Address Copilot review feedback for Kona distribution

- Sort matching releases by semver descending so range versions (e.g. >=17) resolve to the newest matching Kona JDK instead of the lowest
- Rename downloaded archive on Windows before extraction (renameWinArchive) to avoid extraction failures
- Import semver for version sorting

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.eslintignore

@@ -0,0 +1,6 @@
+# Ignore list
+/*
+
+# Do not ignore these folders:
+!__tests__/
+!src/

.eslintrc.js

@@ -0,0 +1,51 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+module.exports = {
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:eslint-plugin-jest/recommended',
+    'eslint-config-prettier'
+  ],
+  parser: '@typescript-eslint/parser',
+  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
+  rules: {
+    '@typescript-eslint/no-require-imports': 'error',
+    '@typescript-eslint/no-non-null-assertion': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-empty-function': 'off',
+    '@typescript-eslint/ban-ts-comment': [
+      'error',
+      {
+        'ts-ignore': 'allow-with-description'
+      }
+    ],
+    'no-console': 'error',
+    'yoda': 'error',
+    'prefer-const': [
+      'error',
+      {
+        destructuring: 'all'
+      }
+    ],
+    'no-control-regex': 'off',
+    'no-constant-condition': ['error', {checkLoops: false}],
+    'node/no-extraneous-import': 'error'
+  },
+  overrides: [
+    {
+      files: ['**/*{test,spec}.ts'],
+      rules: {
+        '@typescript-eslint/no-unused-vars': 'off',
+        'jest/no-standalone-expect': 'off',
+        'jest/no-conditional-expect': 'off',
+        'no-console': 'off',
+
+      }
+    }
+  ],
+  env: {
+    node: true,
+    es6: true,
+    'jest/globals': true
+  }
+};

.github/pull_request_template.md

@@ -5,5 +5,6 @@ Describe your changes.
 Add link to the related issue.
 
 **Check list:**
+- [ ] Ran `npm run check` locally (format, lint, build, test) and all checks pass.
 - [ ] Mark if documentation changes are required.
 - [ ] Mark if tests were added or updated to cover the changes.

.github/workflows/e2e-versions.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   setup-java-major-versions:
-    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -36,7 +36,8 @@ jobs:
             'corretto',
             'dragonwell',
             'sapmachine',
-            'jetbrains'
+            'jetbrains',
+            'kona'
           ] # internally 'adopt-hotspot' is the same as 'adopt'
         version: ['21', '11', '17']
         exclude:
@@ -96,7 +97,7 @@ jobs:
         shell: bash
 
   setup-java-alpine-linux:
-    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-x64) - alpine-linux - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - alpine-linux - ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     container:
       image: alpine:3.21
@@ -127,7 +128,7 @@ jobs:
         shell: bash
 
   setup-java-major-minor-versions:
-    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     needs: setup-java-major-versions
     runs-on: ${{ matrix.os }}
     strategy:
@@ -275,7 +276,7 @@ jobs:
         shell: bash
 
   setup-java-ea-versions-zulu:
-    name: zulu ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
+    name: zulu ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
     runs-on: ${{ matrix.os }}
     strategy:
@@ -302,7 +303,7 @@ jobs:
         shell: bash
 
   setup-java-ea-versions-temurin:
-    name: temurin ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
+    name: temurin ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
     runs-on: ${{ matrix.os }}
     strategy:
@@ -328,8 +329,64 @@ jobs:
         run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
         shell: bash
 
+  setup-java-temurin-signature-verification:
+    name: temurin ${{ matrix.version }} signature verification - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+        version: ['21', '17']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java with signature verification
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: temurin
+          verify-signature: true
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-microsoft-signature-verification:
+    name: microsoft ${{ matrix.version }} signature verification - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+        version: ['21', '17']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java with signature verification
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: microsoft
+          verify-signature: true
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
   setup-java-ea-versions-sapmachine:
-    name: sapmachine ${{ matrix.version }} (jdk-x64) - ${{ matrix.os }}
+    name: sapmachine ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
     runs-on: ${{ matrix.os }}
     strategy:

.github/workflows/zizmor.yml

@@ -23,12 +23,12 @@ jobs:
       security-events: write # to upload SARIF results to code scanning
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.x'
 
@@ -42,7 +42,7 @@ jobs:
 
       - name: Upload SARIF results to code scanning
         if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: zizmor.sarif
           category: zizmor

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.husky/pre-push

@@ -0,0 +1 @@
+npm run build && npm test

README.md

@@ -41,6 +41,10 @@ For more details,  see the full release notes on the [releases page](https://git
 
   - `check-latest`: Setting this option makes the action to check for the latest available version for the version spec.
 
+  - `verify-signature`: Verifies downloaded Java package signatures when supported by the selected distribution. Currently supported for `temurin` and `microsoft`. If set to `true` for unsupported distributions, the action fails.
+
+  - `verify-signature-public-key`: ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.
+
   - `cache`: Quick [setup caching](#caching-packages-dependencies) for the dependencies managed through one of the predefined package managers. It can be one of "maven", "gradle" or "sbt".
 
   - `cache-dependency-path`: The path to a dependency file: pom.xml, build.gradle, build.sbt, etc. This option can be used with the `cache` option. If this option is omitted, the action searches for the dependency file in the entire repository. This option supports wildcards and a list of file names for caching multiple dependencies.
@@ -114,6 +118,7 @@ Currently, the following distributions are supported:
 | `graalvm` | [Oracle GraalVM](https://www.graalvm.org/) | [`graalvm` license](https://www.oracle.com/downloads/licenses/graal-free-license.html)
 | `graalvm-community` | [GraalVM Community](https://github.com/graalvm/graalvm-ce-builds/releases) | [`graalvm-community` license](https://github.com/oracle/graal/blob/master/LICENSE)
 | `jetbrains` | [JetBrains Runtime](https://github.com/JetBrains/JetBrainsRuntime/) | [`jetbrains` license](https://github.com/JetBrains/JetBrainsRuntime/blob/main/LICENSE)
+| `kona` | [Tencent Kona JDK](https://tencent.github.io/konajdk/) | [`kona` license](https://tencent.github.io/konajdk/LICENSE.txt)
 | `jdkfile` | Custom JDK Installation | |
 
 > [!NOTE]
@@ -277,6 +282,7 @@ In the example above multiple JDKs are installed for the same job. The result af
   - [SapMachine](docs/advanced-usage.md#SapMachine)
   - [GraalVM](docs/advanced-usage.md#GraalVM)
   - [JetBrains](docs/advanced-usage.md#JetBrains)
+  - [Tencent Kona](docs/advanced-usage.md#Tencent-Kona)
 - [Installing custom Java package type](docs/advanced-usage.md#Installing-custom-Java-package-type)
 - [Installing custom Java architecture](docs/advanced-usage.md#Installing-custom-Java-architecture)
 - [Installing custom Java distribution from local file](docs/advanced-usage.md#Installing-Java-from-local-file)

__tests__/auth.test.ts

@@ -160,6 +160,7 @@ describe('auth tests', () => {
     const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
   <servers>
     <server>
       <id>${id}</id>
@@ -181,6 +182,7 @@ describe('auth tests', () => {
     const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
   <servers>
     <server>
       <id>${id}</id>

__tests__/data/kona.json

@@ -0,0 +1,162 @@
+{
+  "8": [
+    {
+      "version": "8.0.20",
+      "jdkVersion": "8u432",
+      "latest": true,
+      "baseUrl": "https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/",
+      "files": [
+        {
+          "os": "linux",
+          "arch": "aarch64",
+          "filename": "TencentKona8.0.20.b1_jdk_linux-aarch64_8u432.tar.gz",
+          "checksum": "8e6ab38b17f98d7ba727037cb49bbd174f3103a6ddacafb1fb7c0231006a80a7"
+        },
+        {
+          "os": "linux",
+          "arch": "x86_64",
+          "filename": "TencentKona8.0.20.b1_jdk_linux-x86_64_8u432.tar.gz",
+          "checksum": "384cdb36b38993f4b7292682a5dfd8d5d33ba7bdbca2d95018d1341c792d2823"
+        },
+        {
+          "os": "macos",
+          "arch": "aarch64",
+          "filename": "TencentKona8.0.20.b1_jdk_macosx-aarch64_8u432_notarized.tar.gz",
+          "checksum": "829c46691a4b519f14fedfcdca32a94d7793d3570c4a51b3a5072cc394619f25"
+        },
+        {
+          "os": "macos",
+          "arch": "x86_64",
+          "filename": "TencentKona8.0.20.b1_jdk_macosx-x86_64_8u432_notarized.tar.gz",
+          "checksum": ""
+        },
+        {
+          "os": "windows",
+          "arch": "x86_64",
+          "filename": "TencentKona8.0.20.b1_jdk_windows-x86_64_8u432_signed.zip",
+          "checksum": "339646817254dbcb5c17904807bbfdeafaa8e4bac9f2aae25434870cdeaba296"
+        }
+      ]
+    }
+  ],
+  "11": [
+    {
+      "version": "11.0.25",
+      "jdkVersion": "11.0.25",
+      "latest": true,
+      "baseUrl": "https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/",
+      "files": [
+        {
+          "os": "linux",
+          "arch": "aarch64",
+          "filename": "TencentKona-11.0.25.b1-jdk_linux-aarch64.tar.gz",
+          "checksum": "887ca5eeb675dd9b9d22833a8b0c1031ee1a031227d6cf2d8c1920cc585d2b71"
+        },
+        {
+          "os": "linux",
+          "arch": "x86_64",
+          "filename": "TencentKona-11.0.25.b1-jdk_linux-x86_64.tar.gz",
+          "checksum": "6642d7cccf98f33b3ec55cdbf77979c614f0d3cbbd282e8d0df52233edc52f9a"
+        },
+        {
+          "os": "macos",
+          "arch": "aarch64",
+          "filename": "TencentKona-11.0.25.b1_jdk_macosx-aarch64_notarized.tar.gz",
+          "checksum": "8f07242d3191a35c3b2fca1122f315518c7312f0155e98ac7ae39ea083f93e21"
+        },
+        {
+          "os": "macos",
+          "arch": "x86_64",
+          "filename": "TencentKona-11.0.25.b1_jdk_macosx-x86_64_notarized.tar.gz",
+          "checksum": "0832b93d8d8122cb72db85321ddd85c9a6086e0f28327733fc2da3c0ecc9c455"
+        },
+        {
+          "os": "windows",
+          "arch": "x86_64",
+          "filename": "TencentKona-11.0.25.b1_jdk_windows-x86_64_signed.zip",
+          "checksum": "05c470c5da4b3bc1844117f611ecd241d3ae9e5d01c17ffafffde0f23825aad7"
+        }
+      ]
+    }
+  ],
+  "17": [
+    {
+      "version": "17.0.13",
+      "jdkVersion": "17.0.13",
+      "latest": true,
+      "baseUrl": "https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/",
+      "files": [
+        {
+          "os": "linux",
+          "arch": "aarch64",
+          "filename": "TencentKona-17.0.13.b1-jdk_linux-aarch64.tar.gz",
+          "checksum": "372411dff5b42f6e419f1dd40772d98141a15c3d180ed1af6f2b49bdbbd32d52"
+        },
+        {
+          "os": "linux",
+          "arch": "x86_64",
+          "filename": "TencentKona-17.0.13.b1-jdk_linux-x86_64.tar.gz",
+          "checksum": "b54bb023d1187737b23ca34d0857d2d40822b14e38d28c7948c8ff6b5927e523"
+        },
+        {
+          "os": "macos",
+          "arch": "aarch64",
+          "filename": "TencentKona-17.0.13.b1_jdk_macosx-aarch64_notarized.tar.gz",
+          "checksum": "22f5d296c407fc137e6af9ce275e662346ca82f1a5acfc407247efd8cedf5256"
+        },
+        {
+          "os": "macos",
+          "arch": "x86_64",
+          "filename": "TencentKona-17.0.13.b1_jdk_macosx-x86_64_notarized.tar.gz",
+          "checksum": "87ace41ac9718f2a9512b24bad0f735bc5ac61b8198b4cd5634199f124883b36"
+        },
+        {
+          "os": "windows",
+          "arch": "x86_64",
+          "filename": "TencentKona-17.0.13.b1_jdk_windows-x86_64_signed.zip",
+          "checksum": "616089018151e8e5daf8e88276063633a2cb28a718a2afce49bb8fc10541e83d"
+        }
+      ]
+    }
+  ],
+  "21": [
+    {
+      "version": "21.0.5",
+      "jdkVersion": "21.0.5",
+      "latest": true,
+      "baseUrl": "https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/",
+      "files": [
+        {
+          "os": "linux",
+          "arch": "aarch64",
+          "filename": "TencentKona-21.0.5.b1-jdk_linux-aarch64.tar.gz",
+          "checksum": "d8ca108147db3f19134d7aa995bac14e1fb3d124b0300a9a7893266a8f028104"
+        },
+        {
+          "os": "linux",
+          "arch": "x86_64",
+          "filename": "TencentKona-21.0.5.b1-jdk_linux-x86_64.tar.gz",
+          "checksum": "afae039d9666fadcb84940c5350b29cd061019b0cc43700f0bf0342320892adf"
+        },
+        {
+          "os": "macos",
+          "arch": "aarch64",
+          "filename": "TencentKona-21.0.5.b1_jdk_macosx-aarch64_notarized.tar.gz",
+          "checksum": "7621a218767bfbd3023b176dc6d9dd019677f8efec0d48a4eb2b2ed2b50bd1fb"
+        },
+        {
+          "os": "macos",
+          "arch": "x86_64",
+          "filename": "TencentKona-21.0.5.b1_jdk_macosx-x86_64_notarized.tar.gz",
+          "checksum": "6c54d46f979ad998b708f664c5aeeeef855660ef527d584a7c2930951cca9999"
+        },
+        {
+          "os": "windows",
+          "arch": "x86_64",
+          "filename": "TencentKona-21.0.5.b1_jdk_windows-x86_64_signed.zip",
+          "checksum": "ee1ee730fc5e02268d91b9df602b65122dad25b3d3898069331ebc8338005da1"
+        }
+      ]
+    }
+  ]
+}

