actions/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java.git synced 2026-09-09 20:24:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Keep macOS GPG verification homes within socket limits

Browse Source 
Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
This commit is contained in:
Bruno Borges
2026-09-09 02:12:24 -04:00
co-authored by Copilot App
parent 7f2b3ca2cf
commit a5aaf7ca60
6 changed files with 152 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/gpg.test.ts
+59 -36
View File
@@ -14,6 +14,13 @@ import * as path from 'path';
import * as io from '@actions/io'; import * as io from '@actions/io';
const __dirname = path.dirname(fileURLToPath(import.meta.url)); const __dirname = path.dirname(fileURLToPath(import.meta.url));
const mockTmpDir = jest.fn(os.tmpdir);
jest.unstable_mockModule('os', () => ({
...os,
default: {...os, tmpdir: mockTmpDir},
tmpdir: mockTmpDir
}));
jest.unstable_mockModule('@actions/exec', () => ({ jest.unstable_mockModule('@actions/exec', () => ({
exec: jest.fn() exec: jest.fn()
@@ -35,6 +42,7 @@ describe('gpg tests', () => {
await io.rmRF(tempDir); await io.rmRF(tempDir);
await io.mkdirP(tempDir); await io.mkdirP(tempDir);
jest.clearAllMocks(); jest.clearAllMocks();
mockTmpDir.mockImplementation(os.tmpdir);
(exec.exec as jest.Mock<any>).mockResolvedValue(0); (exec.exec as jest.Mock<any>).mockResolvedValue(0);
}); });
@@ -223,40 +231,57 @@ describe('gpg tests', () => {
}); });
describe('verifyPackageSignature', () => { describe('verifyPackageSignature', () => {
it.each(['success', 'import failure', 'verification failure'])( describe.each(['long', 'canonical macOS'])('%s TMPDIR', tempDirKind => {
'uses the OS temp directory with a long RUNNER_TEMP and cleans up after %s', afterEach(() => {
async outcome => { process.env['RUNNER_TEMP'] = tempDir;
const longRunnerTemp = path.join( });
tempDir,
'long-runner-path-'.repeat(8) it.each(['success', 'import failure', 'verification failure'])(
); 'uses a short macOS home or RUNNER_TEMP elsewhere and cleans up after %s',
const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig'); async outcome => {
let gpgHome = ''; const longRunnerTemp = path.join(
process.env['RUNNER_TEMP'] = longRunnerTemp; tempDir,
fs.mkdirSync(longRunnerTemp, {recursive: true}); 'long-runner-path-'.repeat(8)
fs.writeFileSync(signaturePath, 'signature'); );
(tc.downloadTool as jest.Mock<any>).mockResolvedValue(signaturePath); const signaturePath = path.join(tempDir, 'jdk.tar.gz.sig');
(exec.exec as jest.Mock<any>).mockImplementation( const expectedParent =
async (_command: string, args: string[]) => { process.platform === 'darwin' ? '/tmp' : longRunnerTemp;
gpgHome = path.join(os.tmpdir(), path.posix.basename(args[1])); let gpgHome = '';
expect(args[1]).toBe(gpg.toGpgPath(gpgHome)); process.env['RUNNER_TEMP'] = longRunnerTemp;
expect( mockTmpDir.mockReturnValue(
fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8') tempDirKind === 'long'
).toBe('public key'); ? longRunnerTemp
if (process.platform !== 'win32') { : `/private/var/folders/ab/${'c'.repeat(31)}/T`
expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700); );
fs.mkdirSync(longRunnerTemp, {recursive: true});
fs.writeFileSync(signaturePath, 'signature');
(tc.downloadTool as jest.Mock<any>).mockResolvedValue(signaturePath);
(exec.exec as jest.Mock<any>).mockImplementation(
async (_command: string, args: string[]) => {
gpgHome = path.join(expectedParent, path.posix.basename(args[1]));
expect(args[1]).toBe(gpg.toGpgPath(gpgHome));
if (process.platform === 'darwin') {
expect(
Buffer.byteLength(path.join(gpgHome, 'S.gpg-agent.browser'))
).toBeLessThan(104);
}
expect(
fs.readFileSync(path.join(gpgHome, 'public-key-0.asc'), 'utf8')
).toBe('public key');
if (process.platform !== 'win32') {
expect(fs.statSync(gpgHome).mode & 0o777).toBe(0o700);
}
if (
(outcome === 'import failure' && args.includes('--import')) ||
(outcome === 'verification failure' &&
args.includes('--verify'))
) {
throw new Error(outcome);
}
return 0;
} }
if ( );
(outcome === 'import failure' && args.includes('--import')) ||
(outcome === 'verification failure' && args.includes('--verify'))
) {
throw new Error(outcome);
}
return 0;
}
);
try {
const verification = gpg.verifyPackageSignature( const verification = gpg.verifyPackageSignature(
path.join(tempDir, 'jdk.tar.gz'), path.join(tempDir, 'jdk.tar.gz'),
'https://example.com/jdk.tar.gz.sig', 'https://example.com/jdk.tar.gz.sig',
@@ -273,11 +298,9 @@ describe('gpg tests', () => {
expect(fs.existsSync(gpgHome)).toBe(false); expect(fs.existsSync(gpgHome)).toBe(false);
expect(fs.existsSync(signaturePath)).toBe(false); expect(fs.existsSync(signaturePath)).toBe(false);
expect(fs.readdirSync(longRunnerTemp)).toEqual([]); expect(fs.readdirSync(longRunnerTemp)).toEqual([]);
} finally {
process.env['RUNNER_TEMP'] = tempDir;
} }
} );
); });
it('imports bundled key and verifies package', async () => { it('imports bundled key and verifies package', async () => {
const publicKeyContent = const publicKeyContent =
dist/cleanup/index.js
Vendored
+3 -5
View File
@@ -35747,8 +35747,6 @@ __nccwpck_require__.d(__webpack_exports__, {
var cleanup_java_core = __nccwpck_require__(3838); var cleanup_java_core = __nccwpck_require__(3838);
// EXTERNAL MODULE: external "fs" // EXTERNAL MODULE: external "fs"
var external_fs_ = __nccwpck_require__(9896); var external_fs_ = __nccwpck_require__(9896);
// EXTERNAL MODULE: external "os"
var external_os_ = __nccwpck_require__(857);
// EXTERNAL MODULE: external "path" // EXTERNAL MODULE: external "path"
var external_path_ = __nccwpck_require__(6928); var external_path_ = __nccwpck_require__(6928);
// EXTERNAL MODULE: external "crypto" // EXTERNAL MODULE: external "crypto"
@@ -35769,7 +35767,6 @@ var src_util = __nccwpck_require__(4527);
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
@@ -35846,8 +35843,9 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
const signaturePath = await tc.downloadTool(signatureUrl); const signaturePath = await tc.downloadTool(signatureUrl);
let gpgHome; let gpgHome;
try { try {
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); const tempDir = process.platform === 'darwin' ? '/tmp' : util.getTempDir();
