actions/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java.git synced 2026-09-10 04:34:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix signature verification GPG homes on long runner paths

Browse Source
This commit is contained in:
copilot-swe-agent[bot]
2026-09-09 04:53:15 +00:00
committed by GitHub
parent d8572d4b37
commit 7f2b3ca2cf
6 changed files with 165 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/gpg.test.ts
+57
View File
@@ -9,6 +9,7 @@ import {
} from '@jest/globals'; } from '@jest/globals';
import {fileURLToPath} from 'url'; import {fileURLToPath} from 'url';
import * as fs from 'fs'; import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path'; import * as path from 'path';
import * as io from '@actions/io'; import * as io from '@actions/io';
@@ -222,6 +223,62 @@ describe('gpg tests', () => {
}); });
describe('verifyPackageSignature', () => { describe('verifyPackageSignature', () => {
it.each(['success', 'import failure', 'verification failure'])(
'uses the OS temp directory with a long RUNNER_TEMP and cleans up after %s',
async outcome => {
const longRunnerTemp = path.join(
tempDir,
'long-runner-path-'.repeat(8)
);
const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig');
let gpgHome = '';
process.env['RUNNER_TEMP'] = longRunnerTemp;
fs.mkdirSync(longRunnerTemp, {recursive: true});
fs.writeFileSync(signaturePath, 'signature');
(tc.downloadTool as jest.Mock<any>).mockResolvedValue(signaturePath);
(exec.exec as jest.Mock<any>).mockImplementation(
async (_command: string, args: string[]) => {
gpgHome = path.join(os.tmpdir(), path.posix.basename(args[1]));
expect(args[1]).toBe(gpg.toGpgPath(gpgHome));
expect(
fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8')
).toBe('public key');
if (process.platform !== 'win32') {
expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700);
}
if (
(outcome === 'import failure' && args.includes('--import')) ||
(outcome === 'verification failure' && args.includes('--verify'))
) {
throw new Error(outcome);
}
return 0;
}
);
try {
const verification = gpg.verifyPackageSignature(
path.join(tempDir, 'jdk.tar.gz'),
'https://example.com/jdk.tar.gz.sig',
'public key'
);
if (outcome === 'success') {
await verification;
} else {
await expect(verification).rejects.toThrow(outcome);
}
expect(exec.exec).toHaveBeenCalledTimes(
outcome === 'import failure' ? 1 : 2
);
expect(fs.existsSync(gpgHome)).toBe(false);
expect(fs.existsSync(signaturePath)).toBe(false);
expect(fs.readdirSync(longRunnerTemp)).toEqual([]);
} finally {
process.env['RUNNER_TEMP'] = tempDir;
}
}
);
it('imports bundled key and verifies package', async () => { it('imports bundled key and verifies package', async () => {
const publicKeyContent = const publicKeyContent =
'-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----'; '-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----';
dist/cleanup/index.js
Vendored
+7 -3
View File
@@ -35747,6 +35747,8 @@ __nccwpck_require__.d(__webpack_exports__, {
var cleanup_java_core = __nccwpck_require__(3838); var cleanup_java_core = __nccwpck_require__(3838);
// EXTERNAL MODULE: external "fs" // EXTERNAL MODULE: external "fs"
var external_fs_ = __nccwpck_require__(9896); var external_fs_ = __nccwpck_require__(9896);
// EXTERNAL MODULE: external "os"
var external_os_ = __nccwpck_require__(857);
// EXTERNAL MODULE: external "path" // EXTERNAL MODULE: external "path"
var external_path_ = __nccwpck_require__(6928); var external_path_ = __nccwpck_require__(6928);
// EXTERNAL MODULE: external "crypto" // EXTERNAL MODULE: external "crypto"
@@ -35767,6 +35769,7 @@ var src_util = __nccwpck_require__(4527);
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
@@ -35783,8 +35786,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix) { function createGpgHome(prefix, tempDir = util.getTempDir()) {
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix)); const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs.chmodSync(gpgHome, 0o700); fs.chmodSync(gpgHome, 0o700);
} }
@@ -35843,7 +35846,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
const signaturePath = await tc.downloadTool(signatureUrl); const signaturePath = await tc.downloadTool(signatureUrl);
let gpgHome; let gpgHome;
try { try {
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir());
} }
catch (error) { catch (error) {
try { try {
dist/setup/220.index.js
Vendored
+31 -27
View File
@@ -184,14 +184,17 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -202,7 +205,7 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -215,8 +218,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -224,7 +227,7 @@ function createGpgHome(prefix) {
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -232,7 +235,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -254,32 +257,33 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -291,19 +295,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -313,8 +317,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
} }
} }
dist/setup/463.index.js
Vendored
+31 -27
View File
@@ -296,14 +296,17 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -314,7 +317,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -327,8 +330,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -336,7 +339,7 @@ function createGpgHome(prefix) {
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -344,7 +347,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -366,32 +369,33 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -403,19 +407,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -425,8 +429,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
} }
} }
dist/setup/81.index.js
Vendored
+31 -27
View File
@@ -271,14 +271,17 @@ async function write(directory, settings, overwriteSettings) {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -289,7 +292,7 @@ async function write(directory, settings, overwriteSettings) {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -302,8 +305,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -311,7 +314,7 @@ function createGpgHome(prefix) {
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -319,7 +322,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -341,32 +344,33 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir());
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -378,19 +382,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -400,8 +404,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome);
} }
} }
src/gpg.ts
+8 -3
View File
@@ -1,4 +1,5 @@
import * as fs from 'fs'; import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path'; import * as path from 'path';
import {randomUUID} from 'crypto'; import {randomUUID} from 'crypto';
import * as io from '@actions/io'; import * as io from '@actions/io';
@@ -26,8 +27,11 @@ export function toGpgPath(p: string): string {
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix: string): string { function createGpgHome(
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix)); prefix: string,
tempDir: string = util.getTempDir()
): string {
const gpgHome = fs.mkdtempSync(path.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs.chmodSync(gpgHome, 0o700); fs.chmodSync(gpgHome, 0o700);
} }
@@ -107,7 +111,8 @@ export async function verifyPackageSignature(
const signaturePath = await tc.downloadTool(signatureUrl); const signaturePath = await tc.downloadTool(signatureUrl);
let gpgHome: string; let gpgHome: string;
try { try {
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX); // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir());
} catch (error) { } catch (error) {
try { try {
await io.rmRF(signaturePath); await io.rmRF(signaturePath);