__tests__/data/temurin.json

@@ -15,7 +15,8 @@
           "link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_linux_hotspot_16.0.2_7.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_linux_hotspot_16.0.2_7.tar.gz.json",
           "name": "OpenJDK16U-jdk_x64_linux_hotspot_16.0.2_7.tar.gz",
-          "size": 205463525
+          "size": 205463525,
+          "signature_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_linux_hotspot_16.0.2_7.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-16.0.2+7_adopt",
@@ -44,7 +45,8 @@
           "link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_mac_hotspot_16.0.2_7.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_mac_hotspot_16.0.2_7.tar.gz.json",
           "name": "OpenJDK16U-jdk_x64_mac_hotspot_16.0.2_7.tar.gz",
-          "size": 206621395
+          "size": 206621395,
+          "signature_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_mac_hotspot_16.0.2_7.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-16.0.2+7_adopt",
@@ -73,7 +75,8 @@
           "link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_windows_hotspot_16.0.2_7.zip",
           "metadata_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_windows_hotspot_16.0.2_7.zip.json",
           "name": "OpenJDK16U-jdk_x64_windows_hotspot_16.0.2_7.zip",
-          "size": 203448494
+          "size": 203448494,
+          "signature_link": "https://github.com/adoptium/temurin16-binaries/releases/download/jdk-16.0.2%2B7/OpenJDK16U-jdk_x64_windows_hotspot_16.0.2_7.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-16.0.2+7_adopt",
@@ -113,7 +116,8 @@
           "link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u302b08.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u302b08.tar.gz.json",
           "name": "OpenJDK8U-jdk_x64_linux_hotspot_8u302b08.tar.gz",
-          "size": 102954777
+          "size": 102954777,
+          "signature_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_linux_hotspot_8u302b08.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk8u302-b08",
@@ -142,7 +146,8 @@
           "link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u302b08.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u302b08.tar.gz.json",
           "name": "OpenJDK8U-jdk_x64_mac_hotspot_8u302b08.tar.gz",
-          "size": 107303398
+          "size": 107303398,
+          "signature_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_mac_hotspot_8u302b08.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk8u302-b08",
@@ -171,7 +176,8 @@
           "link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_windows_hotspot_8u302b08.zip",
           "metadata_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_windows_hotspot_8u302b08.zip.json",
           "name": "OpenJDK8U-jdk_x64_windows_hotspot_8u302b08.zip",
-          "size": 104297671
+          "size": 104297671,
+          "signature_link": "https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u302-b08/OpenJDK8U-jdk_x64_windows_hotspot_8u302b08.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk8u302-b08",
@@ -211,7 +217,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 188909250
+          "size": 188909250,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-16-ge39bf269d60",
@@ -240,7 +247,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 192952713
+          "size": 192952713,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -260,7 +268,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 188816971
+          "size": 188816971,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-16-ge39bf269d60",
@@ -280,7 +289,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 182299353
+          "size": 182299353,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -300,7 +310,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 187674392
+          "size": 187674392,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-46-gea8d2c72e83",
@@ -320,7 +331,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 179501342
+          "size": 179501342,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-21-ge39bf269d60",
@@ -340,7 +352,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-29-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-29-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-29-23-34.tar.gz",
-          "size": 192126971
+          "size": 192126971,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-29-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -360,7 +373,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 192015878
+          "size": 192015878,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-21-ge39bf269d60",
@@ -389,7 +403,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-31-00-07.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-31-00-07.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-31-00-07.tar.gz",
-          "size": 192422068
+          "size": 192422068,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-31-00-07.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -418,7 +433,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-31-00-07.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-31-00-07.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-31-00-07.zip",
-          "size": 188694175
+          "size": 188694175,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-31-00-07.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -447,7 +463,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-31-00-07.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-31-00-07.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-31-00-07.zip",
-          "size": 184618115
+          "size": 184618115,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-31-00-07.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+33_adopt-219-ge39bf269d60",
@@ -489,7 +506,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-27-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-27-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-27-23-34.tar.gz",
-          "size": 192125161
+          "size": 192125161,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-31-00-07-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-27-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-242-gce1857dd7a1",
@@ -531,7 +549,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 188911467
+          "size": 188911467,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-42-g4596b4e9d4e",
@@ -560,7 +579,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 192950510
+          "size": 192950510,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -580,7 +600,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 188815685
+          "size": 188815685,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-36-g4596b4e9d4e",
@@ -600,7 +621,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 182307654
+          "size": 182307654,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -620,7 +642,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 187698851
+          "size": 187698851,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-36-g4596b4e9d4e",
@@ -640,7 +663,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 179501218
+          "size": 179501218,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-40-g4596b4e9d4e",
@@ -660,7 +684,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-22-23-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-22-23-30.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-22-23-30.tar.gz",
-          "size": 192124471
+          "size": 192124471,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-22-23-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -680,7 +705,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 192015026
+          "size": 192015026,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-40-g4596b4e9d4e",
@@ -709,7 +735,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-23-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-23-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-23-03-09.tar.gz",
-          "size": 193003513
+          "size": 193003513,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-23-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -738,7 +765,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-23-03-09.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-23-03-09.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-23-03-09.zip",
-          "size": 188694996
+          "size": 188694996,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-23-03-09.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -767,7 +795,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-23-03-09.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-23-03-09.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-23-03-09.zip",
-          "size": 184626937
+          "size": 184626937,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-23-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-23-03-09.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+32_adopt-217-g4596b4e9d4e",
@@ -809,7 +838,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 188891565
+          "size": 188891565,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "a342f28aaec",
@@ -829,7 +859,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 188790907
+          "size": 188790907,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "a342f28aaec",
@@ -849,7 +880,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 182276594
+          "size": 182276594,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-191-ga342f28aaec",
@@ -869,7 +901,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 187678422
+          "size": 187678422,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-26-ga342f28aaec",
@@ -889,7 +922,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 179475721
+          "size": 179475721,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-26-ga342f28aaec",
@@ -909,7 +943,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-20-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-20-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-20-23-34.tar.gz",
-          "size": 192104689
+          "size": 192104689,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-20-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-191-ga342f28aaec",
@@ -929,7 +964,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-21-03-09.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-21-03-09.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-21-03-09.tar.gz",
-          "size": 191982821
+          "size": 191982821,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-21-03-09.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "a342f28aaec",
@@ -958,7 +994,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-21-03-09.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-21-03-09.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-21-03-09.zip",
-          "size": 188685330
+          "size": 188685330,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-21-03-09.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-191-ga342f28aaec",
@@ -987,7 +1024,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-21-03-09.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-21-03-09.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-21-03-09.zip",
-          "size": 184607457
+          "size": 184607457,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-21-03-09-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-21-03-09.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-191-ga342f28aaec",
@@ -1029,7 +1067,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 188896773
+          "size": 188896773,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-14-g20418a26958",
@@ -1058,7 +1097,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 192948484
+          "size": 192948484,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-179-g20418a26958",
@@ -1078,7 +1118,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 188791964
+          "size": 188791964,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-14-g20418a26958",
@@ -1098,7 +1139,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 182281944
+          "size": 182281944,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-179-g20418a26958",
@@ -1118,7 +1160,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 187650365
+          "size": 187650365,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-23-g20418a26958",
@@ -1138,7 +1181,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 179483622
+          "size": 179483622,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-55-g20418a26958",
@@ -1158,7 +1202,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-15-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-15-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-15-23-34.tar.gz",
-          "size": 192108731
+          "size": 192108731,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-15-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-179-g20418a26958",
@@ -1178,7 +1223,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-16-10-58.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-16-10-58.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-16-10-58.tar.gz",
-          "size": 191985123
+          "size": 191985123,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-16-10-58.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-14-g20418a26958",
@@ -1207,7 +1253,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-16-10-58.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-16-10-58.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-16-10-58.zip",
-          "size": 188688539
+          "size": 188688539,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-16-10-58.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-179-g20418a26958",
@@ -1236,7 +1283,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-16-10-58.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-16-10-58.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-16-10-58.zip",
-          "size": 184612045
+          "size": 184612045,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-16-10-58-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-16-10-58.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+31_adopt-179-g20418a26958",
@@ -1278,7 +1326,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 188899456
+          "size": 188899456,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "ce22197617d",
@@ -1307,7 +1356,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 192953428
+          "size": 192953428,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-200-gce22197617d",
@@ -1327,7 +1377,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 188792852
+          "size": 188792852,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-66-gce22197617d",
@@ -1347,7 +1398,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 187678600
+          "size": 187678600,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "ce22197617d",
@@ -1367,7 +1419,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 179480996
+          "size": 179480996,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "ce22197617d",
@@ -1387,7 +1440,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-13-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-13-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-13-23-34.tar.gz",
-          "size": 192105446
+          "size": 192105446,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-13-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-200-gce22197617d",
@@ -1407,7 +1461,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 191986856
+          "size": 191986856,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "ce22197617d",
@@ -1436,7 +1491,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-14-11-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-14-11-30.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-14-11-30.tar.gz",
-          "size": 192995067
+          "size": 192995067,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-14-11-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-200-gce22197617d",
@@ -1465,7 +1521,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-14-11-30.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-14-11-30.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-14-11-30.zip",
-          "size": 188686556
+          "size": 188686556,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-14-11-30.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-200-gce22197617d",
@@ -1494,7 +1551,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-14-11-30.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-14-11-30.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-14-11-30.zip",
-          "size": 184620492
+          "size": 184620492,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-14-11-30-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-14-11-30.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-200-gce22197617d",
@@ -1536,7 +1594,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 188896299
+          "size": 188896299,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1565,7 +1624,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 192941671
+          "size": 192941671,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1585,7 +1645,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 188838708
+          "size": 188838708,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-161-g3e7e5bc2003",
@@ -1605,7 +1666,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 182274073
+          "size": 182274073,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-40-g3e7e5bc2003",
@@ -1625,7 +1687,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 187666608
+          "size": 187666608,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-40-g3e7e5bc2003",
@@ -1645,7 +1708,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 179472325
+          "size": 179472325,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-30-g3e7e5bc2003",
@@ -1665,7 +1729,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-08-23-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-08-23-35.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-08-23-35.tar.gz",
-          "size": 192098387
+          "size": 192098387,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-08-23-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1685,7 +1750,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 191983708
+          "size": 191983708,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1714,7 +1780,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-09-12-54.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-09-12-54.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-09-12-54.tar.gz",
-          "size": 193004476
+          "size": 193004476,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-09-12-54.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1743,7 +1810,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-09-12-54.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-09-12-54.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-09-12-54.zip",
-          "size": 188681640
+          "size": 188681640,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-09-12-54.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1772,7 +1840,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-09-12-54.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-09-12-54.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-09-12-54.zip",
-          "size": 184605514
+          "size": 184605514,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-09-12-54-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-09-12-54.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+30_adopt-164-g3e7e5bc2003",
@@ -1823,7 +1892,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 192962903
+          "size": 192962903,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-172-g06428c22b61",
@@ -1843,7 +1913,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 188800217
+          "size": 188800217,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "06428c22b61",
@@ -1863,7 +1934,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 187663978
+          "size": 187663978,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-78-g06428c22b61",
@@ -1883,7 +1955,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 179496669
+          "size": 179496669,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-78-g06428c22b61",
@@ -1903,7 +1976,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-06-23-34.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-06-23-34.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-06-23-34.tar.gz",
-          "size": 192113242
+          "size": 192113242,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-06-23-34.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-172-g06428c22b61",
@@ -1923,7 +1997,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 192021951
+          "size": 192021951,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-172-g06428c22b61",
@@ -1952,7 +2027,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-07-11-35.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-07-11-35.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-07-11-35.tar.gz",
-          "size": 193018554
+          "size": 193018554,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-07-11-35.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-172-g06428c22b61",
@@ -1981,7 +2057,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-07-11-35.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-07-11-35.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-07-11-35.zip",
-          "size": 188702463
+          "size": 188702463,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-07-11-35-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-07-11-35.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-172-g06428c22b61",
@@ -2023,7 +2100,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 188953178
+          "size": 188953178,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2052,7 +2130,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 192957934
+          "size": 192957934,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2072,7 +2151,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 188797466
+          "size": 188797466,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-43-g6d3debb5c12",
@@ -2092,7 +2172,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 182292580
+          "size": 182292580,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2112,7 +2193,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 187684930
+          "size": 187684930,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-64-g6d3debb5c12",
@@ -2132,7 +2214,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 179484390
+          "size": 179484390,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-54-g6d3debb5c12",
@@ -2152,7 +2235,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-01-23-30.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-01-23-30.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-01-23-30.tar.gz",
-          "size": 192114561
+          "size": 192114561,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-07-01-23-30.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2172,7 +2256,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 192014644
+          "size": 192014644,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2201,7 +2286,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-02-12-00.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-02-12-00.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-07-02-12-00.tar.gz",
-          "size": 192425033
+          "size": 192425033,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-07-02-12-00.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2230,7 +2316,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-02-12-00.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-02-12-00.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-07-02-12-00.zip",
-          "size": 188697393
+          "size": 188697393,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-07-02-12-00.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2259,7 +2346,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-02-12-00.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-02-12-00.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-02-12-00.zip",
-          "size": 184618232
+          "size": 184618232,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-07-02-12-00-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-07-02-12-00.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+29_adopt-138-g6d3debb5c12",
@@ -2301,7 +2389,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_linux_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 188940191
+          "size": 188940191,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_linux_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2330,7 +2419,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_aarch64_mac_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 192953718
+          "size": 192953718,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_aarch64_mac_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2350,7 +2440,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_arm_linux_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 188795343
+          "size": 188795343,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_arm_linux_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "0fe0d0825e7",
@@ -2370,7 +2461,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64_aix_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 182285782
+          "size": 182285782,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64_aix_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "0fe0d0825e7",
@@ -2390,7 +2482,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_ppc64le_linux_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 187652430
+          "size": 187652430,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_ppc64le_linux_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "0fe0d0825e7",
@@ -2410,7 +2503,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_s390x_linux_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 179489547
+          "size": 179489547,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_s390x_linux_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "0fe0d0825e7",
@@ -2430,7 +2524,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-06-29-23-33.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-06-29-23-33.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-06-29-23-33.tar.gz",
-          "size": 192109453
+          "size": 192109453,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_alpine-linux_hotspot_2021-06-29-23-33.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2450,7 +2545,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_linux_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 192013559
+          "size": 192013559,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_linux_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2479,7 +2575,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-06-30-09-16.tar.gz",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-06-30-09-16.tar.gz.json",
           "name": "OpenJDK17-jdk_x64_mac_hotspot_2021-06-30-09-16.tar.gz",
-          "size": 192419518
+          "size": 192419518,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_mac_hotspot_2021-06-30-09-16.tar.gz.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2508,7 +2605,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-06-30-09-16.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-06-30-09-16.zip.json",
           "name": "OpenJDK17-jdk_x64_windows_hotspot_2021-06-30-09-16.zip",
-          "size": 188672489
+          "size": 188672489,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x64_windows_hotspot_2021-06-30-09-16.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-130-g0fe0d0825e7",
@@ -2537,7 +2635,8 @@
           "link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-06-30-09-16.zip",
           "metadata_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-06-30-09-16.zip.json",
           "name": "OpenJDK17-jdk_x86-32_windows_hotspot_2021-06-30-09-16.zip",
-          "size": 184626094
+          "size": 184626094,
+          "signature_link": "https://github.com/adoptium/temurin17-binaries/releases/download/jdk17-2021-06-30-09-16-beta/OpenJDK17-jdk_x86-32_windows_hotspot_2021-06-30-09-16.zip.sig"
         },
         "project": "jdk",
         "scm_ref": "jdk-17+28_adopt-132-g23fbf51b850",

__tests__/distributors/base-installer.test.ts

@@ -464,6 +464,24 @@ describe('setupJava', () => {
     }
   );
 
+  it('should fail when verify-signature is enabled for unsupported distributions', async () => {
+    mockJavaBase = new EmptyJavaBase({
+      version: '11',
+      architecture: 'x86',
+      packageType: 'jdk',
+      checkLatest: false,
+      verifySignature: true
+    });
+
+    await expect(mockJavaBase.setupJava()).rejects.toThrow(
+      "Input 'verify-signature' is not supported for distribution 'Empty'."
+    );
+    expect(spyTcFindAllVersions).not.toHaveBeenCalled();
+    expect(spyCoreAddPath).not.toHaveBeenCalled();
+    expect(spyCoreExportVariable).not.toHaveBeenCalled();
+    expect(spyCoreSetOutput).not.toHaveBeenCalled();
+  });
+
   it.each([
     [
       {

__tests__/distributors/jetbrains-installer.test.ts

@@ -87,10 +87,26 @@ describe('findPackageForDownload', () => {
       const url = resolvedVersion.url;
       const options = {method: 'HEAD'};
 
-      https.request(url, options, res => {
+      await new Promise<void>((resolve, reject) => {
-        // JetBrains uses 403 for inexistent packages
+        const request = https.request(url, options, res => {
-        expect(res.statusCode).not.toBe(403);
+          let assertionError: unknown;
-        res.resume();
+
+          try {
+            // JetBrains uses 403 for non-existent packages
+            expect(res.statusCode).not.toBe(403);
+          } catch (error) {
+            assertionError = error;
+          }
+
+          res.resume();
+          res.once('error', reject);
+          res.once('end', () =>
+            assertionError ? reject(assertionError as Error) : resolve()
+          );
+        });
+
+        request.on('error', reject);
+        request.end();
       });
     }
   );

__tests__/distributors/kona-installer.test.ts

@@ -0,0 +1,223 @@
+import {KonaDistribution} from '../../src/distributions/kona/installer';
+
+import manifestData from '../data/kona.json';
+
+function mockDistr(
+  version: string,
+  os: string,
+  arch: string,
+  packageType: string
+): KonaDistribution {
+  const distribution = new KonaDistribution({
+    version: version,
+    architecture: arch,
+    packageType: packageType,
+    checkLatest: false
+  });
+
+  distribution['getOs'] = () => os;
+  distribution['fetchReleaseInfo'] = async () => manifestData;
+
+  return distribution;
+}
+
+describe('Check getAvailableReleases', () => {
+  it.each([
+    ['8', 'linux', 'aarch64', 'linux-aarch64'],
+    ['8.0.20', 'macos', 'x86_64', 'macosx-x86_64'],
+    ['11', 'linux', 'x86_64', 'linux-x86_64'],
+    ['11.0.25', 'macos', 'aarch64', 'macosx-aarch64'],
+    ['17.0.13', 'windows', 'x86_64', 'windows-x86_64'],
+    ['21.0.5', 'linux', 'x86_64', 'linux-x86_64']
+  ])(
+    'should get releases with the specified version "%s", OS "%s" and arch "%s"',
+    async (
+      version: string,
+      os: string,
+      arch: string,
+      expectedPattern: string
+    ) => {
+      const distribution = mockDistr(version, os, arch, 'jdk');
+
+      const releases = await distribution['getAvailableReleases']();
+      expect(releases).not.toBeNull();
+      expect(releases.length).toBe(4);
+      releases.forEach(release =>
+        expect(release.downloadUrl).toContain(expectedPattern)
+      );
+    }
+  );
+});
+
+describe('Check findPackageForDownload', () => {
+  it.each([
+    [
+      '8',
+      'linux',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/TencentKona8.0.20.b1_jdk_linux-aarch64_8u432.tar.gz'
+    ],
+    [
+      '8.0.20',
+      'linux',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/TencentKona8.0.20.b1_jdk_linux-x86_64_8u432.tar.gz'
+    ],
+    [
+      '8.0.20',
+      'macos',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/TencentKona8.0.20.b1_jdk_macosx-aarch64_8u432_notarized.tar.gz'
+    ],
+    [
+      '8.0.20',
+      'macos',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/TencentKona8.0.20.b1_jdk_macosx-x86_64_8u432_notarized.tar.gz'
+    ],
+    [
+      '8.0.20',
+      'windows',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-8/releases/download/8.0.20-GA/TencentKona8.0.20.b1_jdk_windows-x86_64_8u432_signed.zip'
+    ],
+
+    [
+      '11',
+      'linux',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/TencentKona-11.0.25.b1-jdk_linux-aarch64.tar.gz'
+    ],
+    [
+      '11.0.25',
+      'linux',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/TencentKona-11.0.25.b1-jdk_linux-x86_64.tar.gz'
+    ],
+    [
+      '11.0.25',
+      'macos',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/TencentKona-11.0.25.b1_jdk_macosx-aarch64_notarized.tar.gz'
+    ],
+    [
+      '11.0.25',
+      'macos',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/TencentKona-11.0.25.b1_jdk_macosx-x86_64_notarized.tar.gz'
+    ],
+    [
+      '11.0.25',
+      'windows',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-11/releases/download/kona11.0.25/TencentKona-11.0.25.b1_jdk_windows-x86_64_signed.zip'
+    ],
+
+    [
+      '17',
+      'linux',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/TencentKona-17.0.13.b1-jdk_linux-aarch64.tar.gz'
+    ],
+    [
+      '17.0.13',
+      'linux',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/TencentKona-17.0.13.b1-jdk_linux-x86_64.tar.gz'
+    ],
+    [
+      '17.0.13',
+      'macos',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/TencentKona-17.0.13.b1_jdk_macosx-aarch64_notarized.tar.gz'
+    ],
+    [
+      '17.0.13',
+      'macos',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/TencentKona-17.0.13.b1_jdk_macosx-x86_64_notarized.tar.gz'
+    ],
+    [
+      '17.0.13',
+      'windows',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-17/releases/download/TencentKona-17.0.13/TencentKona-17.0.13.b1_jdk_windows-x86_64_signed.zip'
+    ],
+
+    [
+      '21',
+      'linux',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/TencentKona-21.0.5.b1-jdk_linux-aarch64.tar.gz'
+    ],
+    [
+      '21.0.5',
+      'linux',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/TencentKona-21.0.5.b1-jdk_linux-x86_64.tar.gz'
+    ],
+    [
+      '21.0.5',
+      'macos',
+      'aarch64',
+      'https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/TencentKona-21.0.5.b1_jdk_macosx-aarch64_notarized.tar.gz'
+    ],
+    [
+      '21.0.5',
+      'macos',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/TencentKona-21.0.5.b1_jdk_macosx-x86_64_notarized.tar.gz'
+    ],
+    [
+      '21.0.5',
+      'windows',
+      'x86_64',
+      'https://github.com/Tencent/TencentKona-21/releases/download/TencentKona-21.0.5/TencentKona-21.0.5.b1_jdk_windows-x86_64_signed.zip'
+    ]
+  ])(
+    'should return the download URL with the specified version "%s", OS "%s" and arch "%s"',
+    async (version: string, os: string, arch: string, expectedUrl: string) => {
+      const distribution = mockDistr(version, os, arch, 'jdk');
+
+      const availableRelease =
+        await distribution['findPackageForDownload'](version);
+      expect(availableRelease).not.toBeNull();
+      expect(availableRelease.url).toBe(expectedUrl);
+    }
+  );
+});
+
+describe('No release is found', () => {
+  it.each([
+    ['8', 'linux', 'x86'],
+    ['8.0.0', 'linux', 'x86_64'],
+    ['11', 'linux', 'ppc64'],
+    ['17', 'solaris', 'x86_64'],
+    ['17', 'windows', 'aarch64'],
+    ['22', 'macos', 'x86_64']
+  ])(
+    `should throw an error due to no release with the specified version "%s", os "%s" and arch "%s"`,
+    async (version: string, os: string, arch: string) => {
+      const distribution = mockDistr(version, os, arch, 'jdk');
+
+      await expect(
+        distribution['findPackageForDownload'](version)
+      ).rejects.toThrow(
+        `No Kona release for the specified version "${version}" on OS "${os}" and arch "${arch}".`
+      );
+    }
+  );
+});
+
+describe('The package type must be jdk', () => {
+  it('should throw an error due to the specified package type is not jdk', async () => {
+    const version = '8.0.20';
+    const os = 'linux';
+    const arch = 'x86_64';
+    const distribution = mockDistr(version, os, arch, 'jre');
+
+    await expect(
+      distribution['findPackageForDownload'](version)
+    ).rejects.toThrow('Kona provides jdk only');
+  });
+});

