Skip to content

Added support for GPG signing #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
konradpabjan merged 12 commits into from
Jul 22, 2020
Merged

Added support for GPG signing #63

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
d94db22
Added support for GPG
jaredpetersen May 2, 2020
e494666
fixed setSecret
jaredpetersen May 23, 2020
01f4422
Merge remote-tracking branch 'upstream/master'
jaredpetersen Jun 24, 2020
7f23828
addressed most of the feedback
jaredpetersen Jul 16, 2020
91d1667
added blurb about private key file and cleanup for hosted runners
jaredpetersen Jul 16, 2020
034b7a7
forgot to run build
jaredpetersen Jul 16, 2020
2d0e474
removed unecessary set secret -- it's an environment variable not a l…
jaredpetersen Jul 16, 2020
4d8dc69
fixing defaults
jaredpetersen Jul 16, 2020
012c21e
fixed gpg passhprase default
jaredpetersen Jul 16, 2020
36bb906
removed test timeout
jaredpetersen Jul 17, 2020
ac9630f
cleaned up description for how the private key is stored
jaredpetersen Jul 17, 2020
38e0c8b
improved cleanup error message
jaredpetersen Jul 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
addressed most of the feedback
  • Loading branch information
@jaredpetersen
jaredpetersen committed Jul 16, 2020
commit 7f2382879a87cb040cab54a4b211b7f593937c2b
2 changes: 1 addition & 1 deletion __tests__/gpg.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ import gpg = require('../src/gpg');
describe('gpg tests', () => {
beforeEach(async () => {
await io.mkdirP(tempDir);
}, 300000);
});

afterAll(async () => {
try {
Expand Down
5 changes: 5 additions & 0 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,18 +21,22 @@ inputs:
description: 'Path to where the compressed JDK is located. The path could
be in your source repository or a local path on the agent.'
required: false
default: ''
server-id:
description: 'ID of the distributionManagement repository in the pom.xml
file. Default is `github`'
required: false
default: 'github'
server-username:
description: 'Environment variable name for the username for authentication
to the Apache Maven repository. Default is $GITHUB_ACTOR'
required: false
default: 'GITHUB_ACTOR'
Comment thread
konradpabjan marked this conversation as resolved.
server-password:
description: 'Environment variable name for password or token for
authentication to the Apache Maven repository. Default is $GITHUB_TOKEN'
required: false
default: 'GITHUB_TOKEN'
Comment thread
konradpabjan marked this conversation as resolved.
settings-path:
description: 'Path to where the settings.xml file will be written. Default is ~/.m2.'
required: false
Expand All @@ -43,6 +47,7 @@ inputs:
description: 'Environment variable name for the GPG private key passphrase. Default is
$GPG_PASSPHRASE.'
required: false
default: 'GPG_PASSHPRASE'
outputs:
path:
description: 'Path to where the java environment has been installed (same as $JAVA_HOME)'
Expand Down
29 changes: 26 additions & 3 deletions dist/cleanup/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -946,6 +946,28 @@ module.exports = require("os");

module.exports = require("child_process");

/***/ }),

/***/ 211:
/***/ (function(__unusedmodule, exports) {

"use strict";

Object.defineProperty(exports, "__esModule", { value: true });
exports.INPUT_VERSION = 'version';
exports.INPUT_JAVA_VERSION = 'java-version';
exports.INPUT_ARCHITECTURE = 'architecture';
exports.INPUT_JAVA_PACKAGE = 'java-package';
exports.INPUT_JDK_FILE = 'jdkFile';
exports.INPUT_SERVER_ID = 'server-id';
exports.INPUT_SERVER_USERNAME = 'server-username';
exports.INPUT_SERVER_PASSWORD = 'server-password';
exports.INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
exports.INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
exports.INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = 'gpg-private-key-fingerprint';


/***/ }),

/***/ 219:
Expand All @@ -972,12 +994,13 @@ var __importStar = (this && this.__importStar) || function (mod) {
Object.defineProperty(exports, "__esModule", { value: true });
const core = __importStar(__webpack_require__(470));
const gpg = __importStar(__webpack_require__(884));
const constants = __importStar(__webpack_require__(211));
function run() {
return __awaiter(this, void 0, void 0, function* () {
if (core.getInput('gpg-private-key', { required: false })) {
console.log('removing private key from keychain');
if (core.getInput(constants.INPUT_GPG_PRIVATE_KEY, { required: false })) {
core.info('removing private key from keychain');
try {
const keyFingerprint = core.getState('gpg-private-key-fingerprint');
const keyFingerprint = core.getState(constants.STATE_GPG_PRIVATE_KEY_FINGERPRINT);
yield gpg.deleteKey(keyFingerprint);
}
catch (error) {
Expand Down
68 changes: 48 additions & 20 deletions dist/setup/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25645,6 +25645,28 @@ function range(n, m) {
exports.range = range;
//# sourceMappingURL=Set.js.map

