From a5aaf7ca6008034c8011eda11cb341b121a4fb1e Mon Sep 17 00:00:00 2001 From: Bruno Borges Date: Wed, 9 Sep 2026 02:12:24 -0400 Subject: [PATCH] Keep macOS GPG verification homes within socket limits Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3 --- __tests__/gpg.test.ts | 95 +++++++++++++++++++++++++---------------- dist/cleanup/index.js | 8 ++-- dist/setup/220.index.js | 60 +++++++++++++------------- dist/setup/463.index.js | 60 +++++++++++++------------- dist/setup/81.index.js | 60 +++++++++++++------------- src/gpg.ts | 6 +-- 6 files changed, 152 insertions(+), 137 deletions(-) diff --git a/__tests__/gpg.test.ts b/__tests__/gpg.test.ts index 3db50c45..f9a0ca3c 100644 --- a/__tests__/gpg.test.ts +++ b/__tests__/gpg.test.ts @@ -14,6 +14,13 @@ import * as path from 'path'; import * as io from '@actions/io'; const __dirname = path.dirname(fileURLToPath(import.meta.url)); +const mockTmpDir = jest.fn(os.tmpdir); + +jest.unstable_mockModule('os', () => ({ + ...os, + default: {...os, tmpdir: mockTmpDir}, + tmpdir: mockTmpDir +})); jest.unstable_mockModule('@actions/exec', () => ({ exec: jest.fn() @@ -35,6 +42,7 @@ describe('gpg tests', () => { await io.rmRF(tempDir); await io.mkdirP(tempDir); jest.clearAllMocks(); + mockTmpDir.mockImplementation(os.tmpdir); (exec.exec as jest.Mock).mockResolvedValue(0); }); @@ -223,40 +231,57 @@ describe('gpg tests', () => { }); describe('verifyPackageSignature', () => { - it.each(['success', 'import failure', 'verification failure'])( - 'uses the OS temp directory with a long RUNNER_TEMP and cleans up after %s', - async outcome => { - const longRunnerTemp = path.join( - tempDir, - 'long-runner-path-'.repeat(8) - ); - const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig'); - let gpgHome = ''; - process.env['RUNNER_TEMP'] = longRunnerTemp; - fs.mkdirSync(longRunnerTemp, {recursive: true}); - fs.writeFileSync(signaturePath, 'signature'); - (tc.downloadTool as jest.Mock).mockResolvedValue(signaturePath); - (exec.exec as jest.Mock).mockImplementation( - async (_command: string, args: string[]) => { - gpgHome = path.join(os.tmpdir(), path.posix.basename(args[1])); - expect(args[1]).toBe(gpg.toGpgPath(gpgHome)); - expect( - fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8') - ).toBe('public key'); - if (process.platform !== 'win32') { - expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700); + describe.each(['long', 'canonical macOS'])('%s TMPDIR', tempDirKind => { + afterEach(() => { + process.env['RUNNER_TEMP'] = tempDir; + }); + + it.each(['success', 'import failure', 'verification failure'])( + 'uses a short macOS home or RUNNER_TEMP elsewhere and cleans up after %s', + async outcome => { + const longRunnerTemp = path.join( + tempDir, + 'long-runner-path-'.repeat(8) + ); + const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig'); + const expectedParent = + process.platform === 'darwin' ? '/tmp' : longRunnerTemp; + let gpgHome = ''; + process.env['RUNNER_TEMP'] = longRunnerTemp; + mockTmpDir.mockReturnValue( + tempDirKind === 'long' + ? longRunnerTemp + : `/private/var/folders/ab/${'c'.repeat(31)}/T` + ); + fs.mkdirSync(longRunnerTemp, {recursive: true}); + fs.writeFileSync(signaturePath, 'signature'); + (tc.downloadTool as jest.Mock).mockResolvedValue(signaturePath); + (exec.exec as jest.Mock).mockImplementation( + async (_command: string, args: string[]) => { + gpgHome = path.join(expectedParent, path.posix.basename(args[1])); + expect(args[1]).toBe(gpg.toGpgPath(gpgHome)); + if (process.platform === 'darwin') { + expect( + Buffer.byteLength(path.join(gpgHome, 'S.gpg-agent.browser')) + ).toBeLessThan(104); + } + expect( + fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8') + ).toBe('public key'); + if (process.platform !== 'win32') { + expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700); + } + if ( + (outcome === 'import failure' && args.includes('--import')) || + (outcome === 'verification failure' && + args.includes('--verify')) + ) { + throw new Error(outcome); + } + return 0; } - if ( - (outcome === 'import failure' && args.includes('--import')) || - (outcome === 'verification failure' && args.includes('--verify')) - ) { - throw new Error(outcome); - } - return 0; - } - ); + ); - try { const verification = gpg.verifyPackageSignature( path.join(tempDir, 'jdk.tar.gz'), 'https://example.com/jdk.tar.gz.sig', @@ -273,11 +298,9 @@ describe('gpg tests', () => { expect(fs.existsSync(gpgHome)).toBe(false); expect(fs.existsSync(signaturePath)).toBe(false); expect(fs.readdirSync(longRunnerTemp)).toEqual([]); - } finally { - process.env['RUNNER_TEMP'] = tempDir; } - } - ); + ); + }); it('imports bundled key and verifies package', async () => { const publicKeyContent = diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 4ce7c937..8792ad3a 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -35747,8 +35747,6 @@ __nccwpck_require__.d(__webpack_exports__, { var cleanup_java_core = __nccwpck_require__(3838); // EXTERNAL MODULE: external "fs" var external_fs_ = __nccwpck_require__(9896); -// EXTERNAL MODULE: external "os" -var external_os_ = __nccwpck_require__(857); // EXTERNAL MODULE: external "path" var external_path_ = __nccwpck_require__(6928); // EXTERNAL MODULE: external "crypto" @@ -35769,7 +35767,6 @@ var src_util = __nccwpck_require__(4527); - const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { @@ -35846,8 +35843,9 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten const signaturePath = await tc.downloadTool(signatureUrl); let gpgHome; try { - // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); + // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit. + const tempDir = process.platform === 'darwin' ? '/tmp' : util.getTempDir(); + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir); } catch (error) { try { diff --git a/dist/setup/220.index.js b/dist/setup/220.index.js index fac9a566..f5cfebc7 100644 --- a/dist/setup/220.index.js +++ b/dist/setup/220.index.js @@ -184,17 +184,14 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); - +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); @@ -205,7 +202,7 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -218,8 +215,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -227,7 +224,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -235,7 +232,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -257,33 +254,34 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); + // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit. + const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(); + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -295,19 +293,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -317,8 +315,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); } } diff --git a/dist/setup/463.index.js b/dist/setup/463.index.js index 53f7245f..02b5bfc9 100644 --- a/dist/setup/463.index.js +++ b/dist/setup/463.index.js @@ -296,17 +296,14 @@ class TemurinDistribution extends base_installer/* JavaBase */.O { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); - +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); @@ -317,7 +314,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -330,8 +327,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -339,7 +336,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -347,7 +344,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -369,33 +366,34 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); + // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit. + const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(); + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -407,19 +405,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -429,8 +427,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); } } diff --git a/dist/setup/81.index.js b/dist/setup/81.index.js index 14af642f..3ac82d8f 100644 --- a/dist/setup/81.index.js +++ b/dist/setup/81.index.js @@ -271,17 +271,14 @@ async function write(directory, settings, overwriteSettings) { /* unused harmony export GPG_HOME_PREFIX */ /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); -/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); -/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); -/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); -/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); -/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); -/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805); -/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527); - +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928); +/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982); +/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__); +/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701); +/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260); +/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805); +/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527); @@ -292,7 +289,7 @@ async function write(directory, settings, overwriteSettings) { const GPG_HOME_PREFIX = 'setup-java-gpg-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; async function isGpgAvailable() { - return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); + return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false)); } // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions @@ -305,8 +302,8 @@ function toGpgPath(p) { .replace(/\\/g, '/') .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); } -function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { - const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); +function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) { + const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix)); if (process.platform !== 'win32') { fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); } @@ -314,7 +311,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* } async function importKey(privateKey) { const gpgHome = createGpgHome(GPG_HOME_PREFIX); - const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); + const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`); try { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { encoding: 'utf-8', @@ -322,7 +319,7 @@ async function importKey(privateKey) { mode: 0o600 }); try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -344,33 +341,34 @@ async function removeGpgHome(gpgHome) { if (!gpgHome) { return; } - const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); - const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); - if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || - !path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { + const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome); + const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()); + if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir || + !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); } if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { return; } try { - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); } catch { // gpgconf may be unavailable, but directory removal must still be attempted. } - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome); } async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { - const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); + const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl); let gpgHome; try { - // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); + // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit. + const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(); + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir); } catch (error) { try { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); } catch { // ignore cleanup failures @@ -382,19 +380,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ? publicKeyContent : [publicKeyContent]; const publicKeyFiles = publicKeys.map((publicKey, index) => { - const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); + const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); return toGpgPath(publicKeyFile); }); const options = { silent: true }; - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', '--import', ...publicKeyFiles ], options); - await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ + await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [ '--homedir', toGpgPath(gpgHome), '--batch', @@ -404,8 +402,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten ], options); } finally { - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); - await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath); + await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome); } } diff --git a/src/gpg.ts b/src/gpg.ts index 8315103a..b522d126 100644 --- a/src/gpg.ts +++ b/src/gpg.ts @@ -1,5 +1,4 @@ import * as fs from 'fs'; -import * as os from 'os'; import * as path from 'path'; import {randomUUID} from 'crypto'; import * as io from '@actions/io'; @@ -111,8 +110,9 @@ export async function verifyPackageSignature( const signaturePath = await tc.downloadTool(signatureUrl); let gpgHome: string; try { - // Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. - gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); + // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit. + const tempDir = process.platform === 'darwin' ? '/tmp' : util.getTempDir(); + gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir); } catch (error) { try { await io.rmRF(signaturePath);