Set default signature verification for supported distributions (#1246)

* Default signature verification for supported distributions

* Delegate signature defaults to installers

README.md

@@ -159,7 +159,7 @@ steps:
 | `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
 | `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
 | `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
-| `verify-signature` | Verify downloaded Java package signatures when supported. Currently supported for `temurin` and `microsoft`. | `false` |
+| `verify-signature` | Verify downloaded Java package signatures when supported. Defaults to `true` for `temurin` and `microsoft`, and `false` for other distributions. | Automatically enabled for `temurin` and `microsoft` |
 | `verify-signature-public-key` | ASCII-armored GPG public key to use for signature verification. Overrides the bundled key. | |
 | `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
 | `cache` | Enable dependency caching for `maven`, `gradle`, or `sbt`. | |

__tests__/distributors/microsoft-installer.test.ts

@@ -398,13 +398,12 @@ describe('downloadTool', () => {
     jest.restoreAllMocks();
   });
 
-  it('verifies signature when enabled', async () => {
+  it('verifies signatures by default', async () => {
     const signedDistribution = new MicrosoftDistributions({
       version: '17',
       architecture: 'x64',
       packageType: 'jdk',
-      checkLatest: false,
+      checkLatest: false
-      verifySignature: true
     });
 
     await signedDistribution['downloadTool']({

__tests__/distributors/temurin-installer.test.ts

@@ -457,14 +457,13 @@ describe('downloadTool', () => {
     jest.restoreAllMocks();
   });
 
-  it('verifies signature when enabled', async () => {
+  it('verifies signatures by default', async () => {
     const distribution = new TemurinDistribution(
       {
         version: '17',
         architecture: 'x64',
         packageType: 'jdk',
-        checkLatest: false,
+        checkLatest: false
-        verifySignature: true
       },
       TemurinImplementation.Hotspot
     );
@@ -482,6 +481,27 @@ describe('downloadTool', () => {
     );
   });
 
+  it('does not verify signatures when explicitly disabled', async () => {
+    const distribution = new TemurinDistribution(
+      {
+        version: '17',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false,
+        verifySignature: false
+      },
+      TemurinImplementation.Hotspot
+    );
+
+    await distribution['downloadTool']({
+      version: '17.0.14+7',
+      url: 'https://example.com/jdk.tar.gz',
+      signatureUrl: 'https://example.com/jdk.tar.gz.sig'
+    });
+
+    expect(spyVerifySignature).not.toHaveBeenCalled();
+  });
+
   it('downloads and adds matching JMODs to the JDK', async () => {
     spyDownloadTool
       .mockResolvedValueOnce('/tmp/jdk.tar.gz')
@@ -499,7 +519,8 @@ describe('downloadTool', () => {
         version: '25',
         architecture: 'x64',
         packageType: 'jdk+jmods',
-        checkLatest: false
+        checkLatest: false,
+        verifySignature: false
       },
       TemurinImplementation.Hotspot
     );

__tests__/setup-java.test.ts

@@ -161,6 +161,37 @@ describe('setup action orchestration', () => {
     expect(factory.getJavaDistribution).not.toHaveBeenCalled();
   });
 
+  it.each([
+    ['temurin', undefined, undefined],
+    ['zulu', undefined, undefined],
+    ['temurin', false, false],
+    ['zulu', true, true]
+  ])(
+    'passes signature verification input for %s with explicit value %s as %s',
+    async (distribution, explicitValue, expectedValue) => {
+      inputs.set('distribution', distribution);
+      multilineInputs.set('java-version', ['21']);
+      if (explicitValue !== undefined) {
+        inputs.set('verify-signature', String(explicitValue));
+        booleanInputs.set('verify-signature', explicitValue);
+      }
+      (factory.getJavaDistribution as jest.Mock).mockReturnValue({
+        setupJava: jest.fn(async () => ({
+          version: '21.0.4+7',
+          path: '/opt/java/21'
+        }))
+      });
+
+      await run();
+
+      expect(factory.getJavaDistribution).toHaveBeenCalledWith(
+        distribution,
+        expect.objectContaining({verifySignature: expectedValue}),
+        ''
+      );
+    }
+  );
+
   it('requires distribution when it cannot be inferred from the version file', async () => {
     inputs.set('java-version-file', '.java-version');
     (fs.readFileSync as jest.Mock).mockReturnValue(Buffer.from('21'));
@@ -200,7 +231,6 @@ describe('setup action orchestration', () => {
     booleanInputs.set('check-latest', true);
     booleanInputs.set('force-download', true);
     booleanInputs.set('set-default', false);
-    booleanInputs.set('verify-signature', true);
     inputs.set('verify-signature-public-key', 'public-key');
     (fs.readFileSync as jest.Mock).mockReturnValue(
       Buffer.from('java=21.0.5-tem')
@@ -232,7 +262,7 @@ describe('setup action orchestration', () => {
         forceDownload: true,
         cacheJdk: false,
         setDefault: false,
-        verifySignature: true,
+        verifySignature: undefined,
         verifySignaturePublicKey: 'public-key'
       },
       '/tmp/java.tar.gz'

