From 7f2b3ca2cf6fbb25ecc4f09cc8503e6bd5295089 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 9 Sep 2026 04:53:15 +0000 Subject: [PATCH] Fix signature verification GPG homes on long runner paths --- __tests__/gpg.test.ts | 57 ++++++++++++++++++++++++++++++++++++++++ dist/cleanup/index.js | 10 ++++--- dist/setup/220.index.js | 58 ++++++++++++++++++++++------------------- dist/setup/463.index.js | 58 ++++++++++++++++++++++------------------- dist/setup/81.index.js | 58 ++++++++++++++++++++++------------------- src/gpg.ts | 11 +++++--- 6 files changed, 165 insertions(+), 87 deletions(-) diff --git a/__tests__/gpg.test.ts b/__tests__/gpg.test.ts index 2e411bcc..3db50c45 100644 --- a/__tests__/gpg.test.ts +++ b/__tests__/gpg.test.ts @@ -9,6 +9,7 @@ import { } from '@jest/globals'; import {fileURLToPath} from 'url'; import * as fs from 'fs'; +import * as os from 'os'; import * as path from 'path'; import * as io from '@actions/io'; @@ -222,6 +223,62 @@ describe('gpg tests', () => { }); describe('verifyPackageSignature', () => { + it.each(['success', 'import failure', 'verification failure'])( + 'uses the OS temp directory with a long RUNNER_TEMP and cleans up after %s', + async outcome => { + const longRunnerTemp = path.join( + tempDir, + 'long-runner-path-'.repeat(8) + ); + const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig'); + let gpgHome = ''; + process.env['RUNNER_TEMP'] = longRunnerTemp; + fs.mkdirSync(longRunnerTemp, {recursive: true}); + fs.writeFileSync(signaturePath, 'signature'); + (tc.downloadTool as jest.Mock).mockResolvedValue(signaturePath); + (exec.exec as jest.Mock).mockImplementation( + async (_command: string, args: string[]) => { + gpgHome = path.join(os.tmpdir(), path.posix.basename(args[1])); + expect(args[1]).toBe(gpg.toGpgPath(gpgHome)); + expect( + fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8') + ).toBe('public key'); + if (process.platform !== 'win32') { + expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700); + } + if ( + (outcome === 'import failure' && args.includes('--import')) || + (outcome === 'verification failure' && args.includes('--verify')) + ) { + throw new Error(outcome); + } + return 0; + } + ); + + try { + const verification = gpg.verifyPackageSignature( + path.join(tempDir, 'jdk.tar.gz'), + 'https://example.com/jdk.tar.gz.sig', + 'public key' + ); + if (outcome === 'success') { + await verification; + } else { + await expect(verification).rejects.toThrow(outcome); + } + expect(exec.exec).toHaveBeenCalledTimes( + outcome === 'import failure' ? 1 : 2 + ); + expect(fs.existsSync(gpgHome)).toBe(false); + expect(fs.existsSync(signaturePath)).toBe(false); + expect(fs.readdirSync(longRunnerTemp)).toEqual([]); + } finally { + process.env['RUNNER_TEMP'] = tempDir; + } + } + ); + it('imports bundled key and verifies package', async () => { const publicKeyContent = '-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----'; diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 2ae9fe8d..4ce7c937 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -35747,6 +35747,8 @@ __nccwpck_require__.d(__webpack_exports__, { var cleanup_java_core = __nccwpck_require__(3838); // EXTERNAL MODULE: external "fs" var external_fs_ = __nccwpck_require__(9896); +// EXTERNAL MODULE: external "os" +var external_os_ = __nccwpck_require__(857); // EXTERNAL MODULE: external "path" var external_path_ = __nccwpck_require__(6928); // EXTERNAL MODULE: external "crypto" @@ -35767,6 +35769,7 @@ var src_util = __nccwpck_require__(4527); + const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { @@ -35783,8 +35786,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix) { - const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix)); +function createGpgHome(prefix, tempDir = util.getTempDir()) { + const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix)); if (process.platform !== 'win32') { fs.chmodSync(gpgHome, 0o700); } @@ -35843,7 +35846,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten const signaturePath = await tc.downloadTool(signatureUrl); let gpgHome; try { - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); + // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); } catch (error) { try { diff --git a/dist/setup/220.index.js b/dist/setup/220.index.js index b1af6f1a..fac9a566 100644 --- a/dist/setup/220.index.js +++ b/dist/setup/220.index.js @@ -184,14 +184,17 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); + @@ -202,7 +205,7 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -215,8 +218,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -224,7 +227,7 @@ function createGpgHome(prefix) { } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -232,7 +235,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -254,32 +257,33 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); + // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -291,19 +295,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -313,8 +317,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); } } diff --git a/dist/setup/463.index.js b/dist/setup/463.index.js index c07adf58..53f7245f 100644 --- a/dist/setup/463.index.js +++ b/dist/setup/463.index.js @@ -296,14 +296,17 @@ class TemurinDistribution extends base_installer/* JavaBase */.O { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); + @@ -314,7 +317,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -327,8 +330,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -336,7 +339,7 @@ function createGpgHome(prefix) { } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -344,7 +347,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -366,32 +369,33 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); + // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -403,19 +407,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -425,8 +429,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); } } diff --git a/dist/setup/81.index.js b/dist/setup/81.index.js index eb322254..14af642f 100644 --- a/dist/setup/81.index.js +++ b/dist/setup/81.index.js @@ -271,14 +271,17 @@ async function write(directory, settings, overwriteSettings) { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); +/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); + @@ -289,7 +292,7 @@ async function write(directory, settings, overwriteSettings) { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -302,8 +305,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -311,7 +314,7 @@ function createGpgHome(prefix) { } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -319,7 +322,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -341,32 +344,33 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); + // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -378,19 +382,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -400,8 +404,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); } } diff --git a/src/gpg.ts b/src/gpg.ts index 0d4f76aa..8315103a 100644 --- a/src/gpg.ts +++ b/src/gpg.ts @@ -1,4 +1,5 @@ import * as fs from 'fs'; +import * as os from 'os'; import * as path from 'path'; import {randomUUID} from 'crypto'; import * as io from '@actions/io'; @@ -26,8 +27,11 @@ export function toGpgPath(p: string): string { .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix: string): string { - const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix)); +function createGpgHome( + prefix: string, + tempDir: string = util.getTempDir() +): string { + const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix)); if (process.platform !== 'win32') { fs.chmodSync(gpgHome, 0o700); } @@ -107,7 +111,8 @@ export async function verifyPackageSignature( const signaturePath = await tc.downloadTool(signatureUrl); let gpgHome: string; try { - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); + // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); } catch (error) { try { await io.rmRF(signaturePath);