__tests__/distributors/microsoft-installer.test.ts

@@ -1,8 +1,15 @@
-import {MicrosoftDistributions} from '../../src/distributions/microsoft/installer';
+import {
+  MicrosoftDistributions,
+  MICROSOFT_PUBLIC_KEY
+} from '../../src/distributions/microsoft/installer';
 import os from 'os';
 import data from '../data/microsoft.json';
 import * as httpm from '@actions/http-client';
 import * as core from '@actions/core';
+import * as tc from '@actions/tool-cache';
+import * as gpg from '../../src/gpg';
+import * as util from '../../src/util';
+import fs from 'fs';
 
 describe('findPackageForDownload', () => {
   let distribution: MicrosoftDistributions;
@@ -102,6 +109,7 @@ describe('findPackageForDownload', () => {
       .replace('{{OS_TYPE}}', os)
       .replace('{{ARCHIVE_TYPE}}', archive);
     expect(result.url).toBe(url);
+    expect(result.signatureUrl).toBe(`${url}.sig`);
   });
 
   it.each([
@@ -187,4 +195,153 @@ describe('findPackageForDownload', () => {
       /No matching version found for SemVer */
     );
   });
+
+  it('uses manifest-provided signature URL when available', async () => {
+    spyGetManifestFromRepo.mockReturnValue({
+      result: [
+        {
+          version: '17.0.10',
+          stable: true,
+          release_url: 'https://example.test',
+          files: [
+            {
+              filename: 'microsoft-jdk-17.0.10-linux-x64.tar.gz',
+              arch: 'x64',
+              platform: 'linux',
+              download_url: 'https://example.test/jdk.tar.gz',
+              signature_url: 'https://example.test/jdk.tar.gz.custom.sig'
+            }
+          ]
+        }
+      ],
+      statusCode: 200,
+      headers: {}
+    });
+    jest.spyOn(os, 'platform').mockReturnValue('linux');
+
+    const result = await distribution['findPackageForDownload']('17.0.10');
+
+    expect(result.signatureUrl).toBe(
+      'https://example.test/jdk.tar.gz.custom.sig'
+    );
+  });
+});
+
+describe('downloadTool', () => {
+  let spyDownloadTool: jest.SpyInstance;
+  let spyExtractJdkFile: jest.SpyInstance;
+  let spyCacheDir: jest.SpyInstance;
+  let spyVerifySignature: jest.SpyInstance;
+  let distribution: MicrosoftDistributions;
+
+  beforeEach(() => {
+    jest
+      .spyOn(os, 'platform')
+      .mockReturnValue(process.platform as ReturnType<typeof os.platform>);
+
+    distribution = new MicrosoftDistributions({
+      version: '17',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    spyDownloadTool = jest.spyOn(tc, 'downloadTool');
+    spyDownloadTool.mockImplementation(async () => {
+      return '/tmp/jdk.tar.gz';
+    });
+
+    spyExtractJdkFile = jest.spyOn(util, 'extractJdkFile');
+    spyExtractJdkFile.mockImplementation(async () => {
+      return '/tmp/unpacked';
+    });
+
+    jest.spyOn(fs, 'readdirSync').mockReturnValue(['jdk'] as any);
+    spyCacheDir = jest.spyOn(tc, 'cacheDir');
+    spyCacheDir.mockImplementation(async () => {
+      return '/tmp/cached';
+    });
+
+    jest
+      .spyOn(util, 'renameWinArchive')
+      .mockImplementation((archivePath: string) => `${archivePath}.zip`);
+
+    spyVerifySignature = jest.spyOn(gpg, 'verifyPackageSignature');
+    spyVerifySignature.mockImplementation(async () => {});
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('verifies signature when enabled', async () => {
+    const signedDistribution = new MicrosoftDistributions({
+      version: '17',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false,
+      verifySignature: true
+    });
+
+    await signedDistribution['downloadTool']({
+      version: '17.0.14+7',
+      url: 'https://example.com/jdk.tar.gz',
+      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
+    });
+
+    expect(spyVerifySignature).toHaveBeenCalledWith(
+      '/tmp/jdk.tar.gz',
+      'https://example.com/jdk.tar.gz.sig',
+      MICROSOFT_PUBLIC_KEY
+    );
+  });
+
+  it('uses custom public key when verifySignaturePublicKey is provided', async () => {
+    const customKey =
+      '-----BEGIN PGP PUBLIC KEY BLOCK-----\ncustom\n-----END PGP PUBLIC KEY BLOCK-----';
+    const signedDistribution = new MicrosoftDistributions({
+      version: '17',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false,
+      verifySignature: true,
+      verifySignaturePublicKey: customKey
+    });
+
+    await signedDistribution['downloadTool']({
+      version: '17.0.14+7',
+      url: 'https://example.com/jdk.tar.gz',
+      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
+    });
+
+    expect(spyVerifySignature).toHaveBeenCalledWith(
+      '/tmp/jdk.tar.gz',
+      'https://example.com/jdk.tar.gz.sig',
+      customKey
+    );
+  });
+
+  it('fails when signature is missing and verification is enabled', async () => {
+    const signedDistribution = new MicrosoftDistributions({
+      version: '17',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false,
+      verifySignature: true
+    });
+
+    await expect(
+      signedDistribution['downloadTool']({
+        version: '17.0.14+7',
+        url: 'https://example.com/jdk.tar.gz'
+      })
+    ).rejects.toThrow(
+      "Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version 17.0.14+7."
+    );
+    expect(spyVerifySignature).not.toHaveBeenCalled();
+  });
+
+  it('supports signature verification', () => {
+    expect(distribution['supportsSignatureVerification']()).toBe(true);
+  });
 });

__tests__/distributors/temurin-installer.test.ts

@@ -1,10 +1,15 @@
 import {HttpClient} from '@actions/http-client';
+import * as tc from '@actions/tool-cache';
+import fs from 'fs';
 import os from 'os';
 import {
   TemurinDistribution,
-  TemurinImplementation
+  TemurinImplementation,
+  ADOPTIUM_PUBLIC_KEY
 } from '../../src/distributions/temurin/installer';
 import {JavaInstallerOptions} from '../../src/distributions/base-models';
+import * as util from '../../src/util';
+import * as gpg from '../../src/gpg';
 
 import manifestData from '../data/temurin.json';
 import * as core from '@actions/core';
@@ -231,6 +236,7 @@ describe('findPackageForDownload', () => {
     distribution['getAvailableVersions'] = async () => manifestData as any;
     const resolvedVersion = await distribution['findPackageForDownload'](input);
     expect(resolvedVersion.version).toBe(expected);
+    expect(resolvedVersion.signatureUrl).toBeDefined();
   });
 
   it('version is found but binaries list is empty', async () => {
@@ -281,3 +287,109 @@ describe('findPackageForDownload', () => {
     );
   });
 });
+
+describe('downloadTool', () => {
+  let spyDownloadTool: jest.SpyInstance;
+  let spyVerifySignature: jest.SpyInstance;
+  let spyExtractJdkFile: jest.SpyInstance;
+  let spyCacheDir: jest.SpyInstance;
+  let spyReadDirSync: jest.SpyInstance;
+  let spyRenameWinArchive: jest.SpyInstance;
+
+  beforeEach(() => {
+    spyDownloadTool = jest.spyOn(tc, 'downloadTool');
+    spyDownloadTool.mockResolvedValue('/tmp/jdk.tar.gz');
+    spyVerifySignature = jest.spyOn(gpg, 'verifyPackageSignature');
+    spyVerifySignature.mockResolvedValue(undefined);
+    spyExtractJdkFile = jest.spyOn(util, 'extractJdkFile');
+    spyExtractJdkFile.mockResolvedValue('/tmp/extracted');
+    spyCacheDir = jest.spyOn(tc, 'cacheDir');
+    spyCacheDir.mockResolvedValue('/tmp/toolcache');
+    spyReadDirSync = jest.spyOn(fs, 'readdirSync');
+    spyReadDirSync.mockReturnValue(['jdk-17'] as any);
+    spyRenameWinArchive = jest.spyOn(util, 'renameWinArchive');
+    spyRenameWinArchive.mockReturnValue('/tmp/jdk.tar.gz.zip');
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it('verifies signature when enabled', async () => {
+    const distribution = new TemurinDistribution(
+      {
+        version: '17',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false,
+        verifySignature: true
+      },
+      TemurinImplementation.Hotspot
+    );
+
+    await distribution['downloadTool']({
+      version: '17.0.14+7',
+      url: 'https://example.com/jdk.tar.gz',
+      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
+    });
+
+    expect(spyVerifySignature).toHaveBeenCalledWith(
+      '/tmp/jdk.tar.gz',
+      'https://example.com/jdk.tar.gz.sig',
+      ADOPTIUM_PUBLIC_KEY
+    );
+  });
+
+  it('fails when signature is missing and verification is enabled', async () => {
+    const distribution = new TemurinDistribution(
+      {
+        version: '17',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false,
+        verifySignature: true
+      },
+      TemurinImplementation.Hotspot
+    );
+
+    await expect(
+      distribution['downloadTool']({
+        version: '17.0.14+7',
+        url: 'https://example.com/jdk.tar.gz'
+      })
+    ).rejects.toThrow(
+      "Input 'verify-signature' is enabled, but no signature URL was found"
+    );
+    expect(spyVerifySignature).not.toHaveBeenCalled();
+  });
+
+  it('uses custom public key when verifySignaturePublicKey is provided', async () => {
+    const customKey =
+      '-----BEGIN PGP PUBLIC KEY BLOCK-----\ncustom\n-----END PGP PUBLIC KEY BLOCK-----';
+    const distribution = new TemurinDistribution(
+      {
+        version: '17',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false,
+        verifySignature: true,
+        verifySignaturePublicKey: customKey
+      },
+      TemurinImplementation.Hotspot
+    );
+
+    await distribution['downloadTool']({
+      version: '17.0.14+7',
+      url: 'https://example.com/jdk.tar.gz',
+      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
+    });
+
+    expect(spyVerifySignature).toHaveBeenCalledWith(
+      '/tmp/jdk.tar.gz',
+      'https://example.com/jdk.tar.gz.sig',
+      customKey
+    );
+  });
+});

__tests__/gpg.test.ts

@@ -1,6 +1,7 @@
 import * as path from 'path';
 import * as io from '@actions/io';
 import * as exec from '@actions/exec';
+import * as tc from '@actions/tool-cache';
 import * as gpg from '../src/gpg';
 
 jest.mock('@actions/exec', () => {
@@ -9,6 +10,12 @@ jest.mock('@actions/exec', () => {
   };
 });
 
+jest.mock('@actions/tool-cache', () => {
+  return {
+    downloadTool: jest.fn()
+  };
+});
+
 const tempDir = path.join(__dirname, 'runner', 'temp');
 process.env['RUNNER_TEMP'] = tempDir;
 
@@ -25,6 +32,35 @@ describe('gpg tests', () => {
     }
   });
 
+  describe('toGpgPath', () => {
+    const originalPlatform = process.platform;
+
+    afterEach(() => {
+      Object.defineProperty(process, 'platform', {value: originalPlatform});
+    });
+
+    it('returns path unchanged on non-Windows platforms', () => {
+      Object.defineProperty(process, 'platform', {value: 'linux'});
+      expect(gpg.toGpgPath('/tmp/some/path')).toBe('/tmp/some/path');
+      expect(gpg.toGpgPath('D:\\a\\_temp\\file')).toBe('D:\\a\\_temp\\file');
+    });
+
+    it('converts Windows backslashes and drive letter to POSIX path on Windows', () => {
+      Object.defineProperty(process, 'platform', {value: 'win32'});
+      expect(gpg.toGpgPath('D:\\a\\_temp\\gpg-home')).toBe(
+        '/d/a/_temp/gpg-home'
+      );
+      expect(
+        gpg.toGpgPath('C:\\Users\\runner\\AppData\\Local\\Temp\\key.asc')
+      ).toBe('/c/Users/runner/AppData/Local/Temp/key.asc');
+    });
+
+    it('handles uppercase and lowercase drive letters on Windows', () => {
+      Object.defineProperty(process, 'platform', {value: 'win32'});
+      expect(gpg.toGpgPath('d:\\a\\_temp\\file')).toBe('/d/a/_temp/file');
+    });
+  });
+
   describe('importKey', () => {
     it('attempts to import private key and returns null key id on failure', async () => {
       const privateKey = 'KEY CONTENTS';
@@ -51,5 +87,47 @@ describe('gpg tests', () => {
         expect.anything()
       );
     });
+
+    describe('verifyPackageSignature', () => {
+      it('imports bundled key and verifies package', async () => {
+        const publicKeyContent =
+          '-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----';
+        (tc.downloadTool as jest.Mock).mockResolvedValue('/tmp/jdk.tar.gz.sig');
+        await gpg.verifyPackageSignature(
+          '/tmp/jdk.tar.gz',
+          'https://example.com/jdk.tar.gz.sig',
+          publicKeyContent
+        );
+
+        expect(tc.downloadTool).toHaveBeenCalledWith(
+          'https://example.com/jdk.tar.gz.sig'
+        );
+        expect(exec.exec).toHaveBeenNthCalledWith(
+          1,
+          'gpg',
+          [
+            '--homedir',
+            expect.any(String),
+            '--batch',
+            '--import',
+            expect.stringContaining('public-key.asc')
+          ],
+          expect.objectContaining({silent: true})
+        );
+        expect(exec.exec).toHaveBeenNthCalledWith(
+          2,
+          'gpg',
+          [
+            '--homedir',
+            expect.any(String),
+            '--batch',
+            '--verify',
+            '/tmp/jdk.tar.gz.sig',
+            '/tmp/jdk.tar.gz'
+          ],
+          expect.objectContaining({silent: true})
+        );
+      });
+    });
   });
 });

