArchive in microsoft-installer tests to fix Windows CI failure * fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert Windows-style paths in environment variables like GNUPGHOME. This caused GPG to fail with exit code 2 when verifying Microsoft JDK signatures on Windows, because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid POSIX path. Fix: pass --homedir as an explicit command-line argument to both gpg --import and gpg --verify. MSYS2 does correctly convert Windows paths in command-line arguments, so this approach works reliably on Windows, Linux, and macOS. * fix: convert Windows paths to POSIX format for MSYS2 GPG on Windows The Git-bundled GPG on Windows (C:\Program Files\Git\usr\bin\gpg.exe) is an MSYS2-based binary that uses POSIX path conventions internally. When Windows-style paths with backslashes and drive letters (D:\a\_temp\...) are passed as arguments, GPG may fail to resolve them correctly, resulting in a fatal error (exit code 2). Fix: add a toGpgPath() helper that converts Windows paths to MSYS2 POSIX format (/d/a/_temp/...) before passing them to any gpg command. On Linux and macOS the helper is a no-op. Applied to all four paths used in verifyPackageSignature: - gpgHome (--homedir argument) - publicKeyFile (--import argument) - signaturePath (--verify signature argument) - archivePath (--verify data argument) * Fix gpg test formatting --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
This commit is contained in:
John
GitHub
Vendored
+201
-7
@@ -78000,7 +78000,7 @@ function isProbablyGradleDaemonProblem(packageManager, error) {
|
||||
"use strict";
|
||||
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
|
||||
exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = exports.INPUT_VERIFY_SIGNATURE = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
|
||||
exports.MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
|
||||
exports.INPUT_JAVA_VERSION = 'java-version';
|
||||
exports.INPUT_JAVA_VERSION_FILE = 'java-version-file';
|
||||
@@ -78009,6 +78009,8 @@ exports.INPUT_JAVA_PACKAGE = 'java-package';
|
||||
exports.INPUT_DISTRIBUTION = 'distribution';
|
||||
exports.INPUT_JDK_FILE = 'jdkFile';
|
||||
exports.INPUT_CHECK_LATEST = 'check-latest';
|
||||
exports.INPUT_VERIFY_SIGNATURE = 'verify-signature';
|
||||
exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
|
||||
exports.INPUT_SERVER_ID = 'server-id';
|
||||
exports.INPUT_SERVER_USERNAME = 'server-username';
|
||||
exports.INPUT_SERVER_PASSWORD = 'server-password';
|
||||
@@ -78308,6 +78310,7 @@ const constants_1 = __nccwpck_require__(27242);
|
||||
const os_1 = __importDefault(__nccwpck_require__(70857));
|
||||
class JavaBase {
|
||||
constructor(distribution, installerOptions) {
|
||||
var _a;
|
||||
this.distribution = distribution;
|
||||
this.http = new httpm.HttpClient('actions/setup-java', undefined, {
|
||||
allowRetries: true,
|
||||
@@ -78317,10 +78320,15 @@ class JavaBase {
|
||||
this.architecture = installerOptions.architecture || os_1.default.arch();
|
||||
this.packageType = installerOptions.packageType;
|
||||
this.checkLatest = installerOptions.checkLatest;
|
||||
this.verifySignature = (_a = installerOptions.verifySignature) !== null && _a !== void 0 ? _a : false;
|
||||
this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
|
||||
}
|
||||
setupJava() {
|
||||
var _a, _b;
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
if (this.verifySignature && !this.supportsSignatureVerification()) {
|
||||
throw new Error(`Input 'verify-signature' is not supported for distribution '${this.distribution}'.`);
|
||||
}
|
||||