/***/ }),

/***/ 694:
/***/ (function(__unusedmodule, exports) {

"use strict";

Object.defineProperty(exports, "__esModule", { value: true });
exports.INPUT_VERSION = 'version';
exports.INPUT_JAVA_VERSION = 'java-version';
exports.INPUT_ARCHITECTURE = 'architecture';
exports.INPUT_JAVA_PACKAGE = 'java-package';
exports.INPUT_JDK_FILE = 'jdkFile';
exports.INPUT_SERVER_ID = 'server-id';
exports.INPUT_SERVER_USERNAME = 'server-username';
exports.INPUT_SERVER_PASSWORD = 'server-password';
exports.INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
exports.INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
exports.INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
exports.STATE_GPG_PRIVATE_KEY_FINGERPRINT = 'gpg-private-key-fingerprint';


/***/ }),

/***/ 695:
Expand Down Expand Up @@ -28650,40 +28672,46 @@ const core = __importStar(__webpack_require__(470));
const installer = __importStar(__webpack_require__(923));
const auth = __importStar(__webpack_require__(331));
const gpg = __importStar(__webpack_require__(884));
const constants = __importStar(__webpack_require__(694));
const path = __importStar(__webpack_require__(622));
const DEFAULT_ID = 'github';
const DEFAULT_USERNAME = 'GITHUB_ACTOR';
const DEFAULT_PASSWORD = 'GITHUB_TOKEN';
const DEFAULT_GPG_PRIVATE_KEY = undefined;
const DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
function run() {
return __awaiter(this, void 0, void 0, function* () {
try {
let version = core.getInput('version');
let version = core.getInput(constants.INPUT_VERSION);
if (!version) {
version = core.getInput('java-version', { required: true });
version = core.getInput(constants.INPUT_JAVA_VERSION, { required: true });
}
const arch = core.getInput('architecture', { required: true });
const javaPackage = core.getInput('java-package', { required: true });
const jdkFile = core.getInput('jdkFile', { required: false }) || '';
const arch = core.getInput(constants.INPUT_ARCHITECTURE, { required: true });
const javaPackage = core.getInput(constants.INPUT_JAVA_PACKAGE, {
required: true
});
const jdkFile = core.getInput(constants.INPUT_JDK_FILE, { required: false });
yield installer.getJava(version, arch, jdkFile, javaPackage);
const matchersPath = path.join(__dirname, '..', '..', '.github');
console.log(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);
const id = core.getInput('server-id', { required: false }) || DEFAULT_ID;
const username = core.getInput('server-username', { required: false }) || DEFAULT_USERNAME;
const password = core.getInput('server-password', { required: false }) || DEFAULT_PASSWORD;
const gpgPrivateKey = core.getInput('gpg-private-key', { required: false }) ||
DEFAULT_GPG_PRIVATE_KEY;
const gpgPassphrase = core.getInput('gpg-passphrase', { required: false }) ||
(gpgPrivateKey ? DEFAULT_GPG_PASSPHRASE : undefined);
core.info(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);
const id = core.getInput(constants.INPUT_SERVER_ID, { required: false });
const username = core.getInput(constants.INPUT_SERVER_USERNAME, {
required: false
});
const password = core.getInput(constants.INPUT_SERVER_PASSWORD, {
required: false
});
const gpgPrivateKey = core.getInput(constants.INPUT_GPG_PRIVATE_KEY, {
required: false
});
const gpgPassphrase = core.getInput(constants.INPUT_GPG_PASSPHRASE, { required: false }) ||
(gpgPrivateKey ? constants.INPUT_DEFAULT_GPG_PASSPHRASE : undefined);
if (gpgPrivateKey) {
core.setSecret(gpgPrivateKey);
}
if (gpgPassphrase) {
core.setSecret(gpgPassphrase);
}
yield auth.configAuthentication(id, username, password, gpgPassphrase);
if (gpgPrivateKey) {
console.log('importing private key');
core.info('importing private key');
const keyFingerprint = (yield gpg.importKey(gpgPrivateKey)) || '';
core.saveState('gpg-private-key-fingerprint', keyFingerprint);
core.saveState(constants.STATE_GPG_PRIVATE_KEY_FINGERPRINT, keyFingerprint);
}
}
catch (error) {
Expand Down
9 changes: 6 additions & 3 deletions src/cleanup-java.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,14 @@
import * as core from '@actions/core';
import * as gpg from './gpg';
import * as constants from './constants';

async function run() {
if (core.getInput('gpg-private-key', {required: false})) {
console.log('removing private key from keychain');
if (core.getInput(constants.INPUT_GPG_PRIVATE_KEY, {required: false})) {
core.info('removing private key from keychain');
try {
const keyFingerprint = core.getState('gpg-private-key-fingerprint');
const keyFingerprint = core.getState(
constants.STATE_GPG_PRIVATE_KEY_FINGERPRINT
);
await gpg.deleteKey(keyFingerprint);
} catch (error) {
core.setFailed(error.message);

@yaananth yaananth Jul 17, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What could be the error message here? If we fail to clean up, should we surface that as an actionable item to end user so that they can manually clean it up (relevant to self-hosted runners)

@jaredpetersen jaredpetersen Jul 17, 2020 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is just going to output whatever we get from running the failed GPG command. So for example if it failed to find the key for whatever reason, it's going to tell us

>> gpg --batch --yes --delete-keys hello
gpg: key "hello" not found: Not found
gpg: hello: delete key failed: Not found

Or if it failed, it would just be whatever @action/exec surfaces for errors (which may look a little raw).