__tests__/maven-args.test.ts

@@ -0,0 +1,104 @@
+import * as core from '@actions/core';
+
+import {configureMavenArgs} from '../src/maven-args';
+import {
+  INPUT_SHOW_DOWNLOAD_PROGRESS,
+  MAVEN_ARGS_ENV,
+  MAVEN_NO_TRANSFER_PROGRESS_FLAG
+} from '../src/constants';
+
+describe('configureMavenArgs', () => {
+  let inputs: Record<string, string>;
+  let spyGetInput: jest.SpyInstance;
+  let spyExportVariable: jest.SpyInstance;
+  let spyInfo: jest.SpyInstance;
+  let spyDebug: jest.SpyInstance;
+  const originalMavenArgs = process.env[MAVEN_ARGS_ENV];
+
+  beforeEach(() => {
+    inputs = {};
+
+    spyGetInput = jest.spyOn(core, 'getInput');
+    spyGetInput.mockImplementation((name: string) => inputs[name] ?? '');
+
+    spyExportVariable = jest.spyOn(core, 'exportVariable');
+    spyExportVariable.mockImplementation((name: string, value: string) => {
+      process.env[name] = value;
+    });
+
+    spyInfo = jest.spyOn(core, 'info');
+    spyInfo.mockImplementation(() => undefined);
+
+    spyDebug = jest.spyOn(core, 'debug');
+    spyDebug.mockImplementation(() => undefined);
+
+    delete process.env[MAVEN_ARGS_ENV];
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    if (originalMavenArgs === undefined) {
+      delete process.env[MAVEN_ARGS_ENV];
+    } else {
+      process.env[MAVEN_ARGS_ENV] = originalMavenArgs;
+    }
+  });
+
+  it('sets MAVEN_ARGS with -ntp by default', () => {
+    configureMavenArgs();
+
+    expect(spyExportVariable).toHaveBeenCalledWith(
+      MAVEN_ARGS_ENV,
+      MAVEN_NO_TRANSFER_PROGRESS_FLAG
+    );
+    expect(process.env[MAVEN_ARGS_ENV]).toBe(MAVEN_NO_TRANSFER_PROGRESS_FLAG);
+  });
+
+  it('does not modify MAVEN_ARGS when show-download-progress is true', () => {
+    inputs[INPUT_SHOW_DOWNLOAD_PROGRESS] = 'true';
+
+    configureMavenArgs();
+
+    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(process.env[MAVEN_ARGS_ENV]).toBeUndefined();
+  });
+
+  it('preserves an existing MAVEN_ARGS value and appends -ntp', () => {
+    process.env[MAVEN_ARGS_ENV] = '-B -Dstyle.color=always';
+
+    configureMavenArgs();
+
+    expect(spyExportVariable).toHaveBeenCalledWith(
+      MAVEN_ARGS_ENV,
+      `-B -Dstyle.color=always ${MAVEN_NO_TRANSFER_PROGRESS_FLAG}`
+    );
+  });
+
+  it('does not duplicate the flag when -ntp is already present', () => {
+    process.env[MAVEN_ARGS_ENV] = '-B -ntp';
+
+    configureMavenArgs();
+
+    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(process.env[MAVEN_ARGS_ENV]).toBe('-B -ntp');
+  });
+
+  it('does not duplicate the flag when --no-transfer-progress is already present', () => {
+    process.env[MAVEN_ARGS_ENV] = '--no-transfer-progress -B';
+
+    configureMavenArgs();
+
+    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(process.env[MAVEN_ARGS_ENV]).toBe('--no-transfer-progress -B');
+  });
+
+  it('keeps the existing MAVEN_ARGS when show-download-progress is true', () => {
+    inputs[INPUT_SHOW_DOWNLOAD_PROGRESS] = 'true';
+    process.env[MAVEN_ARGS_ENV] = '-B';
+
+    configureMavenArgs();
+
+    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(process.env[MAVEN_ARGS_ENV]).toBe('-B');
+  });
+});

__tests__/toolchains.test.ts

@@ -143,7 +143,20 @@ describe('toolchains tests', () => {
         </toolchain>
       </toolchains>`;
     const result = `<?xml version="1.0"?>
-<toolchains>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
   <toolchain>
     <type>jdk</type>
     <provides>
@@ -155,6 +168,68 @@ describe('toolchains tests', () => {
       <jdkHome>/opt/jdk/sun/1.6</jdkHome>
     </configuration>
   </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('does not discard custom elements in existing toolchain definitions', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+        <toolchain>
+          <type>jdk</type>
+          <provides>
+            <version>1.6</version>
+            <vendor>Sun</vendor>
+            <id>sun_1.6</id>
+            <custom>foo</custom>
+          </provides>
+          <configuration>
+            <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+            <fooHome>/usr/local/bin/bash</fooHome>
+          </configuration>
+        </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
   <toolchain>
     <type>jdk</type>
     <provides>
@@ -166,6 +241,544 @@ describe('toolchains tests', () => {
       <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
     </configuration>
   </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>1.6</version>
+      <vendor>Sun</vendor>
+      <id>sun_1.6</id>
+      <custom>foo</custom>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+      <fooHome>/usr/local/bin/bash</fooHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('does not discard existing, custom toolchain definitions', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+        <toolchain>
+            <type>foo</type>
+            <provides>
+                <custom>baz</custom>
+            </provides>
+            <configuration>
+                <fooHome>/usr/local/bin/foo</fooHome>
+            </configuration>
+        </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>foo</type>
+    <provides>
+      <custom>baz</custom>
+    </provides>
+    <configuration>
+      <fooHome>/usr/local/bin/foo</fooHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('does not duplicate existing toolchain definitions', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+      <toolchain>
+        <type>jdk</type>
+        <provides>
+          <version>17</version>
+          <vendor>Eclipse Temurin</vendor>
+          <id>temurin_17</id>
+        </provides>
+        <configuration>
+          <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+        </configuration>
+      </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('does not duplicate existing toolchain definitions if multiple exist', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+        <toolchain>
+          <type>jdk</type>
+          <provides>
+            <version>1.6</version>
+            <vendor>Sun</vendor>
+            <id>sun_1.6</id>
+          </provides>
+          <configuration>
+            <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+          </configuration>
+        </toolchain>
+      <toolchain>
+        <type>jdk</type>
+        <provides>
+          <version>17</version>
+          <vendor>Eclipse Temurin</vendor>
+          <id>temurin_17</id>
+        </provides>
+        <configuration>
+          <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+        </configuration>
+      </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>1.6</version>
+      <vendor>Sun</vendor>
+      <id>sun_1.6</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('handles an empty list of existing toolchains correctly', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('handles an empty existing toolchains.xml correctly', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = ``;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('preserves custom root attributes on existing toolchains.xml', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.0.0 http://maven.apache.org/xsd/toolchains-1.0.0.xsd">
+        <toolchain>
+          <type>jdk</type>
+          <provides>
+            <version>1.6</version>
+            <vendor>Sun</vendor>
+            <id>sun_1.6</id>
+          </provides>
+          <configuration>
+            <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+          </configuration>
+        </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.0.0 http://maven.apache.org/xsd/toolchains-1.0.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>1.6</version>
+      <vendor>Sun</vendor>
+      <id>sun_1.6</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+    </configuration>
+  </toolchain>
+</toolchains>`;
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(toolchainsFile, originalFile);
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+
+    await toolchains.createToolchainsSettings({
+      jdkInfo,
+      settingsDirectory: m2Dir,
+      overwriteSettings: true
+    });
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(toolchainsFile)).toBe(true);
+    expect(fs.readFileSync(toolchainsFile, 'utf-8')).toEqual(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    );
+    expect(
+      toolchains.generateToolchainDefinition(
+        originalFile,
+        jdkInfo.version,
+        jdkInfo.vendor,
+        jdkInfo.id,
+        jdkInfo.jdkHome
+      )
+    ).toEqual(result);
+  }, 100000);
+
+  it('keeps partially-formed jdk toolchains without an id instead of crashing', async () => {
+    const jdkInfo = {
+      version: '17',
+      vendor: 'Eclipse Temurin',
+      id: 'temurin_17',
+      jdkHome: '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64'
+    };
+
+    const originalFile = `<toolchains>
+        <toolchain>
+          <type>jdk</type>
+          <provides>
+            <version>1.6</version>
+            <vendor>Sun</vendor>
+          </provides>
+          <configuration>
+            <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+          </configuration>
+        </toolchain>
+      </toolchains>`;
+    const result = `<?xml version="1.0"?>
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd">
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>17</version>
+      <vendor>Eclipse Temurin</vendor>
+      <id>temurin_17</id>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64</jdkHome>
+    </configuration>
+  </toolchain>
+  <toolchain>
+    <type>jdk</type>
+    <provides>
+      <version>1.6</version>
+      <vendor>Sun</vendor>
+    </provides>
+    <configuration>
+      <jdkHome>/opt/jdk/sun/1.6</jdkHome>
+    </configuration>
+  </toolchain>
 </toolchains>`;
 
     fs.mkdirSync(m2Dir, {recursive: true});

action.yml

@@ -26,6 +26,13 @@ inputs:
     description: 'Set this option if you want the action to check for the latest available version that satisfies the version spec'
     required: false
     default: false
+  verify-signature:
+    description: 'Verify downloaded Java package signatures when supported by the selected distribution'
+    required: false
+    default: false
+  verify-signature-public-key:
+    description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
+    required: false
   server-id:
     description: 'ID of the distributionManagement repository in the pom.xml
        file. Default is `github`'
@@ -75,6 +82,10 @@ inputs:
   mvn-toolchain-vendor:
     description: 'Name of Maven Toolchain Vendor if the default name of "${distribution}" is not wanted. See examples of supported syntax in Advanced Usage file'
     required: false
+  show-download-progress:
+    description: 'Whether Maven should print artifact download/transfer progress to the build log. When "false" (default) the action sets "-ntp" (--no-transfer-progress) in MAVEN_ARGS to produce cleaner logs. Set to "true" to keep the progress output. Has no effect on non-Maven builds.'
+    required: false
+    default: false
 outputs:
   distribution:
     description: 'Distribution of Java that has been installed'

dist/cleanup/index.js

@@ -52241,7 +52241,7 @@ else {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
+exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG = exports.MAVEN_NO_TRANSFER_PROGRESS_FLAG = exports.MAVEN_ARGS_ENV = exports.INPUT_SHOW_DOWNLOAD_PROGRESS = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = exports.INPUT_VERIFY_SIGNATURE = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
 exports.MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
 exports.INPUT_JAVA_VERSION = 'java-version';
 exports.INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -52250,6 +52250,8 @@ exports.INPUT_JAVA_PACKAGE = 'java-package';
 exports.INPUT_DISTRIBUTION = 'distribution';
 exports.INPUT_JDK_FILE = 'jdkFile';
 exports.INPUT_CHECK_LATEST = 'check-latest';
+exports.INPUT_VERIFY_SIGNATURE = 'verify-signature';
+exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
 exports.INPUT_SERVER_ID = 'server-id';
 exports.INPUT_SERVER_USERNAME = 'server-username';
 exports.INPUT_SERVER_PASSWORD = 'server-password';
@@ -52268,6 +52270,10 @@ exports.MVN_SETTINGS_FILE = 'settings.xml';
 exports.MVN_TOOLCHAINS_FILE = 'toolchains.xml';
 exports.INPUT_MVN_TOOLCHAIN_ID = 'mvn-toolchain-id';
 exports.INPUT_MVN_TOOLCHAIN_VENDOR = 'mvn-toolchain-vendor';
+exports.INPUT_SHOW_DOWNLOAD_PROGRESS = 'show-download-progress';
+exports.MAVEN_ARGS_ENV = 'MAVEN_ARGS';
+exports.MAVEN_NO_TRANSFER_PROGRESS_FLAG = '-ntp';
+exports.MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG = '--no-transfer-progress';
 exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = ['corretto'];
 
 
@@ -52311,14 +52317,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.deleteKey = exports.importKey = exports.PRIVATE_KEY_FILE = void 0;
+exports.verifyPackageSignature = exports.deleteKey = exports.importKey = exports.toGpgPath = exports.PRIVATE_KEY_FILE = void 0;
 const fs = __importStar(__nccwpck_require__(79896));
 const path = __importStar(__nccwpck_require__(16928));
 const io = __importStar(__nccwpck_require__(94994));
 const exec = __importStar(__nccwpck_require__(95236));
+const tc = __importStar(__nccwpck_require__(33472));
 const util = __importStar(__nccwpck_require__(54527));
 exports.PRIVATE_KEY_FILE = path.join(util.getTempDir(), 'private-key.asc');
 const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
+// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
+// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
+// internally. Passing Windows paths with backslashes can cause fatal GPG errors
+// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
+function toGpgPath(p) {
+    if (process.platform !== 'win32')
+        return p;
+    return p
+        .replace(/\\/g, '/')
+        .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
+}
+exports.toGpgPath = toGpgPath;
 function importKey(privateKey) {
     return __awaiter(this, void 0, void 0, function* () {
         fs.writeFileSync(exports.PRIVATE_KEY_FILE, privateKey, {
@@ -52355,6 +52374,49 @@ function deleteKey(keyFingerprint) {
     });
 }
 exports.deleteKey = deleteKey;
+function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const signaturePath = yield tc.downloadTool(signatureUrl);
+        let gpgHome;
+        try {
+            gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
+        }
+        catch (error) {
+            try {
+                yield io.rmRF(signaturePath);
+            }
+            catch (_a) {
+                // ignore cleanup failures
+            }
+            throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
+        }
+        try {
+            const publicKeyFile = path.join(gpgHome, 'public-key.asc');
+            fs.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
+            const options = { silent: true };
+            yield exec.exec('gpg', [
+                '--homedir',
+                toGpgPath(gpgHome),
+                '--batch',
+                '--import',
+                toGpgPath(publicKeyFile)
+            ], options);
+            yield exec.exec('gpg', [
+                '--homedir',
+                toGpgPath(gpgHome),
+                '--batch',
+                '--verify',
+                toGpgPath(signaturePath),
+                toGpgPath(archivePath)
+            ], options);
+        }
+        finally {
+            yield io.rmRF(signaturePath);
+            yield io.rmRF(gpgHome);
+        }
+    });
+}
+exports.verifyPackageSignature = verifyPackageSignature;
 
 
 /***/ }),

dist/setup/index.js

@@ -77727,6 +77727,7 @@ function generate(id, username, password, gpgPassphrase) {
             '@xmlns': 'http://maven.apache.org/SETTINGS/1.0.0',
             '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
             '@xsi:schemaLocation': 'http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd',
+            interactiveMode: false,
             servers: {
                 server: [
                     {
@@ -78000,7 +78001,7 @@ function isProbablyGradleDaemonProblem(packageManager, error) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
+exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = exports.MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG = exports.MAVEN_NO_TRANSFER_PROGRESS_FLAG = exports.MAVEN_ARGS_ENV = exports.INPUT_SHOW_DOWNLOAD_PROGRESS = exports.INPUT_MVN_TOOLCHAIN_VENDOR = exports.INPUT_MVN_TOOLCHAIN_ID = exports.MVN_TOOLCHAINS_FILE = exports.MVN_SETTINGS_FILE = exports.M2_DIR = exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = exports.INPUT_JOB_STATUS = exports.INPUT_CACHE_DEPENDENCY_PATH = exports.INPUT_CACHE = exports.INPUT_DEFAULT_GPG_PASSPHRASE = exports.INPUT_DEFAULT_GPG_PRIVATE_KEY = exports.INPUT_GPG_PASSPHRASE = exports.INPUT_GPG_PRIVATE_KEY = exports.INPUT_OVERWRITE_SETTINGS = exports.INPUT_SETTINGS_PATH = exports.INPUT_SERVER_PASSWORD = exports.INPUT_SERVER_USERNAME = exports.INPUT_SERVER_ID = exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = exports.INPUT_VERIFY_SIGNATURE = exports.INPUT_CHECK_LATEST = exports.INPUT_JDK_FILE = exports.INPUT_DISTRIBUTION = exports.INPUT_JAVA_PACKAGE = exports.INPUT_ARCHITECTURE = exports.INPUT_JAVA_VERSION_FILE = exports.INPUT_JAVA_VERSION = exports.MACOS_JAVA_CONTENT_POSTFIX = void 0;
 exports.MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
 exports.INPUT_JAVA_VERSION = 'java-version';
 exports.INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -78009,6 +78010,8 @@ exports.INPUT_JAVA_PACKAGE = 'java-package';
 exports.INPUT_DISTRIBUTION = 'distribution';
 exports.INPUT_JDK_FILE = 'jdkFile';
 exports.INPUT_CHECK_LATEST = 'check-latest';
+exports.INPUT_VERIFY_SIGNATURE = 'verify-signature';
+exports.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
 exports.INPUT_SERVER_ID = 'server-id';
 exports.INPUT_SERVER_USERNAME = 'server-username';
 exports.INPUT_SERVER_PASSWORD = 'server-password';
@@ -78027,6 +78030,10 @@ exports.MVN_SETTINGS_FILE = 'settings.xml';
 exports.MVN_TOOLCHAINS_FILE = 'toolchains.xml';
 exports.INPUT_MVN_TOOLCHAIN_ID = 'mvn-toolchain-id';
 exports.INPUT_MVN_TOOLCHAIN_VENDOR = 'mvn-toolchain-vendor';
+exports.INPUT_SHOW_DOWNLOAD_PROGRESS = 'show-download-progress';
+exports.MAVEN_ARGS_ENV = 'MAVEN_ARGS';
+exports.MAVEN_NO_TRANSFER_PROGRESS_FLAG = '-ntp';
+exports.MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG = '--no-transfer-progress';
 exports.DISTRIBUTIONS_ONLY_MAJOR_VERSION = ['corretto'];
 
 
@@ -78308,6 +78315,7 @@ const constants_1 = __nccwpck_require__(27242);
 const os_1 = __importDefault(__nccwpck_require__(70857));
 class JavaBase {
     constructor(distribution, installerOptions) {
+        var _a;
         this.distribution = distribution;
         this.http = new httpm.HttpClient('actions/setup-java', undefined, {
             allowRetries: true,
@@ -78317,10 +78325,15 @@ class JavaBase {
         this.architecture = installerOptions.architecture || os_1.default.arch();
         this.packageType = installerOptions.packageType;
         this.checkLatest = installerOptions.checkLatest;
+        this.verifySignature = (_a = installerOptions.verifySignature) !== null && _a !== void 0 ? _a : false;
+        this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
     }
     setupJava() {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
+            if (this.verifySignature && !this.supportsSignatureVerification()) {
+                throw new Error(`Input 'verify-signature' is not supported for distribution '${this.distribution}'.`);
+            }
             let foundJava = this.findInToolcache();
             if (foundJava && !this.checkLatest) {
                 core.info(`Resolved Java ${foundJava.version} from tool-cache`);
@@ -78440,6 +78453,9 @@ class JavaBase {
     get toolcacheFolderName() {
         return `Java_${this.distribution}_${this.packageType}`;
     }
+    supportsSignatureVerification() {
+        return false;
+    }
     getToolcacheVersionName(version) {
         if (!this.stable) {
             if (version.includes('+')) {
@@ -78755,6 +78771,7 @@ const installer_10 = __nccwpck_require__(37675);
 const installer_11 = __nccwpck_require__(17557);
 const installer_12 = __nccwpck_require__(26968);
 const installer_13 = __nccwpck_require__(62282);
+const installer_14 = __nccwpck_require__(48151);
 var JavaDistribution;
 (function (JavaDistribution) {
     JavaDistribution["Adopt"] = "adopt";
@@ -78773,6 +78790,7 @@ var JavaDistribution;
     JavaDistribution["GraalVM"] = "graalvm";
     JavaDistribution["GraalVMCommunity"] = "graalvm-community";
     JavaDistribution["JetBrains"] = "jetbrains";
+    JavaDistribution["Kona"] = "kona";
 })(JavaDistribution || (JavaDistribution = {}));
 function getJavaDistribution(distributionName, installerOptions, jdkFile) {
     switch (distributionName) {
@@ -78807,6 +78825,8 @@ function getJavaDistribution(distributionName, installerOptions, jdkFile) {
             return new installer_12.GraalVMCommunityDistribution(installerOptions);
         case JavaDistribution.JetBrains:
             return new installer_13.JetBrainsDistribution(installerOptions);
+        case JavaDistribution.Kona:
+            return new installer_14.KonaDistribution(installerOptions);
         default:
             return null;
     }
@@ -79586,6 +79606,186 @@ class JetBrainsDistribution extends base_installer_1.JavaBase {
 exports.JetBrainsDistribution = JetBrainsDistribution;
 
