Fix Alpine GPG verification failures and support multiple keys

[brunoborges]

Summary

• Imports and supersedes the now-closed Fix alpine failures by switching default back to only warn on verific… #1261.
• Rebases the original change onto main at 4889c4aff54cecfc8d479c505d9893fd814df73f.
• Preserves the original commit authorship and author date from John (1615532+johnoliver@users.noreply.github.com).
• Restores warning-only behavior as the default for GPG verification failures, preventing setup failures when GPG is unavailable or vendor keys have rotated.
• Supports providing multiple GPG verification keys.

Validation

• npm run check
• 43 test suites passed
• 1,454 tests passed

[Copilot]

Copilot review overview

🟡 Changes recommended

Microsoft signature verification should short-circuit cleanly when gpg is unavailable (matching Temurin) to avoid misleading warnings and unnecessary work in Alpine-like environments.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	src/​distributions/​microsoft/​installer.ts — Signature verification for Microsoft builds doesn’t check whether gpg is available before…

What changed in this PR

Updates signature verification behavior to avoid Alpine (musl) workflow failures by defaulting to “check and warn” (non-fatal) while still allowing users to explicitly enforce signature verification, and expands key handling to support multiple GPG keys.

Changes:

• Add an explicit “enforced vs check-and-warn vs disabled” verification policy and incorporate it into JDK cache identity keys.
• Support multiple signature verification keys (type + import path), and improve warning/error messaging with recovery guidance.
• Update docs, action metadata, compiled dist/ bundles, and tests to match the new verification semantics.

File	Description
src/​jdk-cache.ts	Expands verification identity to include enforcement policy and fingerprint multiple-key inputs.
src/​gpg.ts	Adds isGpgAvailable() and allows importing multiple public keys for signature verification.
src/​distributions/​temurin/​installer.ts	Restores default warning-only behavior; enforces failures only when explicitly requested; checks for gpg availability.
src/​distributions/​microsoft/​installer.ts	Switches default behavior to warning-only unless explicitly requested; adds key-rotation guidance to failures.
src/​distributions/​local/​installer.ts	Updates cache identity call signature for new verification identity parameters.
src/​distributions/​base-models.ts	Introduces SignatureVerificationKey and uses it for installer options.
src/​distributions/​base-installer.ts	Tracks whether verification was explicitly requested and feeds that into cache identity and enforcement behavior.
src/​constants.ts	Adds documentation URL and standardized “recovery guidance” help text for verification failures.
README.md	Documents new default vs enforced verification behavior and multi-key configuration guidance.
docs/​advanced-usage.md	Documents cache key separation across verification modes and key sets.
action.yml	Updates input descriptions to reflect new default/warn vs explicit/enforced behavior and multi-key support.
tests/​jdk-cache.test.ts	Updates and expands coverage for verification policy/key separation in cache identities.
tests/​gpg.test.ts	Adds coverage for importing multiple keys.
tests/​distributors/​temurin-installer.test.ts	Adds coverage for implicit vs explicit verification behavior and gpg availability handling.
tests/​distributors/​microsoft-installer.test.ts	Adds coverage for warning-only default behavior and enforced failure behavior.
tests/​distributors/​local-installer.test.ts	Updates expected verification identity from unverified to disabled.
tests/​distributors/​base-installer.test.ts	Updates mocks/expectations for new verification identity signature and default identity value.
tests/​cleanup-java.test.ts	Updates expected verification identity from unverified to disabled.
dist/​setup/​index.js	Updates bundled constants exports for signature verification help text.
dist/​setup/​81.index.js	Updates bundled GPG helpers to support multiple keys and isGpgAvailable().
dist/​setup/​779.index.js	Updates bundled cache identity logic for policy + multi-key fingerprinting.
dist/​setup/​463.index.js	Updates bundled Temurin behavior for warn-by-default and explicit enforcement.
dist/​setup/​242.index.js	Updates bundled base installer to track explicit verification requests and new cache identity signature.
dist/​setup/​220.index.js	Updates bundled Microsoft behavior for warn-by-default and explicit enforcement.
dist/​setup/​19.index.js	Updates bundled Local distribution cache identity call signature.
dist/​cleanup/​index.js	Updates bundled constants and GPG helpers to match runtime behavior.
dist/​cleanup/​314.index.js	Updates bundled cache identity logic for policy + multi-key fingerprinting.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.