action.yml

@@ -41,7 +41,6 @@ inputs:
   verify-signature:
     description: 'Verify downloaded Java package signatures when supported by the selected distribution'
     required: false
-    default: false
   verify-signature-public-key:
     description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
     required: false

dist/setup/242.index.js

@@ -244,7 +244,8 @@ class JavaBase {
             installerOptions.setDefault !== undefined
                 ? installerOptions.setDefault
                 : true;
-        this.verifySignature = installerOptions.verifySignature ?? false;
+        this.verifySignature =
+            installerOptions.verifySignature ?? this.supportsSignatureVerification();
         this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
     }
     async downloadAndVerify(javaRelease) {

dist/setup/index.js

@@ -36376,7 +36376,6 @@ async function run() {
     const checkLatest = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_CHECK_LATEST */.YM, false);
     const forceDownload = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_FORCE_DOWNLOAD */.I9, false);
     const setDefault = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_SET_DEFAULT */.E8, true);
-    const verifySignature = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy, false);
     const verifySignaturePublicKey = setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE_PUBLIC_KEY */.u) || undefined;
     const toolchainIds = setup_java_core/* getMultilineInput */.q3(constants/* INPUT_MVN_TOOLCHAIN_ID */.nr);
     let actionError;
@@ -36404,6 +36403,7 @@ async function run() {
             else if (!distributionName) {
                 throw new Error('distribution input is required when not specified in the version file');
             }
+            const verifySignature = getVerifySignatureInput();
             const installerInputsOptions = {
                 architecture,
                 packageType,
@@ -36428,6 +36428,7 @@ async function run() {
             if (!distributionName) {
                 throw new Error('distribution input is required');
             }
+            const verifySignature = getVerifySignatureInput();
             const installerInputsOptions = {
                 architecture,
                 packageType,
@@ -36492,6 +36493,11 @@ function getJdkFileInput() {
     }
     return jdkFile || deprecatedJdkFile;
 }
+function getVerifySignatureInput() {
+    return setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE */.qy).trim()
+        ? (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy)
+        : undefined;
+}
 async function installVersion(version, options, toolchainId = 0) {
     const { distributionName, jdkFile, architecture, packageType, checkLatest, forceDownload, cacheJdk, setDefault, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
     const installerOptions = {

src/distributions/base-installer.ts

@@ -68,7 +68,8 @@ export abstract class JavaBase {
       installerOptions.setDefault !== undefined
         ? installerOptions.setDefault
         : true;
-    this.verifySignature = installerOptions.verifySignature ?? false;
+    this.verifySignature =
+      installerOptions.verifySignature ?? this.supportsSignatureVerification();
     this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
   }
 

src/setup-java.ts

@@ -29,10 +29,6 @@ export async function run() {
   const checkLatest = getBooleanInput(constants.INPUT_CHECK_LATEST, false);
   const forceDownload = getBooleanInput(constants.INPUT_FORCE_DOWNLOAD, false);
   const setDefault = getBooleanInput(constants.INPUT_SET_DEFAULT, true);
-  const verifySignature = getBooleanInput(
-    constants.INPUT_VERIFY_SIGNATURE,
-    false
-  );
   const verifySignaturePublicKey =
     core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
   const toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
@@ -80,6 +76,8 @@ export async function run() {
         );
       }
 
+      const verifySignature = getVerifySignatureInput();
+
       const installerInputsOptions: installerInputsOptions = {
         architecture,
         packageType,
@@ -107,6 +105,8 @@ export async function run() {
         throw new Error('distribution input is required');
       }
 
+      const verifySignature = getVerifySignatureInput();
+
       const installerInputsOptions: installerInputsOptions = {
         architecture,
         packageType,
@@ -192,6 +192,12 @@ function getJdkFileInput(): string {
   return jdkFile || deprecatedJdkFile;
 }
 
+function getVerifySignatureInput(): boolean | undefined {
+  return core.getInput(constants.INPUT_VERIFY_SIGNATURE).trim()
+    ? getBooleanInput(constants.INPUT_VERIFY_SIGNATURE)
+    : undefined;
+}
+
 async function installVersion(
   version: string,
   options: installerInputsOptions,
@@ -263,7 +269,7 @@ interface installerInputsOptions {
   forceDownload: boolean;
   cacheJdk: boolean;
   setDefault: boolean;
-  verifySignature: boolean;
+  verifySignature: boolean | undefined;
   verifySignaturePublicKey: string | undefined;
   distributionName: string;
   jdkFile: string;