 
+/***/ }),
+
+/***/ 48151:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.KonaDistribution = void 0;
+const core = __importStar(__nccwpck_require__(37484));
+const tc = __importStar(__nccwpck_require__(33472));
+const semver_1 = __importDefault(__nccwpck_require__(62088));
+const fs_1 = __importDefault(__nccwpck_require__(79896));
+const path_1 = __importDefault(__nccwpck_require__(16928));
+const base_installer_1 = __nccwpck_require__(79935);
+const util_1 = __nccwpck_require__(54527);
+class KonaDistribution extends base_installer_1.JavaBase {
+    constructor(installerOptions) {
+        super('Kona', installerOptions);
+    }
+    downloadTool(javaRelease) {
+        return __awaiter(this, void 0, void 0, function* () {
+            core.info(`Downloading Kona JDK ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
+            const javaArchivePath = yield tc.downloadTool(javaRelease.url);
+            core.info(`Extracting Java archive...`);
+            const extension = (0, util_1.getDownloadArchiveExtension)();
+            const archivePath = process.platform === 'win32'
+                ? (0, util_1.renameWinArchive)(javaArchivePath)
+                : javaArchivePath;
+            const extractedJavaPath = yield (0, util_1.extractJdkFile)(archivePath, extension);
+            const archiveName = fs_1.default.readdirSync(extractedJavaPath)[0];
+            const jdkDirectory = path_1.default.join(extractedJavaPath, archiveName);
+            const version = this.getToolcacheVersionName(javaRelease.version);
+            const javaPath = yield tc.cacheDir(jdkDirectory, this.toolcacheFolderName, version, this.architecture);
+            return { version: javaRelease.version, path: javaPath };
+        });
+    }
+    findPackageForDownload(version) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.stable) {
+                throw new Error('Kona provides stable releases only');
+            }
+            if (this.packageType !== 'jdk') {
+                throw new Error('Kona provides jdk only');
+            }
+            const availableReleases = yield this.getAvailableReleases();
+            const releases = availableReleases
+                .filter(item => {
+                return (0, util_1.isVersionSatisfies)(version, item.version);
+            })
+                .map(item => {
+                return {
+                    version: item.version,
+                    url: item.downloadUrl
+                };
+            })
+                .sort((a, b) => -semver_1.default.compareBuild(a.version, b.version));
+            if (!releases.length) {
+                throw new Error(`No Kona release for the specified version "${version}" on OS "${this.getOs()}" and arch "${this.getArch()}".`);
+            }
+            return releases[0];
+        });
+    }
+    getAvailableReleases() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (core.isDebug()) {
+                console.time('Retrieving available releases for Kona took'); // eslint-disable-line no-console
+            }
+            const releaseInfo = yield this.fetchReleaseInfo();
+            if (!releaseInfo) {
+                throw new Error(`Couldn't fetch Kona release information`);
+            }
+            const availableReleases = this.chooseReleases(this.getOs(), this.getArch(), releaseInfo);
+            if (core.isDebug()) {
+                core.startGroup('Print information about available releases');
+                console.timeEnd('Retrieving available releases for Kona took'); // eslint-disable-line no-console
+                core.debug(availableReleases.map(item => item.version).join(', '));
+                core.endGroup();
+            }
+            return availableReleases;
+        });
+    }
+    fetchReleaseInfo() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const releasesInfoUrl = 'https://tencent.github.io/konajdk/releases/kona-v1.json';
+            try {
+                core.debug(`Fetching Kona release info from URL: ${releasesInfoUrl}`);
+                return (yield this.http.getJson(releasesInfoUrl))
+                    .result;
+            }
+            catch (err) {
+                core.debug(`Fetching Kona release info from the URL: ${releasesInfoUrl} failed with the error: ${err.message}`);
+                return null;
+            }
+        });
+    }
+    chooseReleases(os, arch, releaseInfo) {
+        const releases = [];
+        for (const majorVersion in releaseInfo) {
+            const versions = releaseInfo[majorVersion];
+            for (const version of versions) {
+                if (!version.latest) {
+                    continue;
+                }
+                for (const file of version.files) {
+                    if (file.os === os && file.arch === arch) {
+                        releases.push({
+                            version: version.version,
+                            jdkVersion: version.jdkVersion,
+                            os: os,
+                            arch: arch,
+                            downloadUrl: version.baseUrl + file.filename,
+                            checksum: file.checksum
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+        return releases;
+    }
+    getOs() {
+        switch (process.platform) {
+            case 'darwin':
+                return 'macos';
+            case 'win32':
+                return 'windows';
+            default:
+                return process.platform;
+        }
+    }
+    getArch() {
+        switch (this.architecture) {
+            case 'arm64':
+                return 'aarch64';
+            case 'x64':
+                return 'x86_64';
+            default:
+                return this.architecture;
+        }
+    }
+}
+exports.KonaDistribution = KonaDistribution;
+
+
 /***/ }),
 
 /***/ 32063:
@@ -79912,21 +80112,38 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.MicrosoftDistributions = void 0;
+exports.MicrosoftDistributions = exports.MICROSOFT_PUBLIC_KEY = void 0;
 const base_installer_1 = __nccwpck_require__(79935);
 const util_1 = __nccwpck_require__(54527);
+const gpg = __importStar(__nccwpck_require__(88343));
+const microsoft_key_1 = __nccwpck_require__(56286);
 const core = __importStar(__nccwpck_require__(37484));
 const tc = __importStar(__nccwpck_require__(33472));
 const fs_1 = __importDefault(__nccwpck_require__(79896));
 const path_1 = __importDefault(__nccwpck_require__(16928));
+var microsoft_key_2 = __nccwpck_require__(56286);
+Object.defineProperty(exports, "MICROSOFT_PUBLIC_KEY", ({ enumerable: true, get: function () { return microsoft_key_2.MICROSOFT_PUBLIC_KEY; } }));
 class MicrosoftDistributions extends base_installer_1.JavaBase {
     constructor(installerOptions) {
         super('Microsoft', installerOptions);
     }
     downloadTool(javaRelease) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             core.info(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
             let javaArchivePath = yield tc.downloadTool(javaRelease.url);
+            if (this.verifySignature) {
+                if (!javaRelease.signatureUrl) {
+                    throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`);
+                }
+                core.info(`Verifying Java package signature...`);
+                try {
+                    yield gpg.verifyPackageSignature(javaArchivePath, javaRelease.signatureUrl, (_a = this.verifySignaturePublicKey) !== null && _a !== void 0 ? _a : microsoft_key_1.MICROSOFT_PUBLIC_KEY);
+                }
+                catch (error) {
+                    throw new Error(`Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${error.message}`);
+                }
+            }
             core.info(`Extracting Java archive...`);
             const extension = (0, util_1.getDownloadArchiveExtension)();
             if (process.platform === 'win32') {
@@ -79940,6 +80157,7 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
         });
     }
     findPackageForDownload(range) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             const arch = this.distributionArchitecture();
             if (arch !== 'x64' && arch !== 'aarch64') {
@@ -79960,12 +80178,18 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
                 const availableVersionStrings = manifest.map(item => item.version);
                 throw this.createVersionNotFoundError(range, availableVersionStrings);
             }
+            const file = foundRelease.files[0];
+            const signatureUrl = (_a = file.signature_url) !== null && _a !== void 0 ? _a : `${file.download_url}.sig`;
             return {
-                url: foundRelease.files[0].download_url,
+                url: file.download_url,
+                signatureUrl,
                 version: foundRelease.version
             };
         });
     }
+    supportsSignatureVerification() {
+        return true;
+    }
     getAvailableVersions() {
         return __awaiter(this, void 0, void 0, function* () {
             // TODO get these dynamically!
@@ -80008,6 +80232,38 @@ class MicrosoftDistributions extends base_installer_1.JavaBase {
 exports.MicrosoftDistributions = MicrosoftDistributions;
 
 
+/***/ }),
+
+/***/ 56286:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.MICROSOFT_PUBLIC_KEY = void 0;
+// Microsoft Build of OpenJDK GPG signing key
+// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
+exports.MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: BSN Pgp v1.1.0.0
+
+mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
+RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
+UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
+/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
+r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
+fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
+IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
+CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
+icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
+MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
+EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
+yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
+JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
+Fa133tP85xzJEq1XeXm8WeLFo2wV
+=rHCS
+-----END PGP PUBLIC KEY BLOCK-----`;
+
+
 /***/ }),
 
 /***/ 11182:
@@ -80558,6 +80814,50 @@ class SemeruDistribution extends base_installer_1.JavaBase {
 exports.SemeruDistribution = SemeruDistribution;
 
 
+/***/ }),
+
+/***/ 80877:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ADOPTIUM_PUBLIC_KEY = void 0;
+// Adoptium GPG signing key (fingerprint: 3B04D753C9050D9A5D343F39843C48A565F8F04B)
+// Retrieved from: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3B04D753C9050D9A5D343F39843C48A565F8F04B
+exports.ADOPTIUM_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsBNBGGTvTQBCAC6ey144n7CG8foafF6mwgIBN1fIm1ILZDuGS4tMr0/XI8pgJnT
+QvsPxZWEvtSm7bEMObzEoZJcXwjBcJl1B0ui8k5kHMTI75gCmZPsoKLFWIEpuRBQ
+PBocusw80apDmLnNDQLVQvDFtEua5gaNa/fRw9YsmBoXBqvgrjFUIdGyWoQvH5+a
+9OYlWD9n5VV0gnVMb+aclwVzB/zJw3kHGSgzuMtlAHeQiah7Y8yomQn/UIX8yqDf
++11sP3+c87YcjkRqImRTtmKEDcEtGPAIXC6SYA+uEEkbYE0Fy0chkvtnVWJ597fa
+Epai4rnICU8zoJ6X5z3v1aM2WerhX9oq9X8PABEBAAHNQEFkb3B0aXVtIEdQRyBL
+ZXkgKERFQi9SUE0gU2lnbmluZyBLZXkpIDx0ZW11cmluLWRldkBlY2xpcHNlLm9y
+Zz7CwJIEEwEIADwWIQQ7BNdTyQUNml00PzmEPEilZfjwSwUCYZO9NAIbAwULCQgH
+AgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQhDxIpWX48Et4AggAjjJzYWuKV3nG
+7ngInngl8G/m9JoHr7BmwgcQXYhdy5hVkMcUx5JLeXz2LMBUH/F2nD595hgjMabk
+kVib20X8lq9RsNbdfc2hBcWU6qyHKxsIqT4boI2/XDyEzzMyyZWWNGo/27Ci7Xmj
+pWu31nh0pDdPqdyWDIKojbVVnxlCRY8as8Sm+1ufi709KCi4MuwHNsUlCSwb/fju
+NKeHkrHbLcHKUUIEcmTSKRWrpMYBzm1HYOGBz4xPuELwUfUp71ehfoyBZlp6RDRf
+l5TYI1FmCyHuvjNhrJgWv7bOTcf8yObGY+TEUhzc4xQqCrF4ur9d3opvsuPBQsv+
+Klqi5KSZgs7ATQRhk700AQgAq14okly8cFrpYVenEQPiB75AUZfKRpMduiR6IxAj
+SKcH7aSoFZ9AubUEBVpZsyT5svxoEPe1i4TdbF+m9FGy42EcOlLa3ArLTj5H8FRl
+UdGZB9I5mk4GptOzPM+aHMMu92vW/ZwjuS8DvOiQSp+cUmG1EqOMJSM7e/4BM71z
+E+OKaVJCj79pEzhG3SK/IC/OlxxyETT66NSfYJd7Sw5R6Vr19am/uNU690W0CJ+q
+VQeFpmDMr7LnfdFRIh+lJe05+PvWXeidkGjox5cbG52wf8aRIR/FgkfcFvqRMN1f
+B+dVOWueloUeVAnzcUznOKmUEs7LP9ObJhYHHgup4IAU2wARAQABwsB2BBgBCAAg
+FiEEOwTXU8kFDZpdND85hDxIpWX48EsFAmGTvTQCGwwACgkQhDxIpWX48EvXHQf/
+Q0nZsGDXnZHiBoojeSdpkO7WBjMIP3w1GdLvRpPQrS8TfOPbZuoevzCNh38Y3gwF
+yelJspvzDQrBXhgkzAGlucYg8Y7KHa5Ebm7iDgMzc37L1hYSZTYCqwd7aowfgy34
+hOk3B67LffkJpIh738Oa9CtlwxQ9xcytmBmQ1fBBOwm/9IhAwHPQuydYIs4DxWbj
+0MGSP4fDntU7e4UjsHNmhudDcYol0FaqdHHIIB9C/G4CzetRwHFOn3b4JwXMU7YU
+6aJA3mXhi3hggMC3wkT2HHZ/TquuOdNc02fypWOCDOHz0alBBJNqoVUNFNqU3tfJ
+wI4qF/KKq9BfyfucAs0ykA==
+=XLag
+-----END PGP PUBLIC KEY BLOCK-----`;
+
+
 /***/ }),
 