let foundJava = this.findInToolcache();
|
||||
if (foundJava && !this.checkLatest) {
|
||||
core.info(`Resolved Java ${foundJava.version} from tool-cache`);
|
||||
@@ -78440,6 +78448,9 @@ class JavaBase {
|
||||
get toolcacheFolderName() {
|
||||
return `Java_${this.distribution}_${this.packageType}`;
|
||||
}
|
||||
supportsSignatureVerification() {
|
||||
return false;
|
||||
}
|
||||
getToolcacheVersionName(version) {
|
||||
if (!this.stable) {
|
||||
if (version.includes('+')) {
|
||||
@@ -79912,21 +79923,38 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
||||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.MicrosoftDistributions = void 0;
|
||||
exports.MicrosoftDistributions = exports.MICROSOFT_PUBLIC_KEY = void 0;
|
||||
const base_installer_1 = __nccwpck_require__(79935);
|
||||
const util_1 = __nccwpck_require__(54527);
|
||||
const gpg = __importStar(__nccwpck_require__(88343));
|
||||
const microsoft_key_1 = __nccwpck_require__(56286);
|
||||
const core = __importStar(__nccwpck_require__(37484));
|
||||
const tc = __importStar(__nccwpck_require__(33472));
|
||||
const fs_1 = __importDefault(__nccwpck_require__(79896));
|
||||
const path_1 = __importDefault(__nccwpck_require__(16928));
|
||||
var microsoft_key_2 = __nccwpck_require__(56286);
|
||||
Object.defineProperty(exports, "MICROSOFT_PUBLIC_KEY", ({ enumerable: true, get: function () { return microsoft_key_2.MICROSOFT_PUBLIC_KEY; } }));
|
||||
class MicrosoftDistributions extends base_installer_1.JavaBase {
|
||||
constructor(installerOptions) {
|
||||
super('Microsoft', installerOptions);
|
||||
}
|
||||
downloadTool(javaRelease) {
|
||||
var _a;
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
core.info(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
|
||||
let javaArchivePath = yield tc.downloadTool(javaRelease.url);
|
||||
if (this.verifySignature) {
|
||||
if (!javaRelease.signatureUrl) {
|
||||
throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`);
|
||||
}
|
||||
core.info(`Verifying Java package signature...`);
|
||||
try {
|
||||
yield gpg.verifyPackageSignature(javaArchivePath, javaRelease.signatureUrl, (_a = this.verifySignaturePublicKey) !== null && _a !== void 0 ? _a : microsoft_key_1.MICROSOFT_PUBLIC_KEY);
|
||||
}
|
||||
catch (error) {
|
||||
throw new Error(`Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${error.message}`);
|
||||
}
|
||||
}
|
||||
core.info(`Extracting Java archive...`);
|
||||
const extension = (0, util_1.getDownloadArchiveExtension)();
|
||||
if (process.platform === 'win32') {
|
||||
@@ -79940,6 +79968,7 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
|
||||
});
|
||||
}
|
||||
findPackageForDownload(range) {
|
||||
var _a;
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
const arch = this.distributionArchitecture();
|
||||
if (arch !== 'x64' && arch !== 'aarch64') {
|
||||
@@ -79960,12 +79989,18 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
|
||||
const availableVersionStrings = manifest.map(item => item.version);
|
||||
throw this.createVersionNotFoundError(range, availableVersionStrings);
|
||||
}
|
||||
const file = foundRelease.files[0];
|
||||
const signatureUrl = (_a = file.signature_url) !== null && _a !== void 0 ? _a : `${file.download_url}.sig`;
|
||||
return {
|
||||
url: foundRelease.files[0].download_url,
|
||||
url: file.download_url,
|
||||
signatureUrl,
|
||||
version: foundRelease.version
|
||||
};
|
||||
});
|
||||
}
|
||||
supportsSignatureVerification() {
|
||||
return true;
|
||||
}
|
||||
getAvailableVersions() {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
// TODO get these dynamically!
