Skip to content

Commit b96213d

Browse files
johnoliverjohnoliver
authored
Set default signature verification for supported distributions (actions#1246)
* Default signature verification for supported distributions * Delegate signature defaults to installers
1 parent 1dbac3c commit b96213d

9 files changed

Lines changed: 82 additions & 19 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ steps:
159159
| `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
160160
| `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
161161
| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
162-
| `verify-signature` | Verify downloaded Java package signatures when supported. Currently supported for `temurin` and `microsoft`. | `false` |
162+
| `verify-signature` | Verify downloaded Java package signatures when supported. Defaults to `true` for `temurin` and `microsoft`, and `false` for other distributions. | Automatically enabled for `temurin` and `microsoft` |
163163
| `verify-signature-public-key` | ASCII-armored GPG public key to use for signature verification. Overrides the bundled key. | |
164164
| `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
165165
| `cache` | Enable dependency caching for `maven`, `gradle`, or `sbt`. | |

‎__tests__/distributors/microsoft-installer.test.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -398,13 +398,12 @@ describe('downloadTool', () => {
398398
jest.restoreAllMocks();
399399
});
400400

401-
it('verifies signature when enabled', async () => {
401+
it('verifies signatures by default', async () => {
402402
const signedDistribution = new MicrosoftDistributions({
403403
version: '17',
404404
architecture: 'x64',
405405
packageType: 'jdk',
406-
checkLatest: false,
407-
verifySignature: true
406+
checkLatest: false
408407
});
409408

410409
await signedDistribution['downloadTool']({

‎__tests__/distributors/temurin-installer.test.ts‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -457,14 +457,13 @@ describe('downloadTool', () => {
457457
jest.restoreAllMocks();
458458
});
459459

460-
it('verifies signature when enabled', async () => {
460+
it('verifies signatures by default', async () => {
461461
const distribution = new TemurinDistribution(
462462
{
463463
version: '17',
464464
architecture: 'x64',
465465
packageType: 'jdk',
466-
checkLatest: false,
467-
verifySignature: true
466+
checkLatest: false
468467
},
469468
TemurinImplementation.Hotspot
470469
);
@@ -482,6 +481,27 @@ describe('downloadTool', () => {
482481
);
483482
});
484483

484+
it('does not verify signatures when explicitly disabled', async () => {
485+
const distribution = new TemurinDistribution(
486+
{
487+
version: '17',
488+
architecture: 'x64',
489+
packageType: 'jdk',
490+
checkLatest: false,
491+
verifySignature: false
492+
},
493+
TemurinImplementation.Hotspot
494+
);
495+
496+
await distribution['downloadTool']({
497+
version: '17.0.14+7',
498+
url: 'https://example.com/jdk.tar.gz',
499+
signatureUrl: 'https://example.com/jdk.tar.gz.sig'
500+
});
501+
502+
expect(spyVerifySignature).not.toHaveBeenCalled();
503+
});
504+
485505
it('downloads and adds matching JMODs to the JDK', async () => {
486506
spyDownloadTool
487507
.mockResolvedValueOnce('/tmp/jdk.tar.gz')
@@ -499,7 +519,8 @@ describe('downloadTool', () => {
499519
version: '25',
500520
architecture: 'x64',
501521
packageType: 'jdk+jmods',
502-
checkLatest: false
522+
checkLatest: false,
523+
verifySignature: false
503524
},
504525
TemurinImplementation.Hotspot
505526
);

‎__tests__/setup-java.test.ts‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,37 @@ describe('setup action orchestration', () => {
161161
expect(factory.getJavaDistribution).not.toHaveBeenCalled();
162162
});
163163

164+
it.each([
165+
['temurin', undefined, undefined],
166+
['zulu', undefined, undefined],
167+
['temurin', false, false],
168+
['zulu', true, true]
169+
])(
170+
'passes signature verification input for %s with explicit value %s as %s',
171+
async (distribution, explicitValue, expectedValue) => {
172+
inputs.set('distribution', distribution);
173+
multilineInputs.set('java-version', ['21']);
174+
if (explicitValue !== undefined) {
175+
inputs.set('verify-signature', String(explicitValue));
176+
booleanInputs.set('verify-signature', explicitValue);
177+
}
178+
(factory.getJavaDistribution as jest.Mock).mockReturnValue({
179+
setupJava: jest.fn(async () => ({
180+
version: '21.0.4+7',
181+
path: '/opt/java/21'
182+
}))
183+
});
184+
185+
await run();
186+
187+
expect(factory.getJavaDistribution).toHaveBeenCalledWith(
188+
distribution,
189+
expect.objectContaining({verifySignature: expectedValue}),
190+
''
191+
);
192+
}
193+
);
194+
164195
it('requires distribution when it cannot be inferred from the version file', async () => {
165196
inputs.set('java-version-file', '.java-version');
166197
(fs.readFileSync as jest.Mock).mockReturnValue(Buffer.from('21'));
@@ -200,7 +231,6 @@ describe('setup action orchestration', () => {
200231
booleanInputs.set('check-latest', true);
201232
booleanInputs.set('force-download', true);
202233
booleanInputs.set('set-default', false);
203-
booleanInputs.set('verify-signature', true);
204234
inputs.set('verify-signature-public-key', 'public-key');
205235
(fs.readFileSync as jest.Mock).mockReturnValue(
206236
Buffer.from('java=21.0.5-tem')
@@ -232,7 +262,7 @@ describe('setup action orchestration', () => {
232262
forceDownload: true,
233263
cacheJdk: false,
234264
setDefault: false,
235-
verifySignature: true,
265+
verifySignature: undefined,
236266
verifySignaturePublicKey: 'public-key'
237267
},
238268
'/tmp/java.tar.gz'