 /***/ 91986:
@@ -80601,14 +80901,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.TemurinDistribution = exports.TemurinImplementation = void 0;
+exports.TemurinDistribution = exports.TemurinImplementation = exports.ADOPTIUM_PUBLIC_KEY = void 0;
 const core = __importStar(__nccwpck_require__(37484));
 const tc = __importStar(__nccwpck_require__(33472));
 const fs_1 = __importDefault(__nccwpck_require__(79896));
 const path_1 = __importDefault(__nccwpck_require__(16928));
 const semver_1 = __importDefault(__nccwpck_require__(62088));
+const gpg = __importStar(__nccwpck_require__(88343));
+const adoptium_key_1 = __nccwpck_require__(80877);
 const base_installer_1 = __nccwpck_require__(79935);
 const util_1 = __nccwpck_require__(54527);
+var adoptium_key_2 = __nccwpck_require__(80877);
+Object.defineProperty(exports, "ADOPTIUM_PUBLIC_KEY", ({ enumerable: true, get: function () { return adoptium_key_2.ADOPTIUM_PUBLIC_KEY; } }));
 var TemurinImplementation;
 (function (TemurinImplementation) {
     TemurinImplementation["Hotspot"] = "Hotspot";
@@ -80633,7 +80937,8 @@ class TemurinDistribution extends base_installer_1.JavaBase {
                     : item.version_data.semver.replace('-beta+', '+');
                 return {
                     version: formattedVersion,
-                    url: item.binaries[0].package.link
+                    url: item.binaries[0].package.link,
+                    signatureUrl: item.binaries[0].package.signature_link
                 };
             });
             const satisfiedVersions = availableVersionsWithBinaries
@@ -80650,9 +80955,22 @@ class TemurinDistribution extends base_installer_1.JavaBase {
         });
     }
     downloadTool(javaRelease) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             core.info(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
             let javaArchivePath = yield tc.downloadTool(javaRelease.url);
+            if (this.verifySignature) {
+                if (!javaRelease.signatureUrl) {
+                    throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Temurin version ${javaRelease.version}.`);
+                }
+                core.info(`Verifying Java package signature...`);
+                try {
+                    yield gpg.verifyPackageSignature(javaArchivePath, javaRelease.signatureUrl, (_a = this.verifySignaturePublicKey) !== null && _a !== void 0 ? _a : adoptium_key_1.ADOPTIUM_PUBLIC_KEY);
+                }
+                catch (error) {
+                    throw new Error(`Failed to verify signature for Temurin version ${javaRelease.version} from ${javaRelease.signatureUrl}: ${error.message}`);
+                }
+            }
             core.info(`Extracting Java archive...`);
             const extension = (0, util_1.getDownloadArchiveExtension)();
             if (process.platform === 'win32') {
@@ -80669,6 +80987,9 @@ class TemurinDistribution extends base_installer_1.JavaBase {
     get toolcacheFolderName() {
         return super.toolcacheFolderName;
     }
+    supportsSignatureVerification() {
+        return true;
+    }
     getAvailableVersions() {
         return __awaiter(this, void 0, void 0, function* () {
             const platform = this.getPlatformOption();
@@ -80961,14 +81282,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.deleteKey = exports.importKey = exports.PRIVATE_KEY_FILE = void 0;
+exports.verifyPackageSignature = exports.deleteKey = exports.importKey = exports.toGpgPath = exports.PRIVATE_KEY_FILE = void 0;
 const fs = __importStar(__nccwpck_require__(79896));
 const path = __importStar(__nccwpck_require__(16928));
 const io = __importStar(__nccwpck_require__(94994));
 const exec = __importStar(__nccwpck_require__(95236));
+const tc = __importStar(__nccwpck_require__(33472));
 const util = __importStar(__nccwpck_require__(54527));
 exports.PRIVATE_KEY_FILE = path.join(util.getTempDir(), 'private-key.asc');
 const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
+// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
+// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
+// internally. Passing Windows paths with backslashes can cause fatal GPG errors
+// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
+function toGpgPath(p) {
+    if (process.platform !== 'win32')
+        return p;
+    return p
+        .replace(/\\/g, '/')
+        .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
+}
+exports.toGpgPath = toGpgPath;
 function importKey(privateKey) {
     return __awaiter(this, void 0, void 0, function* () {
         fs.writeFileSync(exports.PRIVATE_KEY_FILE, privateKey, {
@@ -81005,6 +81339,130 @@ function deleteKey(keyFingerprint) {
     });
 }
 exports.deleteKey = deleteKey;
+function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const signaturePath = yield tc.downloadTool(signatureUrl);
+        let gpgHome;
+        try {
+            gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
+        }
+        catch (error) {
+            try {
+                yield io.rmRF(signaturePath);
+            }
+            catch (_a) {
+                // ignore cleanup failures
+            }
+            throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
+        }
+        try {
+            const publicKeyFile = path.join(gpgHome, 'public-key.asc');
+            fs.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
+            const options = { silent: true };
+            yield exec.exec('gpg', [
+                '--homedir',
+                toGpgPath(gpgHome),
+                '--batch',
+                '--import',
+                toGpgPath(publicKeyFile)
+            ], options);
+            yield exec.exec('gpg', [
+                '--homedir',
+                toGpgPath(gpgHome),
+                '--batch',
+                '--verify',
+                toGpgPath(signaturePath),
+                toGpgPath(archivePath)
+            ], options);
+        }
+        finally {
+            yield io.rmRF(signaturePath);
+            yield io.rmRF(gpgHome);
+        }
+    });
+}
+exports.verifyPackageSignature = verifyPackageSignature;
+
+
+/***/ }),
+
+/***/ 38172:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.configureMavenArgs = void 0;
+const core = __importStar(__nccwpck_require__(37484));
+const util_1 = __nccwpck_require__(54527);
+const constants_1 = __nccwpck_require__(27242);
+/**
+ * Configures the MAVEN_ARGS environment variable so that Maven suppresses
+ * artifact transfer/download progress output by default, producing cleaner
+ * CI logs.
+ *
+ * Behavior:
+ * - When `show-download-progress` is `false` (the default), `-ntp`
+ *   (`--no-transfer-progress`) is appended to any existing MAVEN_ARGS value.
+ * - When `show-download-progress` is `true`, MAVEN_ARGS is left untouched so
+ *   the user's own configuration (and Maven's default progress output) is
+ *   preserved.
+ *
+ * The change is idempotent: if MAVEN_ARGS already disables transfer progress
+ * (via `-ntp` or `--no-transfer-progress`) nothing is added. Any pre-existing
+ * MAVEN_ARGS value is preserved.
+ *
+ * MAVEN_ARGS is honored by Maven 3.9.0+ and the Maven Wrapper; older Maven
+ * versions ignore it, so this is a no-op there. It has no effect on non-Maven
+ * builds such as Gradle or sbt.
+ */
+function configureMavenArgs() {
+    var _a;
+    const showDownloadProgress = (0, util_1.getBooleanInput)(constants_1.INPUT_SHOW_DOWNLOAD_PROGRESS, false);
+    if (showDownloadProgress) {
+        core.debug(`${constants_1.INPUT_SHOW_DOWNLOAD_PROGRESS} is true; leaving ${constants_1.MAVEN_ARGS_ENV} unchanged`);
+        return;
+    }
+    const existingArgs = ((_a = process.env[constants_1.MAVEN_ARGS_ENV]) !== null && _a !== void 0 ? _a : '').trim();
+    const alreadyDisabled = existingArgs
+        .split(/\s+/)
+        .some(arg => arg === constants_1.MAVEN_NO_TRANSFER_PROGRESS_FLAG ||
+        arg === constants_1.MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG);
+    if (alreadyDisabled) {
+        core.debug(`${constants_1.MAVEN_ARGS_ENV} already disables transfer progress; leaving it unchanged`);
+        return;
+    }
+    const updatedArgs = existingArgs
+        ? `${existingArgs} ${constants_1.MAVEN_NO_TRANSFER_PROGRESS_FLAG}`
+        : constants_1.MAVEN_NO_TRANSFER_PROGRESS_FLAG;
+    core.exportVariable(constants_1.MAVEN_ARGS_ENV, updatedArgs);
+    core.info(`Configured ${constants_1.MAVEN_ARGS_ENV} to include ${constants_1.MAVEN_NO_TRANSFER_PROGRESS_FLAG} to suppress Maven transfer progress logs. ` +
+        `Set '${constants_1.INPUT_SHOW_DOWNLOAD_PROGRESS}: true' to keep the download progress output.`);
+}
+exports.configureMavenArgs = configureMavenArgs;
 
 
 /***/ }),
@@ -81059,6 +81517,7 @@ const constants = __importStar(__nccwpck_require__(27242));
 const cache_1 = __nccwpck_require__(97377);
 const path = __importStar(__nccwpck_require__(16928));
 const distribution_factory_1 = __nccwpck_require__(2970);
+const maven_args_1 = __nccwpck_require__(38172);
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -81073,6 +81532,8 @@ function run() {
             const cache = core.getInput(constants.INPUT_CACHE);
             const cacheDependencyPath = core.getInput(constants.INPUT_CACHE_DEPENDENCY_PATH);
             const checkLatest = (0, util_1.getBooleanInput)(constants.INPUT_CHECK_LATEST, false);
+            const verifySignature = (0, util_1.getBooleanInput)(constants.INPUT_VERIFY_SIGNATURE, false);
+            const verifySignaturePublicKey = core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
             let toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
             core.startGroup('Installed distributions');
             if (versions.length !== toolchainIds.length) {
@@ -81085,6 +81546,8 @@ function run() {
                 architecture,
                 packageType,
                 checkLatest,
+                verifySignature,
+                verifySignaturePublicKey,
                 distributionName,
                 jdkFile,
                 toolchainIds
@@ -81106,6 +81569,7 @@ function run() {
             const matchersPath = path.join(__dirname, '..', '..', '.github');
             core.info(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);
             yield auth.configureAuthentication();
+            (0, maven_args_1.configureMavenArgs)();
             if (cache && (0, util_1.isCacheFeatureAvailable)()) {
                 yield (0, cache_1.restore)(cache, cacheDependencyPath);
             }
@@ -81118,11 +81582,13 @@ function run() {
 run();
 function installVersion(version, options, toolchainId = 0) {
     return __awaiter(this, void 0, void 0, function* () {
-        const { distributionName, jdkFile, architecture, packageType, checkLatest, toolchainIds } = options;
+        const { distributionName, jdkFile, architecture, packageType, checkLatest, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
         const installerOptions = {
             architecture,
             packageType,
             checkLatest,
+            verifySignature,
+            verifySignaturePublicKey,
             version
         };
         const distribution = (0, distribution_factory_1.getJavaDistribution)(distributionName, installerOptions, jdkFile);
@@ -81224,46 +81690,66 @@ function createToolchainsSettings({ jdkInfo, settingsDirectory, overwriteSetting
 exports.createToolchainsSettings = createToolchainsSettings;
 // only exported for testing purposes
 function generateToolchainDefinition(original, version, vendor, id, jdkHome) {
-    let xmlObj;
+    let jsToolchains = [
+        {
+            type: 'jdk',
+            provides: {
+                version: `${version}`,
+                vendor: `${vendor}`,
+                id: `${id}`
+            },
+            configuration: {
+                jdkHome: `${jdkHome}`
+            }
+        }
+    ];
+    // default root attributes, used when the existing file does not declare its own
+    let rootAttributes = {
+        '@xmlns': 'http://maven.apache.org/TOOLCHAINS/1.1.0',
+        '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
+        '@xsi:schemaLocation': 'http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd'
+    };
     if (original === null || original === void 0 ? void 0 : original.length) {
-        xmlObj = (0, xmlbuilder2_1.create)(original)
+        // convert existing toolchains into TS native objects for better handling
+        // xmlbuilder2 will convert the document into a `{toolchains: { toolchain: [] | {} }}` structure
+        // instead of the desired `toolchains: [{}]` one or simply `[{}]`
+        const jsObj = (0, xmlbuilder2_1.create)(original)
             .root()
-            .ele({
+            .toObject();
-            toolchain: {
+        if (jsObj.toolchains) {
-                type: 'jdk',
+            // preserve the existing root attributes (xmlns, schemaLocation, …) so we don't
-                provides: {
+            // silently rewrite user-managed metadata or change the effective XML namespace;
-                    version: `${version}`,
+            // xmlbuilder2 exposes attributes as `@`-prefixed keys on the element object
-                    vendor: `${vendor}`,
+            const existingAttributes = Object.fromEntries(Object.entries(jsObj.toolchains).filter(([key]) => key.startsWith('@')));
-                    id: `${id}`
+            // fall back to the defaults only for attributes the existing file is missing
-                },
+            rootAttributes = Object.assign(Object.assign({}, rootAttributes), existingAttributes);
-                configuration: {
+            if (jsObj.toolchains.toolchain) {
-                    jdkHome: `${jdkHome}`
+                // in case only a single child exists xmlbuilder2 will not create an array and using verbose = true equally doesn't work here
+                // See https://oozcitak.github.io/xmlbuilder2/serialization.html#js-object-and-map-serializers for details
+                if (Array.isArray(jsObj.toolchains.toolchain)) {
+                    jsToolchains.push(...jsObj.toolchains.toolchain);
+                }
+                else {
+                    jsToolchains.push(jsObj.toolchains.toolchain);
                 }
             }
+        }
+        // remove potential duplicates based on type & id (which should be a unique combination);
+        // self.findIndex will only return the first occurrence, ensuring duplicates are skipped
+        jsToolchains = jsToolchains.filter((value, index, self) => {
+            var _a;
+            // ensure non-jdk toolchains are kept in the results, we must not touch them because they belong to the user
+            return value.type !== 'jdk' ||
+                // keep toolchains that lack a usable string id (e.g. partially-formed user files);
+                // we cannot safely deduplicate them and must not crash while reading them
+                typeof ((_a = value.provides) === null || _a === void 0 ? void 0 : _a.id) !== 'string' ||
+                index ===
+                    self.findIndex(t => { var _a, _b; return t.type === value.type && ((_a = t.provides) === null || _a === void 0 ? void 0 : _a.id) === ((_b = value.provides) === null || _b === void 0 ? void 0 : _b.id); });
         });
     }
-    else
+    return (0, xmlbuilder2_1.create)({
-        xmlObj = (0, xmlbuilder2_1.create)({
+        toolchains: Object.assign(Object.assign({}, rootAttributes), { toolchain: jsToolchains })
-            toolchains: {
+    }).end({
-                '@xmlns': 'http://maven.apache.org/TOOLCHAINS/1.1.0',
-                '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
-                '@xsi:schemaLocation': 'http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd',
-                toolchain: [
-                    {
-                        type: 'jdk',
-                        provides: {
-                            version: `${version}`,
-                            vendor: `${vendor}`,
-                            id: `${id}`
-                        },
-                        configuration: {
-                            jdkHome: `${jdkHome}`
-                        }
-                    }
-                ]
-            }
-        });
-    return xmlObj.end({
         format: 'xml',
         wellFormed: false,
         headless: false,

docs/advanced-usage.md

@@ -12,6 +12,7 @@
   - [GraalVM](#GraalVM)
   - [GraalVM Community](#GraalVM-Community)
   - [JetBrains](#JetBrains)
+  - [Tencent Kona](#Tencent-Kona)
 - [Installing custom Java package type](#Installing-custom-Java-package-type)
   - [JavaFX Maven project](#JavaFX-Maven-project)
 - [Installing custom Java architecture](#Installing-custom-Java-architecture)
@@ -19,6 +20,7 @@
 - [Testing against different Java distributions](#Testing-against-different-Java-distributions)
 - [Testing against different platforms](#Testing-against-different-platforms)
 - [Publishing using Apache Maven](#Publishing-using-Apache-Maven)
+- [Maven transfer progress (download logs)](#Maven-transfer-progress-download-logs)
 - [Publishing using Gradle](#Publishing-using-Gradle)
 - [Hosted Tool Cache](#Hosted-Tool-Cache)
 - [Modifying Maven Toolchains](#Modifying-Maven-Toolchains)
@@ -233,6 +235,18 @@ The available package types are:
 - `jdk+ft` - JBRSDK (FreeType)
 - `jre+ft` - JBR (FreeType)
 
+### Tencent Kona
+**NOTE:** Tencent Kona supports major versions 8, 11, 17 and 21, and provides jdk only.
+
+```yaml
+steps:
+- uses: actions/checkout@v6
+- uses: actions/setup-java@v5
+  with:
+    distribution: 'kona'
+    java-version: '21'
+- run: java --version
+```
 
 ## Installing custom Java package type
 ```yaml
@@ -436,6 +450,7 @@ The two `settings.xml` files created from the above example look like the follow
 <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
   <servers>
     <server>
       <id>github</id>
@@ -455,6 +470,7 @@ The two `settings.xml` files created from the above example look like the follow
 <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
   <servers>
     <server>
       <id>maven</id>
@@ -526,6 +542,36 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
 ```
 