I can try to simulate what that might look like a little more concretely tonight if I push up a bad cleanup change.

@jaredpetersen jaredpetersen Jul 17, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might be safer to just say "failed to delete key" rather than the actual GPG output so that we don't leak anything accidentally. If this fails on a hosted runner, they could run the delete command themselves to get a better understanding of what exactly went wrong.

I think I'll go down that route instead.

Expand Down
14 changes: 14 additions & 0 deletions src/constants.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
export const INPUT_VERSION = 'version';
export const INPUT_JAVA_VERSION = 'java-version';
export const INPUT_ARCHITECTURE = 'architecture';
export const INPUT_JAVA_PACKAGE = 'java-package';
export const INPUT_JDK_FILE = 'jdkFile';
export const INPUT_SERVER_ID = 'server-id';
export const INPUT_SERVER_USERNAME = 'server-username';
export const INPUT_SERVER_PASSWORD = 'server-password';
export const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key';
export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';

export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';

export const STATE_GPG_PRIVATE_KEY_FINGERPRINT = 'gpg-private-key-fingerprint';
56 changes: 31 additions & 25 deletions src/setup-java.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,51 +2,57 @@ import * as core from '@actions/core';
import * as installer from './installer';
import * as auth from './auth';
import * as gpg from './gpg';
import * as constants from './constants';
import * as path from 'path';

const DEFAULT_ID = 'github';
const DEFAULT_USERNAME = 'GITHUB_ACTOR';
const DEFAULT_PASSWORD = 'GITHUB_TOKEN';
const DEFAULT_GPG_PRIVATE_KEY = undefined;
const DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';

async function run() {
try {
let version = core.getInput('version');
let version = core.getInput(constants.INPUT_VERSION);
if (!version) {
version = core.getInput('java-version', {required: true});
version = core.getInput(constants.INPUT_JAVA_VERSION, {required: true});
}
const arch = core.getInput('architecture', {required: true});
const javaPackage = core.getInput('java-package', {required: true});
const jdkFile = core.getInput('jdkFile', {required: false}) || '';
const arch = core.getInput(constants.INPUT_ARCHITECTURE, {required: true});
const javaPackage = core.getInput(constants.INPUT_JAVA_PACKAGE, {
required: true
});
const jdkFile = core.getInput(constants.INPUT_JDK_FILE, {required: false});

await installer.getJava(version, arch, jdkFile, javaPackage);

const matchersPath = path.join(__dirname, '..', '..', '.github');
console.log(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);

const id = core.getInput('server-id', {required: false}) || DEFAULT_ID;
const username =
core.getInput('server-username', {required: false}) || DEFAULT_USERNAME;
const password =
core.getInput('server-password', {required: false}) || DEFAULT_PASSWORD;
const gpgPrivateKey =
core.getInput('gpg-private-key', {required: false}) ||
DEFAULT_GPG_PRIVATE_KEY;
core.info(`##[add-matcher]${path.join(matchersPath, 'java.json')}`);

const id = core.getInput(constants.INPUT_SERVER_ID, {required: false});
const username = core.getInput(constants.INPUT_SERVER_USERNAME, {
required: false
});
const password = core.getInput(constants.INPUT_SERVER_PASSWORD, {
required: false
});
const gpgPrivateKey = core.getInput(constants.INPUT_GPG_PRIVATE_KEY, {
required: false
});
const gpgPassphrase =
core.getInput('gpg-passphrase', {required: false}) ||
(gpgPrivateKey ? DEFAULT_GPG_PASSPHRASE : undefined);
core.getInput(constants.INPUT_GPG_PASSPHRASE, {required: false}) ||
(gpgPrivateKey ? constants.INPUT_DEFAULT_GPG_PASSPHRASE : undefined);

if (gpgPrivateKey) {
core.setSecret(gpgPrivateKey);
}

if (gpgPassphrase) {
core.setSecret(gpgPassphrase);
}

await auth.configAuthentication(id, username, password, gpgPassphrase);

if (gpgPrivateKey) {
console.log('importing private key');
core.info('importing private key');
const keyFingerprint = (await gpg.importKey(gpgPrivateKey)) || '';
core.saveState('gpg-private-key-fingerprint', keyFingerprint);
core.saveState(
constants.STATE_GPG_PRIVATE_KEY_FINGERPRINT,
keyFingerprint
);
}
} catch (error) {
core.setFailed(error.message);
Expand Down