Gitea_Action/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java.git synced 2026-08-25 16:00:54 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

Set default signature verification for supported distributions (#1246)

Browse Source 
* Default signature verification for supported distributions

* Delegate signature defaults to installers
This commit is contained in:
John 2026-08-24 15:08:03 +01:00 committed by GitHub
parent 1dbac3c9e1
commit b96213d9d2
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
9 changed files with 82 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -159,7 +159,7 @@ steps:
| `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
| `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
| `verify-signature` | Verify downloaded Java package signatures when supported. Currently supported for `temurin` and `microsoft`. | `false` |
| `verify-signature` | Verify downloaded Java package signatures when supported. Defaults to `true` for `temurin` and `microsoft`, and `false` for other distributions. | Automatically enabled for `temurin` and `microsoft` |
| `verify-signature-public-key` | ASCII-armored GPG public key to use for signature verification. Overrides the bundled key. | |
| `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
| `cache` | Enable dependency caching for `maven`, `gradle`, or `sbt`. | |

5
__tests__/distributors/microsoft-installer.test.ts
View File

@ -398,13 +398,12 @@ describe('downloadTool', () => {
jest.restoreAllMocks();
});
it('verifies signature when enabled', async () => {
it('verifies signatures by default', async () => {
const signedDistribution = new MicrosoftDistributions({
version: '17',
architecture: 'x64',
packageType: 'jdk',
checkLatest: false,
verifySignature: true
checkLatest: false
});
await signedDistribution['downloadTool']({

29
__tests__/distributors/temurin-installer.test.ts
View File

@ -457,14 +457,13 @@ describe('downloadTool', () => {
jest.restoreAllMocks();
});
it('verifies signature when enabled', async () => {
it('verifies signatures by default', async () => {
const distribution = new TemurinDistribution(
{
version: '17',
architecture: 'x64',
packageType: 'jdk',
checkLatest: false,
verifySignature: true
checkLatest: false
},
TemurinImplementation.Hotspot
);
@ -482,6 +481,27 @@ describe('downloadTool', () => {
);
});
it('does not verify signatures when explicitly disabled', async () => {
const distribution = new TemurinDistribution(
{
version: '17',
architecture: 'x64',
packageType: 'jdk',
checkLatest: false,
verifySignature: false
},
TemurinImplementation.Hotspot
);
await distribution['downloadTool']({
version: '17.0.14+7',
url: 'https://example.com/jdk.tar.gz',
signatureUrl: 'https://example.com/jdk.tar.gz.sig'
});
expect(spyVerifySignature).not.toHaveBeenCalled();
});
it('downloads and adds matching JMODs to the JDK', async () => {
spyDownloadTool
.mockResolvedValueOnce('/tmp/jdk.tar.gz')
@ -499,7 +519,8 @@ describe('downloadTool', () => {
version: '25',
architecture: 'x64',
packageType: 'jdk+jmods',
checkLatest: false
checkLatest: false,
verifySignature: false
},
TemurinImplementation.Hotspot
);

34
__tests__/setup-java.test.ts
View File

@ -161,6 +161,37 @@ describe('setup action orchestration', () => {
expect(factory.getJavaDistribution).not.toHaveBeenCalled();
});
it.each([
['temurin', undefined, undefined],
['zulu', undefined, undefined],
['temurin', false, false],
['zulu', true, true]
])(
'passes signature verification input for %s with explicit value %s as %s',
async (distribution, explicitValue, expectedValue) => {
inputs.set('distribution', distribution);
multilineInputs.set('java-version', ['21']);
if (explicitValue !== undefined) {
inputs.set('verify-signature', String(explicitValue));
booleanInputs.set('verify-signature', explicitValue);
}
(factory.getJavaDistribution as jest.Mock).mockReturnValue({
setupJava: jest.fn(async () => ({
version: '21.0.4+7',
path: '/opt/java/21'
}))
});
await run();
expect(factory.getJavaDistribution).toHaveBeenCalledWith(
distribution,
expect.objectContaining({verifySignature: expectedValue}),
''
);
}
);
it('requires distribution when it cannot be inferred from the version file', async () => {
inputs.set('java-version-file', '.java-version');
(fs.readFileSync as jest.Mock).mockReturnValue(Buffer.from('21'));
@ -200,7 +231,6 @@ describe('setup action orchestration', () => {
booleanInputs.set('check-latest', true);
booleanInputs.set('force-download', true);
booleanInputs.set('set-default', false);
booleanInputs.set('verify-signature', true);
inputs.set('verify-signature-public-key', 'public-key');
(fs.readFileSync as jest.Mock).mockReturnValue(
Buffer.from('java=21.0.5-tem')
@ -232,7 +262,7 @@ describe('setup action orchestration', () => {
forceDownload: true,
cacheJdk: false,
setDefault: false,
verifySignature: true,
verifySignature: undefined,
verifySignaturePublicKey: 'public-key'
},
'/tmp/java.tar.gz'

