mirror of
https://github.com/actions/setup-java.git
synced 2026-09-09 20:24:21 +02:00
Fix signature verification GPG homes on long runner paths
This commit is contained in:
copilot-swe-agent[bot]
@@ -9,6 +9,7 @@ import {
|
||||
} from '@jest/globals';
|
||||
import {fileURLToPath} from 'url';
|
||||
import * as fs from 'fs';
|
||||
import * as os from 'os';
|
||||
import * as path from 'path';
|
||||
import * as io from '@actions/io';
|
||||
|
||||
@@ -222,6 +223,62 @@ describe('gpg tests', () => {
|
||||
});
|
||||
|
||||
describe('verifyPackageSignature', () => {
|
||||
it.each(['success', 'import failure', 'verification failure'])(
|
||||
'uses the OS temp directory with a long RUNNER_TEMP and cleans up after %s',
|
||||
async outcome => {
|
||||
const longRunnerTemp = path.join(
|
||||
tempDir,
|
||||
'long-runner-path-'.repeat(8)
|
||||
);
|
||||
const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig');
|
||||
let gpgHome = '';
|
||||
process.env['RUNNER_TEMP'] = longRunnerTemp;
|
||||
fs.mkdirSync(longRunnerTemp, {recursive: true});
|
||||
fs.writeFileSync(signaturePath, 'signature');
|
||||
(tc.downloadTool as jest.Mock<any>).mockResolvedValue(signaturePath);
|
||||
(exec.exec as jest.Mock<any>).mockImplementation(
|
||||
async (_command: string, args: string[]) => {
|
||||
gpgHome = path.join(os.tmpdir(), path.posix.basename(args[1]));
|
||||
expect(args[1]).toBe(gpg.toGpgPath(gpgHome));
|
||||
expect(
|
||||
fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8')
|
||||
).toBe('public key');
|
||||
if (process.platform !== 'win32') {
|
||||
expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700);
|
||||
}
|
||||
if (
|
||||
(outcome === 'import failure' && args.includes('--import')) ||
|
||||
(outcome === 'verification failure' && args.includes('--verify'))
|
||||
) {
|
||||
throw new Error(outcome);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
);
|
||||
|
||||
try {
|
||||
const verification = gpg.verifyPackageSignature(
|
||||
path.join(tempDir, 'jdk.tar.gz'),
|
||||
'https://example.com/jdk.tar.gz.sig',
|
||||
'public key'
|
||||
);
|
||||
if (outcome === 'success') {
|
||||
await verification;
|
||||
} else {
|
||||
await expect(verification).rejects.toThrow(outcome);
|
||||
}
|
||||
expect(exec.exec).toHaveBeenCalledTimes(
|
||||
outcome === 'import failure' ? 1 : 2
|
||||
);
|
||||
expect(fs.existsSync(gpgHome)).toBe(false);
|
||||
expect(fs.existsSync(signaturePath)).toBe(false);
|
||||
expect(fs.readdirSync(longRunnerTemp)).toEqual([]);
|
||||
} finally {
|
||||
process.env['RUNNER_TEMP'] = tempDir;
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
it('imports bundled key and verifies package', async () => {
|
||||
const publicKeyContent =
|
||||
'-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----';
|
||||
|
||||
Vendored
+7
-3
@@ -35747,6 +35747,8 @@ __nccwpck_require__.d(__webpack_exports__, {
|
||||
var cleanup_java_core = __nccwpck_require__(3838);
|
||||
// EXTERNAL MODULE: external "fs"
|
||||
var external_fs_ = __nccwpck_require__(9896);
|
||||
// EXTERNAL MODULE: external "os"
|
||||
var external_os_ = __nccwpck_require__(857);
|
||||
// EXTERNAL MODULE: external "path"
|
||||
var external_path_ = __nccwpck_require__(6928);
|
||||
// EXTERNAL MODULE: external "crypto"
|
||||
@@ -35767,6 +35769,7 @@ var src_util = __nccwpck_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
async function isGpgAvailable() {
|
||||
@@ -35783,8 +35786,8 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix));
|
||||
function createGpgHome(prefix, tempDir = util.getTempDir()) {
|
||||
const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
@@ -35843,7 +35846,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
const signaturePath = await tc.downloadTool(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir());
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
|
||||
Vendored
+31
-27
@@ -184,14 +184,17 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -202,7 +205,7 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
async function isGpgAvailable() {
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
|
||||
}
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
@@ -215,8 +218,8 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
@@ -224,7 +227,7 @@ function createGpgHome(prefix) {
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
@@ -232,7 +235,7 @@ async function importKey(privateKey) {
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -254,32 +257,33 @@ async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -291,19 +295,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
? publicKeyContent
|
||||
: [publicKeyContent];
|
||||
const publicKeyFiles = publicKeys.map((publicKey, index) => {
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
|
||||
return toGpgPath(publicKeyFile);
|
||||
});
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
...publicKeyFiles
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -313,8 +317,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Vendored
+31
-27
@@ -296,14 +296,17 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -314,7 +317,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
async function isGpgAvailable() {
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
|
||||
}
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
@@ -327,8 +330,8 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
@@ -336,7 +339,7 @@ function createGpgHome(prefix) {
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
@@ -344,7 +347,7 @@ async function importKey(privateKey) {
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -366,32 +369,33 @@ async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -403,19 +407,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
? publicKeyContent
|
||||
: [publicKeyContent];
|
||||
const publicKeyFiles = publicKeys.map((publicKey, index) => {
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
|
||||
return toGpgPath(publicKeyFile);
|
||||
});
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
...publicKeyFiles
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -425,8 +429,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Vendored
+31
-27
@@ -271,14 +271,17 @@ async function write(directory, settings, overwriteSettings) {
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
|
||||
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -289,7 +292,7 @@ async function write(directory, settings, overwriteSettings) {
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
async function isGpgAvailable() {
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
|
||||
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
|
||||
}
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
@@ -302,8 +305,8 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
@@ -311,7 +314,7 @@ function createGpgHome(prefix) {
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
@@ -319,7 +322,7 @@ async function importKey(privateKey) {
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -341,32 +344,33 @@ async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -378,19 +382,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
? publicKeyContent
|
||||
: [publicKeyContent];
|
||||
const publicKeyFiles = publicKeys.map((publicKey, index) => {
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
|
||||
return toGpgPath(publicKeyFile);
|
||||
});
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
...publicKeyFiles
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -400,8 +404,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+8
-3
@@ -1,4 +1,5 @@
|
||||
import * as fs from 'fs';
|
||||
import * as os from 'os';
|
||||
import * as path from 'path';
|
||||
import {randomUUID} from 'crypto';
|
||||
import * as io from '@actions/io';
|
||||
@@ -26,8 +27,11 @@ export function toGpgPath(p: string): string {
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
|
||||
function createGpgHome(prefix: string): string {
|
||||
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix));
|
||||
function createGpgHome(
|
||||
prefix: string,
|
||||
tempDir: string = util.getTempDir()
|
||||
): string {
|
||||
const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
@@ -107,7 +111,8 @@ export async function verifyPackageSignature(
|
||||
const signaturePath = await tc.downloadTool(signatureUrl);
|
||||
let gpgHome: string;
|
||||
try {
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir());
|
||||
} catch (error) {
|
||||
try {
|
||||
await io.rmRF(signaturePath);
|
||||
|
||||
Reference in New Issue
Block a user