Gitea_Action/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java.git synced 2026-07-08 14:21:50 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Refine signature verification errors and regenerate dist

Browse Source
This commit is contained in:
copilot-swe-agent[bot] 2026-06-17 14:26:14 +00:00 committed by GitHub
parent 39460f2cc0
commit 70770c9dd2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 32 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
__tests__/distributors/temurin-installer.test.ts
View File

@ -235,7 +235,7 @@ describe('findPackageForDownload', () => {
distribution['getAvailableVersions'] = async () => manifestData as any;
const resolvedVersion = await distribution['findPackageForDownload'](input);
expect(resolvedVersion.version).toBe(expected);
expect(resolvedVersion.signatureUrl).toBeTruthy();
expect(resolvedVersion.signatureUrl).toBeDefined();
});
it('version is found but binaries list is empty', async () => {

9
dist/cleanup/index.js vendored
View File

@ -52116,12 +52116,19 @@ exports.deleteKey = deleteKey;
function verifyPackageSignature(archivePath, signatureUrl, keyFingerprint = exports.ADOPTIUM_SIGNATURE_KEY_FINGERPRINT) {
return __awaiter(this, void 0, void 0, function* () {
const signaturePath = yield tc.downloadTool(signatureUrl);
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
let gpgHome;
try {
gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
}
catch (error) {
throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
}
const env = Object.assign(Object.assign({}, process.env), { GNUPGHOME: gpgHome });
try {
const options = { silent: true, env };
yield exec.exec('gpg', [
'--batch',
// Adoptium release-signing docs recommend keyserver.ubuntu.com for key retrieval.
'--keyserver',
'keyserver.ubuntu.com',
'--recv-keys',

11
dist/setup/index.js vendored
View File

@ -80310,7 +80310,7 @@ class TemurinDistribution extends base_installer_1.JavaBase {
yield gpg.verifyPackageSignature(javaArchivePath, javaRelease.signatureUrl, gpg.ADOPTIUM_SIGNATURE_KEY_FINGERPRINT);
}
catch (error) {
throw new Error(`Failed to verify signature for Temurin version ${javaRelease.version}: ${error.message}`);
throw new Error(`Failed to verify signature for Temurin version ${javaRelease.version} from ${javaRelease.signatureUrl}: ${error.message}`);
}
}
core.info(`Extracting Java archive...`);
@ -80673,12 +80673,19 @@ exports.deleteKey = deleteKey;
function verifyPackageSignature(archivePath, signatureUrl, keyFingerprint = exports.ADOPTIUM_SIGNATURE_KEY_FINGERPRINT) {
return __awaiter(this, void 0, void 0, function* () {
const signaturePath = yield tc.downloadTool(signatureUrl);
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
let gpgHome;
try {
gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
}
catch (error) {
throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
}
const env = Object.assign(Object.assign({}, process.env), { GNUPGHOME: gpgHome });
try {
const options = { silent: true, env };
yield exec.exec('gpg', [
'--batch',
// Adoptium release-signing docs recommend keyserver.ubuntu.com for key retrieval.
'--keyserver',
'keyserver.ubuntu.com',
'--recv-keys',

2
src/distributions/temurin/installer.ts
View File

@ -97,7 +97,7 @@ export class TemurinDistribution extends JavaBase {
);
} catch (error) {
throw new Error(
`Failed to verify signature for Temurin version ${javaRelease.version}: ${
`Failed to verify signature for Temurin version ${javaRelease.version} from ${javaRelease.signatureUrl}: ${
(error as Error).message
}`
);

16
src/gpg.ts
View File

@ -63,9 +63,18 @@ export async function verifyPackageSignature(
keyFingerprint = ADOPTIUM_SIGNATURE_KEY_FINGERPRINT
) {
const signaturePath = await tc.downloadTool(signatureUrl);
const gpgHome = fs.mkdtempSync(
path.join(util.getTempDir(), 'verify-signature-gpg-home-')
);
let gpgHome: string;
try {
gpgHome = fs.mkdtempSync(
path.join(util.getTempDir(), 'verify-signature-gpg-home-')
);
} catch (error) {
throw new Error(
`Failed to create temporary GPG home directory for signature verification: ${
(error as Error).message
}`
);
}
const env = {...process.env, GNUPGHOME: gpgHome};
try {
@ -74,6 +83,7 @@ export async function verifyPackageSignature(
'gpg',
[
'--batch',
// Adoptium release-signing docs recommend keyserver.ubuntu.com for key retrieval.
'--keyserver',
'keyserver.ubuntu.com',
'--recv-keys',