1
action.yml
View File

@ -41,7 +41,6 @@ inputs:
verify-signature:
description: 'Verify downloaded Java package signatures when supported by the selected distribution'
required: false
default: false
verify-signature-public-key:
description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
required: false

3
dist/setup/242.index.js vendored
View File

@ -244,7 +244,8 @@ class JavaBase {
installerOptions.setDefault !== undefined
? installerOptions.setDefault
: true;
this.verifySignature = installerOptions.verifySignature ?? false;
this.verifySignature =
installerOptions.verifySignature ?? this.supportsSignatureVerification();
this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
}
async downloadAndVerify(javaRelease) {

8
dist/setup/index.js vendored
View File

@ -36376,7 +36376,6 @@ async function run() {
const checkLatest = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_CHECK_LATEST */.YM, false);
const forceDownload = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_FORCE_DOWNLOAD */.I9, false);
const setDefault = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_SET_DEFAULT */.E8, true);
const verifySignature = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy, false);
const verifySignaturePublicKey = setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE_PUBLIC_KEY */.u) || undefined;
const toolchainIds = setup_java_core/* getMultilineInput */.q3(constants/* INPUT_MVN_TOOLCHAIN_ID */.nr);
let actionError;
@ -36404,6 +36403,7 @@ async function run() {
else if (!distributionName) {
throw new Error('distribution input is required when not specified in the version file');
}
const verifySignature = getVerifySignatureInput();
const installerInputsOptions = {
architecture,
packageType,
@ -36428,6 +36428,7 @@ async function run() {
if (!distributionName) {
throw new Error('distribution input is required');
}
const verifySignature = getVerifySignatureInput();
const installerInputsOptions = {
architecture,
packageType,
@ -36492,6 +36493,11 @@ function getJdkFileInput() {
}
return jdkFile || deprecatedJdkFile;
}
function getVerifySignatureInput() {
return setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE */.qy).trim()
? (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy)
: undefined;
}
async function installVersion(version, options, toolchainId = 0) {
const { distributionName, jdkFile, architecture, packageType, checkLatest, forceDownload, cacheJdk, setDefault, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
const installerOptions = {

3
src/distributions/base-installer.ts
View File

@ -68,7 +68,8 @@ export abstract class JavaBase {
installerOptions.setDefault !== undefined
? installerOptions.setDefault
: true;
this.verifySignature = installerOptions.verifySignature ?? false;
this.verifySignature =
installerOptions.verifySignature ?? this.supportsSignatureVerification();
this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
}

16
src/setup-java.ts
View File

@ -29,10 +29,6 @@ export async function run() {
const checkLatest = getBooleanInput(constants.INPUT_CHECK_LATEST, false);
const forceDownload = getBooleanInput(constants.INPUT_FORCE_DOWNLOAD, false);
const setDefault = getBooleanInput(constants.INPUT_SET_DEFAULT, true);
const verifySignature = getBooleanInput(
constants.INPUT_VERIFY_SIGNATURE,
false
);
const verifySignaturePublicKey =
core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
const toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
@ -80,6 +76,8 @@ export async function run() {
);
}
const verifySignature = getVerifySignatureInput();
const installerInputsOptions: installerInputsOptions = {
architecture,
packageType,
@ -107,6 +105,8 @@ export async function run() {
throw new Error('distribution input is required');
}
const verifySignature = getVerifySignatureInput();
const installerInputsOptions: installerInputsOptions = {
architecture,
packageType,
@ -192,6 +192,12 @@ function getJdkFileInput(): string {
return jdkFile || deprecatedJdkFile;
}
function getVerifySignatureInput(): boolean | undefined {
return core.getInput(constants.INPUT_VERIFY_SIGNATURE).trim()
? getBooleanInput(constants.INPUT_VERIFY_SIGNATURE)
: undefined;
}
async function installVersion(
version: string,
options: installerInputsOptions,
@ -263,7 +269,7 @@ interface installerInputsOptions {
forceDownload: boolean;
cacheJdk: boolean;
setDefault: boolean;
verifySignature: boolean;
verifySignature: boolean | undefined;
verifySignaturePublicKey: string | undefined;
distributionName: string;
jdkFile: string;