|
||||
@@ -80008,6 +80043,38 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
|
||||
exports.MicrosoftDistributions = MicrosoftDistributions;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 56286:
|
||||
/***/ ((__unused_webpack_module, exports) => {
|
||||
|
||||
"use strict";
|
||||
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.MICROSOFT_PUBLIC_KEY = void 0;
|
||||
// Microsoft Build of OpenJDK GPG signing key
|
||||
// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
|
||||
exports.MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
Version: BSN Pgp v1.1.0.0
|
||||
|
||||
mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
|
||||
RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
|
||||
UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
|
||||
/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
|
||||
r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
|
||||
fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
|
||||
IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
|
||||
CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
|
||||
icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
|
||||
MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
|
||||
EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
|
||||
yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
|
||||
JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
|
||||
Fa133tP85xzJEq1XeXm8WeLFo2wV
|
||||
=rHCS
|
||||
-----END PGP PUBLIC KEY BLOCK-----`;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 11182:
|
||||
@@ -80558,6 +80625,50 @@ class SemeruDistribution extends base_installer_1.JavaBase {
|
||||
exports.SemeruDistribution = SemeruDistribution;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 80877:
|
||||
/***/ ((__unused_webpack_module, exports) => {
|
||||
|
||||
"use strict";
|
||||
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.ADOPTIUM_PUBLIC_KEY = void 0;
|
||||
// Adoptium GPG signing key (fingerprint: 3B04D753C9050D9A5D343F39843C48A565F8F04B)
|
||||
// Retrieved from: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3B04D753C9050D9A5D343F39843C48A565F8F04B
|
||||
exports.ADOPTIUM_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
xsBNBGGTvTQBCAC6ey144n7CG8foafF6mwgIBN1fIm1ILZDuGS4tMr0/XI8pgJnT
|
||||
QvsPxZWEvtSm7bEMObzEoZJcXwjBcJl1B0ui8k5kHMTI75gCmZPsoKLFWIEpuRBQ
|
||||
PBocusw80apDmLnNDQLVQvDFtEua5gaNa/fRw9YsmBoXBqvgrjFUIdGyWoQvH5+a
|
||||
9OYlWD9n5VV0gnVMb+aclwVzB/zJw3kHGSgzuMtlAHeQiah7Y8yomQn/UIX8yqDf
|
||||
+11sP3+c87YcjkRqImRTtmKEDcEtGPAIXC6SYA+uEEkbYE0Fy0chkvtnVWJ597fa
|
||||
Epai4rnICU8zoJ6X5z3v1aM2WerhX9oq9X8PABEBAAHNQEFkb3B0aXVtIEdQRyBL
|
||||
ZXkgKERFQi9SUE0gU2lnbmluZyBLZXkpIDx0ZW11cmluLWRldkBlY2xpcHNlLm9y
|
||||
Zz7CwJIEEwEIADwWIQQ7BNdTyQUNml00PzmEPEilZfjwSwUCYZO9NAIbAwULCQgH
|
||||
AgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQhDxIpWX48Et4AggAjjJzYWuKV3nG
|
||||
7ngInngl8G/m9JoHr7BmwgcQXYhdy5hVkMcUx5JLeXz2LMBUH/F2nD595hgjMabk
|
||||
kVib20X8lq9RsNbdfc2hBcWU6qyHKxsIqT4boI2/XDyEzzMyyZWWNGo/27Ci7Xmj
|
||||
pWu31nh0pDdPqdyWDIKojbVVnxlCRY8as8Sm+1ufi709KCi4MuwHNsUlCSwb/fju
|
||||
NKeHkrHbLcHKUUIEcmTSKRWrpMYBzm1HYOGBz4xPuELwUfUp71ehfoyBZlp6RDRf
|
||||
l5TYI1FmCyHuvjNhrJgWv7bOTcf8yObGY+TEUhzc4xQqCrF4ur9d3opvsuPBQsv+
|
||||
Klqi5KSZgs7ATQRhk700AQgAq14okly8cFrpYVenEQPiB75AUZfKRpMduiR6IxAj
|
||||
SKcH7aSoFZ9AubUEBVpZsyT5svxoEPe1i4TdbF+m9FGy42EcOlLa3ArLTj5H8FRl
|
||||
UdGZB9I5mk4GptOzPM+aHMMu92vW/ZwjuS8DvOiQSp+cUmG1EqOMJSM7e/4BM71z
|
||||
E+OKaVJCj79pEzhG3SK/IC/OlxxyETT66NSfYJd7Sw5R6Vr19am/uNU690W0CJ+q
|
||||
VQeFpmDMr7LnfdFRIh+lJe05+PvWXeidkGjox5cbG52wf8aRIR/FgkfcFvqRMN1f
|
||||
B+dVOWueloUeVAnzcUznOKmUEs7LP9ObJhYHHgup4IAU2wARAQABwsB2BBgBCAAg
|
||||
FiEEOwTXU8kFDZpdND85hDxIpWX48EsFAmGTvTQCGwwACgkQhDxIpWX48EvXHQf/
|
||||
Q0nZsGDXnZHiBoojeSdpkO7WBjMIP3w1GdLvRpPQrS8TfOPbZuoevzCNh38Y3gwF
|
||||
yelJspvzDQrBXhgkzAGlucYg8Y7KHa5Ebm7iDgMzc37L1hYSZTYCqwd7aowfgy34
