Fix alpine failures by switching default back to only warn on verific… - #1261
Closed
brunoborges wants to merge 2 commits into
Closed
Fix alpine failures by switching default back to only warn on verific…#1261brunoborges wants to merge 2 commits into
brunoborges wants to merge 2 commits into
Conversation
…ation failures. To prevent build failures due to missing GPG or rotated vendor keys. Also allow multiple GPG keys to be provided.
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It changes default signature-verification enforcement (security-sensitive behavior) and cache-key identity, so a final human review is needed.
Review tier: Lite
Findings: 2
New issues introduced by this change (2)
| Severity | Finding |
|---|---|
 |
src/distributions/microsoft/installer.ts — This message can be produced in the default (implicit) signature-check mode when verify-signature… |
|
src/distributions/temurin/installer.ts — This message can be surfaced even when the user did not set verify-signature (because signature… |
What changed in this PR
This PR adjusts how actions/setup-java handles JDK package signature verification (especially on Alpine), making the default behavior non-fatal (warn-only) while still allowing users to explicitly enforce verification failures as fatal. It also broadens key support to allow multiple GPG keys and updates caching identity logic and documentation accordingly.
Changes:
- Introduces an explicit “enforced vs check-and-warn” signature verification policy, with enforcement only when
verify-signature: trueis explicitly set. - Allows providing multiple public keys for signature verification and updates the JDK cache identity to reflect verification policy + key set.
- Updates docs/tests and rebuilds
dist/bundles to match runtime behavior.
| File | Description |
|---|---|
| src/jdk-cache.ts | Extends verification identity to include policy (disabled/check-and-warn/enforced) and fingerprints multi-key sets. |
| src/gpg.ts | Adds isGpgAvailable() and updates signature verification to accept/import multiple keys. |
| src/distributions/temurin/installer.ts | Makes implicit verification warn-only, adds gpg availability check, and improves failure guidance. |
| src/distributions/microsoft/installer.ts | Makes implicit verification warn-only and adds failure guidance for key rotation scenarios. |
| src/distributions/local/installer.ts | Updates cache identity callsite to new verification identity signature. |
| src/distributions/base-models.ts | Introduces SignatureVerificationKey type and updates installer options accordingly. |
| src/distributions/base-installer.ts | Tracks whether verification was explicitly requested and threads that into cache identity. |
| src/constants.ts | Adds documentation URL + standardized “key rotation / disable verification” help text. |
| README.md | Updates user-facing docs for default behavior, enforcement semantics, and multi-key input guidance. |
| docs/advanced-usage.md | Documents updated verification identity semantics and links to signature docs section. |
| action.yml | Updates input descriptions to reflect warn-by-default vs explicitly-enforced verification behavior. |
| tests/jdk-cache.test.ts | Updates/expands tests for verification policy separation and multi-key fingerprinting behavior. |
| tests/gpg.test.ts | Updates tests for multiple key import behavior and new key file naming. |
| tests/distributors/temurin-installer.test.ts | Adds coverage for implicit vs explicit behavior and gpg-unavailable behavior. |
| tests/distributors/microsoft-installer.test.ts | Adds coverage for implicit warnings vs explicit failures and missing signature behavior. |
| tests/distributors/local-installer.test.ts | Updates expectations for new “disabled” verification identity string. |
| tests/distributors/base-installer.test.ts | Updates mocks/expectations for new verification identity signature and values. |
| tests/cleanup-java.test.ts | Updates expectations for new “disabled” verification identity string. |
| dist/setup/index.js | Rebuilt bundle reflecting constants export additions and new verification behavior. |
| dist/setup/81.index.js | Rebuilt bundle reflecting isGpgAvailable() and multi-key import behavior. |
| dist/setup/779.index.js | Rebuilt bundle reflecting updated verification identity calculation. |
| dist/setup/463.index.js | Rebuilt bundle reflecting Temurin warn-vs-fail behavior and gpg check. |
| dist/setup/242.index.js | Rebuilt bundle reflecting verifySignatureExplicitlyRequested propagation into cache identity. |
| dist/setup/220.index.js | Rebuilt bundle reflecting Microsoft warn-vs-fail behavior and guidance text. |
| dist/setup/19.index.js | Rebuilt bundle reflecting local installer “disabled” verification identity. |
| dist/cleanup/index.js | Rebuilt cleanup bundle reflecting gpg changes and constants export additions. |
| dist/cleanup/314.index.js | Rebuilt cleanup bundle reflecting updated verification identity calculation. |
Suppressed comments (1)
src/distributions/temurin/installer.ts:156
- Similar to the gpg-unavailable case, this error text can be emitted as a warning even when
verify-signaturewas omitted (default check-and-warn mode). Consider adjusting the wording to distinguish implicit verification from explicitly requested enforcement, to avoid confusing users who didn’t set the input.
if (!release.signatureUrl) {
throw new Error(
`Input 'verify-signature' is enabled, but no signature URL was found for Temurin version ${release.version}.`
);
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+39
to
+42
| if (!javaRelease.signatureUrl) { | ||
| throw new Error( | ||
| `Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.` | ||
| ); |
Comment on lines
+148
to
+151
| if (!(await gpg.isGpgAvailable())) { | ||
| throw new Error( | ||
| "Input 'verify-signature' is enabled, but gpg is not available." | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…ation failures. To prevent build failures due to missing GPG or rotated vendor keys.
Also allow multiple GPG keys to be provided.
Description:
Describe your changes.
Related issue:
Add link to the related issue.
Check list:
npm run checklocally (format, lint, build, test) and all checks pass.