‎action.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ inputs:
4141
verify-signature:
4242
description: 'Verify downloaded Java package signatures when supported by the selected distribution'
4343
required: false
44-
default: false
4544
verify-signature-public-key:
4645
description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
4746
required: false

‎dist/setup/242.index.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,8 @@ class JavaBase {
244244
installerOptions.setDefault !== undefined
245245
? installerOptions.setDefault
246246
: true;
247-
this.verifySignature = installerOptions.verifySignature ?? false;
247+
this.verifySignature =
248+
installerOptions.verifySignature ?? this.supportsSignatureVerification();
248249
this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
249250
}
250251
async downloadAndVerify(javaRelease) {

‎dist/setup/index.js‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36376,7 +36376,6 @@ async function run() {
3637636376
const checkLatest = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_CHECK_LATEST */.YM, false);
3637736377
const forceDownload = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_FORCE_DOWNLOAD */.I9, false);
3637836378
const setDefault = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_SET_DEFAULT */.E8, true);
36379-
const verifySignature = (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy, false);
3638036379
const verifySignaturePublicKey = setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE_PUBLIC_KEY */.u) || undefined;
3638136380
const toolchainIds = setup_java_core/* getMultilineInput */.q3(constants/* INPUT_MVN_TOOLCHAIN_ID */.nr);
3638236381
let actionError;
@@ -36404,6 +36403,7 @@ async function run() {
3640436403
else if (!distributionName) {
3640536404
throw new Error('distribution input is required when not specified in the version file');
3640636405
}
36406+
const verifySignature = getVerifySignatureInput();
3640736407
const installerInputsOptions = {
3640836408
architecture,
3640936409
packageType,
@@ -36428,6 +36428,7 @@ async function run() {
3642836428
if (!distributionName) {
3642936429
throw new Error('distribution input is required');
3643036430
}
36431+
const verifySignature = getVerifySignatureInput();
3643136432
const installerInputsOptions = {
3643236433
architecture,
3643336434
packageType,
@@ -36492,6 +36493,11 @@ function getJdkFileInput() {
3649236493
}
3649336494
return jdkFile || deprecatedJdkFile;
3649436495
}
36496+
function getVerifySignatureInput() {
36497+
return setup_java_core/* getInput */.V4(constants/* INPUT_VERIFY_SIGNATURE */.qy).trim()
36498+
? (0,util/* getBooleanInput */.Vt)(constants/* INPUT_VERIFY_SIGNATURE */.qy)
36499+
: undefined;
36500+
}
3649536501
async function installVersion(version, options, toolchainId = 0) {
3649636502
const { distributionName, jdkFile, architecture, packageType, checkLatest, forceDownload, cacheJdk, setDefault, verifySignature, verifySignaturePublicKey, toolchainIds } = options;
3649736503
const installerOptions = {

‎src/distributions/base-installer.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,8 @@ export abstract class JavaBase {
6868
installerOptions.setDefault !== undefined
6969
? installerOptions.setDefault
7070
: true;
71-
this.verifySignature = installerOptions.verifySignature ?? false;
71+
this.verifySignature =
72+
installerOptions.verifySignature ?? this.supportsSignatureVerification();
7273
this.verifySignaturePublicKey = installerOptions.verifySignaturePublicKey;
7374
}
7475

‎src/setup-java.ts‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ export async function run() {
2929
const checkLatest = getBooleanInput(constants.INPUT_CHECK_LATEST, false);
3030
const forceDownload = getBooleanInput(constants.INPUT_FORCE_DOWNLOAD, false);
3131
const setDefault = getBooleanInput(constants.INPUT_SET_DEFAULT, true);
32-
const verifySignature = getBooleanInput(
33-
constants.INPUT_VERIFY_SIGNATURE,
34-
false
35-
);
3632
const verifySignaturePublicKey =
3733
core.getInput(constants.INPUT_VERIFY_SIGNATURE_PUBLIC_KEY) || undefined;
3834
const toolchainIds = core.getMultilineInput(constants.INPUT_MVN_TOOLCHAIN_ID);
@@ -80,6 +76,8 @@ export async function run() {
8076
);
8177
}
8278

79+
const verifySignature = getVerifySignatureInput();
80+
8381
const installerInputsOptions: installerInputsOptions = {
8482
architecture,
8583
packageType,
@@ -107,6 +105,8 @@ export async function run() {
107105
throw new Error('distribution input is required');
108106
}
109107

108+
const verifySignature = getVerifySignatureInput();
109+
110110
const installerInputsOptions: installerInputsOptions = {
111111
architecture,
112112
packageType,
@@ -192,6 +192,12 @@ function getJdkFileInput(): string {
192192
return jdkFile || deprecatedJdkFile;
193193
}
194194

195+
function getVerifySignatureInput(): boolean | undefined {
196+
return core.getInput(constants.INPUT_VERIFY_SIGNATURE).trim()
197+
? getBooleanInput(constants.INPUT_VERIFY_SIGNATURE)
198+
: undefined;
199+
}
200+
195201
async function installVersion(
196202
version: string,
197203
options: installerInputsOptions,
@@ -263,7 +269,7 @@ interface installerInputsOptions {
263269
forceDownload: boolean;
264270
cacheJdk: boolean;
265271
setDefault: boolean;
266-
verifySignature: boolean;
272+
verifySignature: boolean | undefined;
267273
verifySignaturePublicKey: string | undefined;
268274
distributionName: string;
269275
jdkFile: string;

0 commit comments

Comments
 (0)