|
||||
hOk3B67LffkJpIh738Oa9CtlwxQ9xcytmBmQ1fBBOwm/9IhAwHPQuydYIs4DxWbj
|
||||
0MGSP4fDntU7e4UjsHNmhudDcYol0FaqdHHIIB9C/G4CzetRwHFOn3b4JwXMU7YU
|
||||
6aJA3mXhi3hggMC3wkT2HHZ/TquuOdNc02fypWOCDOHz0alBBJNqoVUNFNqU3tfJ
|
||||
wI4qF/KKq9BfyfucAs0ykA==
|
||||
=XLag
|
||||
-----END PGP PUBLIC KEY BLOCK-----`;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
/***/ 91986:
|
||||
@@ -80601,14 +80712,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
||||
return (mod && mod.__esModule) ? mod : { "default": mod };
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.TemurinDistribution = exports.TemurinImplementation = void 0;
|
||||
exports.TemurinDistribution = exports.TemurinImplementation = exports.ADOPTIUM_PUBLIC_KEY = void 0;
|
||||
const core = __importStar(__nccwpck_require__(37484));
|
||||
const tc = __importStar(__nccwpck_require__(33472));
|
||||
const fs_1 = __importDefault(__nccwpck_require__(79896));
|
||||
const path_1 = __importDefault(__nccwpck_require__(16928));
|
||||
const semver_1 = __importDefault(__nccwpck_require__(62088));
|
||||
const gpg = __importStar(__nccwpck_require__(88343));
|
||||
const adoptium_key_1 = __nccwpck_require__(80877);
|
||||
const base_installer_1 = __nccwpck_require__(79935);
|
||||
const util_1 = __nccwpck_require__(54527);
|
||||
var adoptium_key_2 = __nccwpck_require__(80877);
|
||||
Object.defineProperty(exports, "ADOPTIUM_PUBLIC_KEY", ({ enumerable: true, get: function () { return adoptium_key_2.ADOPTIUM_PUBLIC_KEY; } }));
|
||||
var TemurinImplementation;
|
||||
(function (TemurinImplementation) {
|
||||
TemurinImplementation["Hotspot"] = "Hotspot";
|
||||
@@ -80633,7 +80748,8 @@ class TemurinDistribution extends base_installer_1.JavaBase {
|
||||
: item.version_data.semver.replace('-beta+', '+');
|
||||
return {
|
||||
version: formattedVersion,
|
||||
url: item.binaries[0].package.link
|
||||
url: item.binaries[0].package.link,
|
||||
signatureUrl: item.binaries[0].package.signature_link
|
||||
};
|
||||
});
|
||||
const satisfiedVersions = availableVersionsWithBinaries
|
||||
@@ -80650,9 +80766,22 @@ class TemurinDistribution extends base_installer_1.JavaBase {
|
||||
});
|
||||
}
|
||||
downloadTool(javaRelease) {
|
||||
var _a;
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
core.info(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
|
||||
let javaArchivePath = yield tc.downloadTool(javaRelease.url);
|
||||
if (this.verifySignature) {
|
||||
if (!javaRelease.signatureUrl) {
|
||||
throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Temurin version ${javaRelease.version}.`);
|
||||
}
|
||||
core.info(`Verifying Java package signature...`);
|
||||
try {
|
||||
yield gpg.verifyPackageSignature(javaArchivePath, javaRelease.signatureUrl, (_a = this.verifySignaturePublicKey) !== null && _a !== void 0 ? _a : adoptium_key_1.ADOPTIUM_PUBLIC_KEY);
|
||||
}
|
||||
catch (error) {
|
||||
throw new Error(`Failed to verify signature for Temurin version ${javaRelease.version} from ${javaRelease.signatureUrl}: ${error.message}`);
|
||||
}
|
||||
}
|
||||
core.info(`Extracting Java archive...`);
|
||||
const extension = (0, util_1.getDownloadArchiveExtension)();
|
||||
if (process.platform === 'win32') {
|
||||
@@ -80669,6 +80798,9 @@ class TemurinDistribution extends base_installer_1.JavaBase {
|
||||
get toolcacheFolderName() {
|
||||
return super.toolcacheFolderName;
|
||||
}
|
||||
supportsSignatureVerification() {
|
||||
return true;
|
||||
}
|
||||
getAvailableVersions() {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
const platform = this.getPlatformOption();
|
||||
@@ -80961,14 +81093,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
||||
});
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.deleteKey = exports.importKey = exports.PRIVATE_KEY_FILE = void 0;
|
||||