+## Maven transfer progress (download logs)
+
+By default, Maven prints a line for every artifact it downloads, which can add hundreds of noisy lines to CI logs. To keep logs clean, `setup-java` sets the [`MAVEN_ARGS`](https://maven.apache.org/configure.html#maven_args-environment-variable) environment variable to include `-ntp` (`--no-transfer-progress`) so that subsequent Maven invocations in the job suppress this transfer progress output.
+
+This is enabled by default. Any existing `MAVEN_ARGS` value is preserved (the flag is appended, not overwritten), and the flag is not added twice if you already set it yourself.
+
+If you want to keep the download/transfer progress in your logs, set `show-download-progress: true`:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v6
+    - uses: actions/setup-java@v5
+      with:
+        distribution: '<distribution>'
+        java-version: '21'
+        show-download-progress: true # keep Maven download/transfer progress in the logs
+
+    - name: Build with Maven
+      run: mvn -B package --file pom.xml
+```
+
+***NOTES***:
+- `MAVEN_ARGS` is honored by Maven 3.9.0+ and the Maven Wrapper (`mvnw`). Older Maven versions ignore it, so on those you can pass `--no-transfer-progress` on the command line instead.
+- This setting only affects Maven. It has no effect on Gradle, sbt, or other build tools.
+- `-ntp` only controls transfer/progress output; it does not change whether Maven runs in batch mode. Use `-B`/`--batch-mode` (or `<interactiveMode>false</interactiveMode>` in `settings.xml`) if you also want non-interactive runs.
+
 ## Publishing using Gradle
 ```yaml
 jobs:

docs/contributors.md

@@ -63,6 +63,17 @@ Pull requests are the easiest way to contribute changes to git repos at GitHub.
 - To lint the code, **you need to run the `lint:fix` script**
 - To transpile source code to `javascript` we use [NCC](https://github.com/vercel/ncc). **It is very important to run the `build` script after making changes**, otherwise your changes will not get into the final `javascript` build
 
+> [!TIP]
+> Instead of running each script individually, you can run the aggregate scripts:
+>
+> - `npm run fix` — formats, lints (with autofix) and rebuilds the `dist/` bundle.
+> - `npm run check` — runs the same validation as CI: `format-check`, `lint`, `build` and `test`. **Run this before pushing a pull request** to make sure it will pass the required checks.
+>
+> Git hooks are installed automatically when you run `npm install` (via [husky](https://typicode.github.io/husky/)):
+>
+> - a **pre-commit** hook formats and lints staged files with [lint-staged](https://github.com/lint-staged/lint-staged);
+> - a **pre-push** hook rebuilds `dist/` and runs the test suite.
+
 **Learn more about how to implement tests:**
 
 Adding or changing tests is an integral part of making a change to the code. 

eslint.config.mjs

@@ -1,83 +0,0 @@
-import js from '@eslint/js';
-import tseslint from 'typescript-eslint';
-import jestPlugin from 'eslint-plugin-jest';
-import nodePlugin from 'eslint-plugin-n';
-import eslintConfigPrettier from 'eslint-config-prettier';
-import globals from 'globals';
-
-export default tseslint.config(
-  {
-    ignores: [
-      'dist/',
-      'lib/',
-      'node_modules/',
-      'coverage/',
-      '**/*.js',
-      '**/*.cjs',
-      '**/*.mjs',
-      '**/*.d.ts'
-    ]
-  },
-  {
-    files: ['src/**/*.ts', '__tests__/**/*.ts'],
-    extends: [
-      js.configs.recommended,
-      ...tseslint.configs.recommended,
-      jestPlugin.configs['flat/recommended'],
-      eslintConfigPrettier
-    ],
-    plugins: {
-      n: nodePlugin
-    },
-    languageOptions: {
-      ecmaVersion: 2021,
-      sourceType: 'module',
-      globals: {
-        ...globals.node,
-        ...globals.es2021
-      }
-    },
-    rules: {
-      '@typescript-eslint/no-require-imports': 'error',
-      '@typescript-eslint/no-non-null-assertion': 'off',
-      '@typescript-eslint/no-explicit-any': 'off',
-      '@typescript-eslint/no-empty-function': 'off',
-      '@typescript-eslint/ban-ts-comment': [
-        'error',
-        {
-          'ts-ignore': 'allow-with-description'
-        }
-      ],
-      'no-console': 'error',
-      yoda: 'error',
-      'prefer-const': [
-        'error',
-        {
-          destructuring: 'all'
-        }
-      ],
-      'no-control-regex': 'off',
-      'no-constant-condition': ['error', {checkLoops: false}],
-      // ESLint 10's recommended set adds `preserve-caught-error`, which the
-      // previous ESLint 8 recommended config did not enable. Keep it off to
-      // preserve the prior lint behavior; adopting it would require attaching
-      // an Error `cause` (ES2022) and is out of scope for this upgrade.
-      'preserve-caught-error': 'off',
-      'n/no-extraneous-import': 'error'
-    }
-  },
-  {
-    files: ['**/*{test,spec}.ts'],
-    languageOptions: {
-      globals: {
-        ...globals.jest
-      }
-    },
-    rules: {
-      '@typescript-eslint/no-unused-vars': 'off',
-      'jest/no-standalone-expect': 'off',
-      'jest/no-conditional-expect': 'off',
-      'no-console': 'off'
-    }
-  }
-);

package.json

@@ -11,12 +11,24 @@
     "build": "ncc build -o dist/setup src/setup-java.ts && ncc build -o dist/cleanup src/cleanup-java.ts",
     "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
     "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
-    "lint": "eslint \"src/**/*.ts\" \"__tests__/**/*.ts\"",
+    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
-    "lint:fix": "eslint \"src/**/*.ts\" \"__tests__/**/*.ts\" --fix",
+    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
+    "check": "npm run format-check && npm run lint && npm run build && npm test",
+    "fix": "npm run format && npm run lint:fix && npm run build",
+    "prepare": "husky install",
     "prerelease": "npm run-script build",
     "release": "git add -f dist/setup/index.js dist/cleanup/index.js",
     "test": "jest"
   },
+  "lint-staged": {
+    "*.ts": [
+      "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write",
+      "eslint --config ./.eslintrc.js --fix"
+    ],
+    "*.{yml,yaml}": [
+      "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write"
+    ]
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/actions/setup-java.git"
@@ -40,22 +52,23 @@
     "xmlbuilder2": "^4.0.3"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.0.0",
     "@types/semver": "^7.5.8",
+    "@typescript-eslint/eslint-plugin": "^8.48.0",
+    "@typescript-eslint/parser": "^8.62.0",
     "@vercel/ncc": "^0.44.0",
-    "eslint": "^10.5.0",
+    "eslint": "^8.57.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jest": "^29.15.2",
+    "eslint-plugin-jest": "^29.15.4",
-    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-node": "^11.1.0",
-    "globals": "^17.7.0",
+    "husky": "^9.1.7",
     "jest": "^30.4.2",
     "jest-circus": "^30.4.2",
-    "prettier": "^3.6.2",
+    "lint-staged": "^17.0.8",
+    "prettier": "^3.9.1",
     "ts-jest": "^29.4.11",
-    "typescript": "^5.3.3",
+    "typescript": "^5.3.3"
-    "typescript-eslint": "^8.62.0"
   },
   "bugs": {
     "url": "https://github.com/actions/setup-java/issues"

src/auth.ts

@@ -80,6 +80,7 @@ export function generate(
       '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
       '@xsi:schemaLocation':
         'http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd',
+      interactiveMode: false,
       servers: {
         server: [
           {

src/constants.ts

@@ -6,6 +6,8 @@ export const INPUT_JAVA_PACKAGE = 'java-package';
 export const INPUT_DISTRIBUTION = 'distribution';
 export const INPUT_JDK_FILE = 'jdkFile';
 export const INPUT_CHECK_LATEST = 'check-latest';
+export const INPUT_VERIFY_SIGNATURE = 'verify-signature';
+export const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
 export const INPUT_SERVER_ID = 'server-id';
 export const INPUT_SERVER_USERNAME = 'server-username';
 export const INPUT_SERVER_PASSWORD = 'server-password';
@@ -28,5 +30,10 @@ export const MVN_SETTINGS_FILE = 'settings.xml';
 export const MVN_TOOLCHAINS_FILE = 'toolchains.xml';
 export const INPUT_MVN_TOOLCHAIN_ID = 'mvn-toolchain-id';
 export const INPUT_MVN_TOOLCHAIN_VENDOR = 'mvn-toolchain-vendor';
+export const INPUT_SHOW_DOWNLOAD_PROGRESS = 'show-download-progress';
+
+export const MAVEN_ARGS_ENV = 'MAVEN_ARGS';
+export const MAVEN_NO_TRANSFER_PROGRESS_FLAG = '-ntp';
+export const MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG = '--no-transfer-progress';
 
 export const DISTRIBUTIONS_ONLY_MAJOR_VERSION = ['corretto'];

src/distributions/base-installer.ts

@@ -20,6 +20,8 @@ export abstract class JavaBase {
   protected packageType: string;
   protected stable: boolean;
   protected checkLatest: boolean;
+  protected verifySignature: boolean;
+  protected verifySignaturePublicKey: string | undefined;
 
   constructor(
     protected distribution: string,
@@ -36,6 +38,8 @@ export abstract class JavaBase {
     this.architecture = installerOptions.architecture || os.arch();
     this.packageType = installerOptions.packageType;
     this.checkLatest = installerOptions.checkLatest;
+    this.verifySignature = installerOptions.verifySignature ?? false;
+    this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
   }
 
   protected abstract downloadTool(
@@ -46,6 +50,12 @@ export abstract class JavaBase {
   ): Promise<JavaDownloadRelease>;
 
   public async setupJava(): Promise<JavaInstallerResults> {
+    if (this.verifySignature && !this.supportsSignatureVerification()) {
+      throw new Error(
+        `Input 'verify-signature' is not supported for distribution '${this.distribution}'.`
+      );
+    }
+
     let foundJava = this.findInToolcache();
     if (foundJava && !this.checkLatest) {
       core.info(`Resolved Java ${foundJava.version} from tool-cache`);
@@ -179,6 +189,10 @@ export abstract class JavaBase {
     return `Java_${this.distribution}_${this.packageType}`;
   }
 
+  protected supportsSignatureVerification(): boolean {
+    return false;
+  }
+
   protected getToolcacheVersionName(version: string): string {
     if (!this.stable) {
       if (version.includes('+')) {

src/distributions/base-models.ts

@@ -3,6 +3,8 @@ export interface JavaInstallerOptions {
   architecture: string;
   packageType: string;
   checkLatest: boolean;
+  verifySignature?: boolean;
+  verifySignaturePublicKey?: string;
 }
 
 export interface JavaInstallerResults {
@@ -13,4 +15,5 @@ export interface JavaInstallerResults {
 export interface JavaDownloadRelease {
   version: string;
   url: string;
+  signatureUrl?: string;
 }

src/distributions/corretto/installer.ts

@@ -127,8 +127,7 @@ export class CorrettoDistribution extends JavaBase {
 
   private getAvailableVersionsForPlatform(
     eligibleVersions:
-      | ICorrettoAllAvailableVersions['os']['arch']['imageType']
+      ICorrettoAllAvailableVersions['os']['arch']['imageType'] | undefined
-      | undefined
   ): ICorrettoAvailableVersions[] {
     const availableVersions: ICorrettoAvailableVersions[] = [];
 

src/distributions/distribution-factory.ts

@@ -16,6 +16,7 @@ import {
   GraalVMDistribution
 } from './graalvm/installer';
 import {JetBrainsDistribution} from './jetbrains/installer';
+import {KonaDistribution} from './kona/installer';
 
 enum JavaDistribution {
   Adopt = 'adopt',
@@ -33,7 +34,8 @@ enum JavaDistribution {
   SapMachine = 'sapmachine',
   GraalVM = 'graalvm',
   GraalVMCommunity = 'graalvm-community',
-  JetBrains = 'jetbrains'
+  JetBrains = 'jetbrains',
+  Kona = 'kona'
 }
 
 export function getJavaDistribution(
@@ -82,6 +84,8 @@ export function getJavaDistribution(
       return new GraalVMCommunityDistribution(installerOptions);
     case JavaDistribution.JetBrains:
       return new JetBrainsDistribution(installerOptions);
+    case JavaDistribution.Kona:
+      return new KonaDistribution(installerOptions);
     default:
       return null;
   }

src/distributions/kona/installer.ts

@@ -0,0 +1,191 @@
+import * as core from '@actions/core';
+import * as tc from '@actions/tool-cache';
+import semver from 'semver';
+
+import fs from 'fs';
+import path from 'path';
+
+import {JavaBase} from '../base-installer';
+import {IKonaReleaseInfo, IKonaRelease} from './models';
+import {
+  JavaDownloadRelease,
+  JavaInstallerOptions,
+  JavaInstallerResults
+} from '../base-models';
+import {
+  extractJdkFile,
+  getDownloadArchiveExtension,
+  isVersionSatisfies,
+  renameWinArchive
+} from '../../util';
+
+export class KonaDistribution extends JavaBase {
+  constructor(installerOptions: JavaInstallerOptions) {
+    super('Kona', installerOptions);
+  }
+
+  protected async downloadTool(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JavaInstallerResults> {
+    core.info(
+      `Downloading Kona JDK ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`
+    );
+    const javaArchivePath = await tc.downloadTool(javaRelease.url);
+
+    core.info(`Extracting Java archive...`);
+
+    const extension = getDownloadArchiveExtension();
+    const archivePath =
+      process.platform === 'win32'
+        ? renameWinArchive(javaArchivePath)
+        : javaArchivePath;
+    const extractedJavaPath = await extractJdkFile(archivePath, extension);
+
+    const archiveName = fs.readdirSync(extractedJavaPath)[0];
+    const jdkDirectory = path.join(extractedJavaPath, archiveName);
+    const version = this.getToolcacheVersionName(javaRelease.version);
+
+    const javaPath = await tc.cacheDir(
+      jdkDirectory,
+      this.toolcacheFolderName,
+      version,
+      this.architecture
+    );
+
+    return {version: javaRelease.version, path: javaPath};
+  }
+
+  protected async findPackageForDownload(
+    version: string
+  ): Promise<JavaDownloadRelease> {
+    if (!this.stable) {
+      throw new Error('Kona provides stable releases only');
+    }
+
+    if (this.packageType !== 'jdk') {
+      throw new Error('Kona provides jdk only');
+    }
+
+    const availableReleases = await this.getAvailableReleases();
+    const releases = availableReleases
+      .filter(item => {
+        return isVersionSatisfies(version, item.version);
+      })
+      .map(item => {
+        return {
+          version: item.version,
+          url: item.downloadUrl
+        } as JavaDownloadRelease;
+      })
+      .sort((a, b) => -semver.compareBuild(a.version, b.version));
+
+    if (!releases.length) {
+      throw new Error(
+        `No Kona release for the specified version "${version}" on OS "${this.getOs()}" and arch "${this.getArch()}".`
+      );
+    }
+
+    return releases[0];
+  }
+
+  private async getAvailableReleases(): Promise<IKonaRelease[]> {
+    if (core.isDebug()) {
+      console.time('Retrieving available releases for Kona took'); // eslint-disable-line no-console
+    }
+
+    const releaseInfo = await this.fetchReleaseInfo();
+    if (!releaseInfo) {
+      throw new Error(`Couldn't fetch Kona release information`);
+    }
+
+    const availableReleases = this.chooseReleases(
+      this.getOs(),
+      this.getArch(),
+      releaseInfo
+    );
+
+    if (core.isDebug()) {
+      core.startGroup('Print information about available releases');
+      console.timeEnd('Retrieving available releases for Kona took'); // eslint-disable-line no-console
+      core.debug(availableReleases.map(item => item.version).join(', '));
+      core.endGroup();
+    }
+
+    return availableReleases;
+  }
+
+  private async fetchReleaseInfo(): Promise<IKonaReleaseInfo | null> {
+    const releasesInfoUrl =
+      'https://tencent.github.io/konajdk/releases/kona-v1.json';
+
+    try {
+      core.debug(`Fetching Kona release info from URL: ${releasesInfoUrl}`);
+      return (await this.http.getJson<IKonaReleaseInfo>(releasesInfoUrl))
+        .result;
+    } catch (err) {
+      core.debug(
+        `Fetching Kona release info from the URL: ${releasesInfoUrl} failed with the error: ${
+          (err as Error).message
+        }`
+      );
+      return null;
+    }
+  }
+
+  private chooseReleases(
+    os: string,
+    arch: string,
+    releaseInfo: IKonaReleaseInfo
+  ): IKonaRelease[] {
+    const releases: IKonaRelease[] = [];
+
+    for (const majorVersion in releaseInfo) {
+      const versions = releaseInfo[majorVersion];
+
+      for (const version of versions) {
+        if (!version.latest) {
+          continue;
+        }
+
+        for (const file of version.files) {
+          if (file.os === os && file.arch === arch) {
+            releases.push({
+              version: version.version,
+              jdkVersion: version.jdkVersion,
+              os: os,
+              arch: arch,
+              downloadUrl: version.baseUrl + file.filename,
+              checksum: file.checksum
+            });
+
+            break;
+          }
+        }
+      }
+    }
+
+    return releases;
+  }
+
+  private getOs(): string {
+    switch (process.platform) {
+      case 'darwin':
+        return 'macos';
+      case 'win32':
+        return 'windows';
+      default:
+        return process.platform;
+    }
+  }
+
+  private getArch(): string {
+    switch (this.architecture) {
+      case 'arm64':
+        return 'aarch64';
+      case 'x64':
+        return 'x86_64';
+      default:
+        return this.architecture;
+    }
+  }
+}

src/distributions/kona/models.ts

@@ -0,0 +1,25 @@
+export interface IKonaReleaseInfo {
+  [majorVersion: string]: {
+    version: string;
+    jdkVersion: string;
+    latest: boolean;
+
+    baseUrl: string;
+    files: {
+      os: string; // linux, macos, windows
+      arch: string; // x86_64, aarch64
+
+      filename: string;
+      checksum: string;
+    }[];
+  }[];
+}
+
+export interface IKonaRelease {
+  version: string;
+  jdkVersion: string;
+  os: string; // linux, macos, windows
+  arch: string; // x86_64, aarch64
+  downloadUrl: string;
+  checksum: string; // SHA-256 digest
+}

src/distributions/liberica/models.ts

@@ -4,11 +4,7 @@ export type Bitness = '32' | '64';
 export type ArchType = 'arm' | 'ppc' | 'sparc' | 'x86';
 
 export type OsVersions =
-  | 'linux'
+  'linux' | 'linux-musl' | 'macos' | 'solaris' | 'windows';
-  | 'linux-musl'
-  | 'macos'
-  | 'solaris'
-  | 'windows';
 
 export interface ArchitectureOptions {
   bitness: Bitness;

src/distributions/microsoft/installer.ts

@@ -10,12 +10,16 @@ import {
   getGitHubHttpHeaders,
   renameWinArchive
 } from '../../util';
+import * as gpg from '../../gpg';
+import {MICROSOFT_PUBLIC_KEY} from './microsoft-key';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
 import fs from 'fs';
 import path from 'path';
 import {TypedResponse} from '@actions/http-client/lib/interfaces';
 
+export {MICROSOFT_PUBLIC_KEY} from './microsoft-key';
+
 export class MicrosoftDistributions extends JavaBase {
   constructor(installerOptions: JavaInstallerOptions) {
     super('Microsoft', installerOptions);
@@ -29,6 +33,26 @@ export class MicrosoftDistributions extends JavaBase {
     );
     let javaArchivePath = await tc.downloadTool(javaRelease.url);
 