exports.verifyPackageSignature = exports.deleteKey = exports.importKey = exports.toGpgPath = exports.PRIVATE_KEY_FILE = void 0;
|
||||
const fs = __importStar(__nccwpck_require__(79896));
|
||||
const path = __importStar(__nccwpck_require__(16928));
|
||||
const io = __importStar(__nccwpck_require__(94994));
|
||||
const exec = __importStar(__nccwpck_require__(95236));
|
||||
const tc = __importStar(__nccwpck_require__(33472));
|
||||
const util = __importStar(__nccwpck_require__(54527));
|
||||
exports.PRIVATE_KEY_FILE = path.join(util.getTempDir(), 'private-key.asc');
|
||||
const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
// internally. Passing Windows paths with backslashes can cause fatal GPG errors
|
||||
// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
|
||||
function toGpgPath(p) {
|
||||
if (process.platform !== 'win32')
|
||||
return p;
|
||||
return p
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
exports.toGpgPath = toGpgPath;
|
||||
function importKey(privateKey) {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
fs.writeFileSync(exports.PRIVATE_KEY_FILE, privateKey, {
|
||||
@@ -81005,6 +81150,49 @@ function deleteKey(keyFingerprint) {
|
||||
});
|
||||
}
|
||||
exports.deleteKey = deleteKey;
|
||||
function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
const signaturePath = yield tc.downloadTool(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
yield io.rmRF(signaturePath);
|
||||
}
|
||||
catch (_a) {
|
||||
// ignore cleanup failures
|
||||
}
|
||||
throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
|
||||
}
|
||||
try {
|
||||
const publicKeyFile = path.join(gpgHome, 'public-key.asc');
|
||||
fs.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
|
||||
const options = { silent: true };
|
||||
yield exec.exec('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(publicKeyFile)
|
||||
], options);
|
||||
yield exec.exec('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--verify',
|
||||
toGpgPath(signaturePath),
|
||||
toGpgPath(archivePath)
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
yield io.rmRF(signaturePath);
|
||||
yield io.rmRF(gpgHome);
|
||||
}
|
||||
});
|
||||
}
|
||||
exports.verifyPackageSignature = verifyPackageSignature;
|
||||
|
||||
|
||||
/***/ }),
|
||||
@@ -81073,6 +81261,8 @@ function run() {
|
||||
const cache = core.getInput(constants.INPUT_CACHE);
|
||||
const cacheDependencyPath = core.getInput(constants.INPUT_CACHE_DEPENDENCY_PATH);
|
||||
const checkLatest = (0, util_1.getBooleanInput)(constants.INPUT_CHECK_LATEST, false);
|
||||
const verifySignature = (0, util_1.getBooleanInput)(constants.INPUT_VERIFY_SIGNATURE, false);
|
||||
const verifySignaturePublicKey = core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
|
||||
let toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
|
||||
core.startGroup('Installed distributions');
|
||||
if (versions.length !== toolchainIds.length) {
|
||||
@@ -81085,6 +81275,8 @@ function run() {
|
||||
architecture,
|
||||
packageType,
|
||||
checkLatest,
|
||||
verifySignature,
|
||||
verifySignaturePublicKey,
|
||||
distributionName,
|
||||
jdkFile,
|
||||
toolchainIds
|
||||
@@ -81118,11 +81310,13 @@ function run() {
|
||||
run();
|
||||
function installVersion(version, options, toolchainId = 0) {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
const { distributionName, jdkFile, architecture, packageType, checkLatest, toolchainIds } = options;
|
||||
const { distributionName, jdkFile, architecture, packageType, checkLatest, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
|
||||
const installerOptions = {
|
||||
architecture,
|
||||
packageType,
|
||||
checkLatest,
|
||||
verifySignature,
|
||||
verifySignaturePublicKey,
|
||||
version
|
||||
};
|
||||
const distribution = (0, distribution_factory_1.getJavaDistribution)(distributionName, installerOptions, jdkFile);
|
||||
|
||||
Reference in New Issue
Block a user