+    if (this.verifySignature) {
+      if (!javaRelease.signatureUrl) {
+        throw new Error(
+          `Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`
+        );
+      }
+      core.info(`Verifying Java package signature...`);
+      try {
+        await gpg.verifyPackageSignature(
+          javaArchivePath,
+          javaRelease.signatureUrl,
+          this.verifySignaturePublicKey ?? MICROSOFT_PUBLIC_KEY
+        );
+      } catch (error) {
+        throw new Error(
+          `Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${(error as Error).message}`
+        );
+      }
+    }
+
     core.info(`Extracting Java archive...`);
     const extension = getDownloadArchiveExtension();
     if (process.platform === 'win32') {
@@ -80,12 +104,23 @@ export class MicrosoftDistributions extends JavaBase {
       throw this.createVersionNotFoundError(range, availableVersionStrings);
     }
 
+    const file = foundRelease.files[0] as {
+      download_url: string;
+      signature_url?: string;
+    };
+    const signatureUrl = file.signature_url ?? `${file.download_url}.sig`;
+
     return {
-      url: foundRelease.files[0].download_url,
+      url: file.download_url,
+      signatureUrl,
       version: foundRelease.version
     };
   }
 
+  protected supportsSignatureVerification(): boolean {
+    return true;
+  }
+
   private async getAvailableVersions(): Promise<tc.IToolRelease[] | null> {
     // TODO get these dynamically!
     // We will need Microsoft to add an endpoint where we can query for versions.

src/distributions/microsoft/microsoft-key.ts

@@ -0,0 +1,21 @@
+// Microsoft Build of OpenJDK GPG signing key
+// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
+export const MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: BSN Pgp v1.1.0.0
+
+mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
+RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
+UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
+/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
+r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
+fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
+IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
+CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
+icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
+MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
+EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
+yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
+JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
+Fa133tP85xzJEq1XeXm8WeLFo2wV
+=rHCS
+-----END PGP PUBLIC KEY BLOCK-----`;

src/distributions/temurin/adoptium-key.ts

@@ -0,0 +1,33 @@
+// Adoptium GPG signing key (fingerprint: 3B04D753C9050D9A5D343F39843C48A565F8F04B)
+// Retrieved from: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3B04D753C9050D9A5D343F39843C48A565F8F04B
+export const ADOPTIUM_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsBNBGGTvTQBCAC6ey144n7CG8foafF6mwgIBN1fIm1ILZDuGS4tMr0/XI8pgJnT
+QvsPxZWEvtSm7bEMObzEoZJcXwjBcJl1B0ui8k5kHMTI75gCmZPsoKLFWIEpuRBQ
+PBocusw80apDmLnNDQLVQvDFtEua5gaNa/fRw9YsmBoXBqvgrjFUIdGyWoQvH5+a
+9OYlWD9n5VV0gnVMb+aclwVzB/zJw3kHGSgzuMtlAHeQiah7Y8yomQn/UIX8yqDf
++11sP3+c87YcjkRqImRTtmKEDcEtGPAIXC6SYA+uEEkbYE0Fy0chkvtnVWJ597fa
+Epai4rnICU8zoJ6X5z3v1aM2WerhX9oq9X8PABEBAAHNQEFkb3B0aXVtIEdQRyBL
+ZXkgKERFQi9SUE0gU2lnbmluZyBLZXkpIDx0ZW11cmluLWRldkBlY2xpcHNlLm9y
+Zz7CwJIEEwEIADwWIQQ7BNdTyQUNml00PzmEPEilZfjwSwUCYZO9NAIbAwULCQgH
+AgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQhDxIpWX48Et4AggAjjJzYWuKV3nG
+7ngInngl8G/m9JoHr7BmwgcQXYhdy5hVkMcUx5JLeXz2LMBUH/F2nD595hgjMabk
+kVib20X8lq9RsNbdfc2hBcWU6qyHKxsIqT4boI2/XDyEzzMyyZWWNGo/27Ci7Xmj
+pWu31nh0pDdPqdyWDIKojbVVnxlCRY8as8Sm+1ufi709KCi4MuwHNsUlCSwb/fju
+NKeHkrHbLcHKUUIEcmTSKRWrpMYBzm1HYOGBz4xPuELwUfUp71ehfoyBZlp6RDRf
+l5TYI1FmCyHuvjNhrJgWv7bOTcf8yObGY+TEUhzc4xQqCrF4ur9d3opvsuPBQsv+
+Klqi5KSZgs7ATQRhk700AQgAq14okly8cFrpYVenEQPiB75AUZfKRpMduiR6IxAj
+SKcH7aSoFZ9AubUEBVpZsyT5svxoEPe1i4TdbF+m9FGy42EcOlLa3ArLTj5H8FRl
+UdGZB9I5mk4GptOzPM+aHMMu92vW/ZwjuS8DvOiQSp+cUmG1EqOMJSM7e/4BM71z
+E+OKaVJCj79pEzhG3SK/IC/OlxxyETT66NSfYJd7Sw5R6Vr19am/uNU690W0CJ+q
+VQeFpmDMr7LnfdFRIh+lJe05+PvWXeidkGjox5cbG52wf8aRIR/FgkfcFvqRMN1f
+B+dVOWueloUeVAnzcUznOKmUEs7LP9ObJhYHHgup4IAU2wARAQABwsB2BBgBCAAg
+FiEEOwTXU8kFDZpdND85hDxIpWX48EsFAmGTvTQCGwwACgkQhDxIpWX48EvXHQf/
+Q0nZsGDXnZHiBoojeSdpkO7WBjMIP3w1GdLvRpPQrS8TfOPbZuoevzCNh38Y3gwF
+yelJspvzDQrBXhgkzAGlucYg8Y7KHa5Ebm7iDgMzc37L1hYSZTYCqwd7aowfgy34
+hOk3B67LffkJpIh738Oa9CtlwxQ9xcytmBmQ1fBBOwm/9IhAwHPQuydYIs4DxWbj
+0MGSP4fDntU7e4UjsHNmhudDcYol0FaqdHHIIB9C/G4CzetRwHFOn3b4JwXMU7YU
+6aJA3mXhi3hggMC3wkT2HHZ/TquuOdNc02fypWOCDOHz0alBBJNqoVUNFNqU3tfJ
+wI4qF/KKq9BfyfucAs0ykA==
+=XLag
+-----END PGP PUBLIC KEY BLOCK-----`;

src/distributions/temurin/installer.ts

@@ -4,7 +4,9 @@ import * as tc from '@actions/tool-cache';
 import fs from 'fs';
 import path from 'path';
 import semver from 'semver';
+import * as gpg from '../../gpg';
 
+import {ADOPTIUM_PUBLIC_KEY} from './adoptium-key';
 import {JavaBase} from '../base-installer';
 import {ITemurinAvailableVersions} from './models';
 import {
@@ -22,6 +24,8 @@ import {
   validatePaginationUrl
 } from '../../util';
 
+export {ADOPTIUM_PUBLIC_KEY} from './adoptium-key';
+
 export enum TemurinImplementation {
   Hotspot = 'Hotspot'
 }
@@ -50,7 +54,8 @@ export class TemurinDistribution extends JavaBase {
           : item.version_data.semver.replace('-beta+', '+');
         return {
           version: formattedVersion,
-          url: item.binaries[0].package.link
+          url: item.binaries[0].package.link,
+          signatureUrl: item.binaries[0].package.signature_link
         } as JavaDownloadRelease;
       });
 
@@ -80,6 +85,28 @@ export class TemurinDistribution extends JavaBase {
     );
     let javaArchivePath = await tc.downloadTool(javaRelease.url);
 
+    if (this.verifySignature) {
+      if (!javaRelease.signatureUrl) {
+        throw new Error(
+          `Input 'verify-signature' is enabled, but no signature URL was found for Temurin version ${javaRelease.version}.`
+        );
+      }
+      core.info(`Verifying Java package signature...`);
+      try {
+        await gpg.verifyPackageSignature(
+          javaArchivePath,
+          javaRelease.signatureUrl,
+          this.verifySignaturePublicKey ?? ADOPTIUM_PUBLIC_KEY
+        );
+      } catch (error) {
+        throw new Error(
+          `Failed to verify signature for Temurin version ${javaRelease.version} from ${javaRelease.signatureUrl}: ${
+            (error as Error).message
+          }`
+        );
+      }
+    }
+
     core.info(`Extracting Java archive...`);
     const extension = getDownloadArchiveExtension();
     if (process.platform === 'win32') {
@@ -105,6 +132,10 @@ export class TemurinDistribution extends JavaBase {
     return super.toolcacheFolderName;
   }
 
+  protected supportsSignatureVerification(): boolean {
+    return true;
+  }
+
   private async getAvailableVersions(): Promise<ITemurinAvailableVersions[]> {
     const platform = this.getPlatformOption();
     const arch = this.distributionArchitecture();

src/distributions/temurin/models.ts

@@ -11,6 +11,7 @@ export interface ITemurinAvailableVersions {
       package: {
         checksum: string;
         checksum_link: string;
+        signature_link?: string;
         download_count: number;
         link: string;
         metadata_link: string;

src/gpg.ts

@@ -2,6 +2,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as io from '@actions/io';
 import * as exec from '@actions/exec';
+import * as tc from '@actions/tool-cache';
 import * as util from './util';
 import {ExecOptions} from '@actions/exec/lib/interfaces';
 
@@ -9,6 +10,17 @@ export const PRIVATE_KEY_FILE = path.join(util.getTempDir(), 'private-key.asc');
 
 const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
 
+// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
+// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
+// internally. Passing Windows paths with backslashes can cause fatal GPG errors
+// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
+export function toGpgPath(p: string): string {
+  if (process.platform !== 'win32') return p;
+  return p
+    .replace(/\\/g, '/')
+    .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
+}
+
 export async function importKey(privateKey: string) {
   fs.writeFileSync(PRIVATE_KEY_FILE, privateKey, {
     encoding: 'utf-8',
@@ -53,3 +65,59 @@ export async function deleteKey(keyFingerprint: string) {
     }
   );
 }
+
+export async function verifyPackageSignature(
+  archivePath: string,
+  signatureUrl: string,
+  publicKeyContent: string
+) {
+  const signaturePath = await tc.downloadTool(signatureUrl);
+  let gpgHome: string;
+  try {
+    gpgHome = fs.mkdtempSync(
+      path.join(util.getTempDir(), 'verify-signature-gpg-home-')
+    );
+  } catch (error) {
+    try {
+      await io.rmRF(signaturePath);
+    } catch {
+      // ignore cleanup failures
+    }
+    throw new Error(
+      `Failed to create temporary GPG home directory for signature verification: ${
+        (error as Error).message
+      }`
+    );
+  }
+  try {
+    const publicKeyFile = path.join(gpgHome, 'public-key.asc');
+    fs.writeFileSync(publicKeyFile, publicKeyContent, {encoding: 'utf-8'});
+    const options: ExecOptions = {silent: true};
+    await exec.exec(
+      'gpg',
+      [
+        '--homedir',
+        toGpgPath(gpgHome),
+        '--batch',
+        '--import',
+        toGpgPath(publicKeyFile)
+      ],
+      options
+    );
+    await exec.exec(
+      'gpg',
+      [
+        '--homedir',
+        toGpgPath(gpgHome),
+        '--batch',
+        '--verify',
+        toGpgPath(signaturePath),
+        toGpgPath(archivePath)
+      ],
+      options
+    );
+  } finally {
+    await io.rmRF(signaturePath);
+    await io.rmRF(gpgHome);
+  }
+}

src/maven-args.ts

@@ -0,0 +1,69 @@
+import * as core from '@actions/core';
+import {getBooleanInput} from './util';
+import {
+  INPUT_SHOW_DOWNLOAD_PROGRESS,
+  MAVEN_ARGS_ENV,
+  MAVEN_NO_TRANSFER_PROGRESS_FLAG,
+  MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG
+} from './constants';
+
+/**
+ * Configures the MAVEN_ARGS environment variable so that Maven suppresses
+ * artifact transfer/download progress output by default, producing cleaner
+ * CI logs.
+ *
+ * Behavior:
+ * - When `show-download-progress` is `false` (the default), `-ntp`
+ *   (`--no-transfer-progress`) is appended to any existing MAVEN_ARGS value.
+ * - When `show-download-progress` is `true`, MAVEN_ARGS is left untouched so
+ *   the user's own configuration (and Maven's default progress output) is
+ *   preserved.
+ *
+ * The change is idempotent: if MAVEN_ARGS already disables transfer progress
+ * (via `-ntp` or `--no-transfer-progress`) nothing is added. Any pre-existing
+ * MAVEN_ARGS value is preserved.
+ *
+ * MAVEN_ARGS is honored by Maven 3.9.0+ and the Maven Wrapper; older Maven
+ * versions ignore it, so this is a no-op there. It has no effect on non-Maven
+ * builds such as Gradle or sbt.
+ */
+export function configureMavenArgs(): void {
+  const showDownloadProgress = getBooleanInput(
+    INPUT_SHOW_DOWNLOAD_PROGRESS,
+    false
+  );
+
+  if (showDownloadProgress) {
+    core.debug(
+      `${INPUT_SHOW_DOWNLOAD_PROGRESS} is true; leaving ${MAVEN_ARGS_ENV} unchanged`
+    );
+    return;
+  }
+
+  const existingArgs = (process.env[MAVEN_ARGS_ENV] ?? '').trim();
+
+  const alreadyDisabled = existingArgs
+    .split(/\s+/)
+    .some(
+      arg =>
+        arg === MAVEN_NO_TRANSFER_PROGRESS_FLAG ||
+        arg === MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG
+    );
+
+  if (alreadyDisabled) {
+    core.debug(
+      `${MAVEN_ARGS_ENV} already disables transfer progress; leaving it unchanged`
+    );
+    return;
+  }
+
+  const updatedArgs = existingArgs
+    ? `${existingArgs} ${MAVEN_NO_TRANSFER_PROGRESS_FLAG}`
+    : MAVEN_NO_TRANSFER_PROGRESS_FLAG;
+
+  core.exportVariable(MAVEN_ARGS_ENV, updatedArgs);
+  core.info(
+    `Configured ${MAVEN_ARGS_ENV} to include ${MAVEN_NO_TRANSFER_PROGRESS_FLAG} to suppress Maven transfer progress logs. ` +
+      `Set '${INPUT_SHOW_DOWNLOAD_PROGRESS}: true' to keep the download progress output.`
+  );
+}

src/setup-java.ts

@@ -12,6 +12,7 @@ import {restore} from './cache';
 import * as path from 'path';
 import {getJavaDistribution} from './distributions/distribution-factory';
 import {JavaInstallerOptions} from './distributions/base-models';
+import {configureMavenArgs} from './maven-args';
 
 async function run() {
   try {
@@ -28,6 +29,12 @@ async function run() {
       constants.INPUT_CACHE_DEPENDENCY_PATH
     );
     const checkLatest = getBooleanInput(constants.INPUT_CHECK_LATEST, false);
+    const verifySignature = getBooleanInput(
+      constants.INPUT_VERIFY_SIGNATURE,
+      false
+    );
+    const verifySignaturePublicKey =
+      core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
     let toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
 
     core.startGroup('Installed distributions');
@@ -44,6 +51,8 @@ async function run() {
       architecture,
       packageType,
       checkLatest,
+      verifySignature,
+      verifySignaturePublicKey,
       distributionName,
       jdkFile,
       toolchainIds
@@ -79,6 +88,7 @@ async function run() {
     core.info(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);
 
     await auth.configureAuthentication();
+    configureMavenArgs();
     if (cache && isCacheFeatureAvailable()) {
       await restore(cache, cacheDependencyPath);
     }
@@ -100,6 +110,8 @@ async function installVersion(
     architecture,
     packageType,
     checkLatest,
+    verifySignature,
+    verifySignaturePublicKey,
     toolchainIds
   } = options;
 
@@ -107,6 +119,8 @@ async function installVersion(
     architecture,
     packageType,
     checkLatest,
+    verifySignature,
+    verifySignaturePublicKey,
     version
   };
 
@@ -141,6 +155,8 @@ interface installerInputsOptions {
   architecture: string;
   packageType: string;
   checkLatest: boolean;
+  verifySignature: boolean;
+  verifySignaturePublicKey: string | undefined;
   distributionName: string;
   jdkFile: string;
   toolchainIds: Array<string>;

src/toolchains.ts

@@ -83,47 +83,76 @@ export function generateToolchainDefinition(
   id: string,
   jdkHome: string
 ) {
-  let xmlObj;
+  let jsToolchains: Toolchain[] = [
-  if (original?.length) {
+    {
-    xmlObj = xmlCreate(original)
+      type: 'jdk',
-      .root()
+      provides: {
-      .ele({
+        version: `${version}`,
-        toolchain: {
+        vendor: `${vendor}`,
-          type: 'jdk',
+        id: `${id}`
-          provides: {
+      },
-            version: `${version}`,
+      configuration: {
-            vendor: `${vendor}`,
+        jdkHome: `${jdkHome}`
-            id: `${id}`
-          },
-          configuration: {
-            jdkHome: `${jdkHome}`
-          }
-        }
-      });
-  } else
-    xmlObj = xmlCreate({
-      toolchains: {
-        '@xmlns': 'http://maven.apache.org/TOOLCHAINS/1.1.0',
-        '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
-        '@xsi:schemaLocation':
-          'http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd',
-        toolchain: [
-          {
-            type: 'jdk',
-            provides: {
-              version: `${version}`,
-              vendor: `${vendor}`,
-              id: `${id}`
-            },
-            configuration: {
-              jdkHome: `${jdkHome}`
-            }
-          }
-        ]
       }
-    });
+    }
+  ];
+  // default root attributes, used when the existing file does not declare its own
+  let rootAttributes: Record<string, string> = {
+    '@xmlns': 'http://maven.apache.org/TOOLCHAINS/1.1.0',
+    '@xmlns:xsi': 'http://www.w3.org/2001/XMLSchema-instance',
+    '@xsi:schemaLocation':
+      'http://maven.apache.org/TOOLCHAINS/1.1.0 https://maven.apache.org/xsd/toolchains-1.1.0.xsd'
+  };
+  if (original?.length) {
+    // convert existing toolchains into TS native objects for better handling
+    // xmlbuilder2 will convert the document into a `{toolchains: { toolchain: [] | {} }}` structure
+    // instead of the desired `toolchains: [{}]` one or simply `[{}]`
+    const jsObj = xmlCreate(original)
+      .root()
+      .toObject() as unknown as ExtractedToolchains;
+    if (jsObj.toolchains) {
+      // preserve the existing root attributes (xmlns, schemaLocation, …) so we don't
+      // silently rewrite user-managed metadata or change the effective XML namespace;
+      // xmlbuilder2 exposes attributes as `@`-prefixed keys on the element object
+      const existingAttributes = Object.fromEntries(
+        Object.entries(jsObj.toolchains).filter(([key]) => key.startsWith('@'))
+      ) as Record<string, string>;
+      // fall back to the defaults only for attributes the existing file is missing
+      rootAttributes = {...rootAttributes, ...existingAttributes};
 
-  return xmlObj.end({
+      if (jsObj.toolchains.toolchain) {
+        // in case only a single child exists xmlbuilder2 will not create an array and using verbose = true equally doesn't work here
+        // See https://oozcitak.github.io/xmlbuilder2/serialization.html#js-object-and-map-serializers for details
+        if (Array.isArray(jsObj.toolchains.toolchain)) {
+          jsToolchains.push(...jsObj.toolchains.toolchain);
+        } else {
+          jsToolchains.push(jsObj.toolchains.toolchain);
+        }
+      }
+    }
+
+    // remove potential duplicates based on type & id (which should be a unique combination);
+    // self.findIndex will only return the first occurrence, ensuring duplicates are skipped
+    jsToolchains = jsToolchains.filter(
+      (value, index, self) =>
+        // ensure non-jdk toolchains are kept in the results, we must not touch them because they belong to the user
+        value.type !== 'jdk' ||
+        // keep toolchains that lack a usable string id (e.g. partially-formed user files);
+        // we cannot safely deduplicate them and must not crash while reading them
+        typeof value.provides?.id !== 'string' ||
+        index ===
+          self.findIndex(
+            t => t.type === value.type && t.provides?.id === value.provides?.id
+          )
+    );
+  }
+
+  return xmlCreate({
+    toolchains: {
+      ...rootAttributes,
+      toolchain: jsToolchains
+    }
+  }).end({
     format: 'xml',
     wellFormed: false,
     headless: false,
@@ -166,3 +195,24 @@ async function writeToolchainsFileToDisk(
     flag: 'w'
   });
 }
+
+interface ExtractedToolchains {
+  toolchains: {
+    // root attributes such as xmlns / schemaLocation are exposed as `@`-prefixed keys
+    [attribute: `@${string}`]: string;
+    toolchain?: Toolchain[] | Toolchain;
+  };
+}
+
+// Toolchain type definition according to Maven Toolchains XSD 1.1.0
+interface Toolchain {
+  type: string;
+  provides:
+    | {
+        version: string;
+        vendor: string;
+        id: string;
+      }
+    | any;
+  configuration: any;
+}