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
} }
catch (error) { catch (error) {
try { try {
dist/setup/220.index.js
Vendored
+29 -31
View File
@@ -184,17 +184,14 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); /* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); /* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -205,7 +202,7 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -218,8 +215,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -227,7 +224,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/*
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -235,7 +232,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -257,33 +254,34 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -295,19 +293,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -317,8 +315,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
} }
} }
dist/setup/463.index.js
Vendored
+29 -31
View File
@@ -296,17 +296,14 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); /* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); /* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -317,7 +314,7 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -330,8 +327,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -339,7 +336,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/*
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -347,7 +344,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -369,33 +366,34 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -407,19 +405,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -429,8 +427,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
} }
} }
dist/setup/81.index.js
Vendored
+29 -31
View File
@@ -271,17 +271,14 @@ async function write(directory, settings, overwriteSettings) {
/* unused harmony export GPG_HOME_PREFIX */ /* unused harmony export GPG_HOME_PREFIX */
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__); /* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(857); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
/* harmony import */ var os__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(os__WEBPACK_IMPORTED_MODULE_1__); /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__); /* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6982); /* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_3___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_3__); /* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(8701); /* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5260); /* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(9805);
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(4527);
@@ -292,7 +289,7 @@ async function write(directory, settings, overwriteSettings) {
const GPG_HOME_PREFIX = 'setup-java-gpg-'; const GPG_HOME_PREFIX = 'setup-java-gpg-';
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-'; const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
async function isGpgAvailable() { async function isGpgAvailable() {
return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .which */ .K7('gpg', false)); return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
} }
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...). // Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions // The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
@@ -305,8 +302,8 @@ function toGpgPath(p) {
.replace(/\\/g, '/') .replace(/\\/g, '/')
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`); .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
} }
function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()) { function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_2__.join(tempDir, prefix)); const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
if (process.platform !== 'win32') { if (process.platform !== 'win32') {
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700); fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
} }
@@ -314,7 +311,7 @@ function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_7__/*
} }
async function importKey(privateKey) { async function importKey(privateKey) {
const gpgHome = createGpgHome(GPG_HOME_PREFIX); const gpgHome = createGpgHome(GPG_HOME_PREFIX);
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_3__.randomUUID)()}.asc`); const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
try { try {
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, { fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
encoding: 'utf-8', encoding: 'utf-8',
@@ -322,7 +319,7 @@ async function importKey(privateKey) {
mode: 0o600 mode: 0o600
}); });
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -344,33 +341,34 @@ async function removeGpgHome(gpgHome) {
if (!gpgHome) { if (!gpgHome) {
return; return;
} }
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_2__.resolve(gpgHome); const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_2__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_7__/* .getTempDir */ .G4()); const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
if (path__WEBPACK_IMPORTED_MODULE_2__.dirname(resolvedGpgHome) !== resolvedTempDir || if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
!path__WEBPACK_IMPORTED_MODULE_2__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) { !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`); throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
} }
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) { if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
return; return;
} }
try { try {
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true }); await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
} }
catch { catch {
// gpgconf may be unavailable, but directory removal must still be attempted. // gpgconf may be unavailable, but directory removal must still be attempted.
} }
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(resolvedGpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
} }
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) { async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_6__/* .downloadTool */ .bq(signatureUrl); const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
let gpgHome; let gpgHome;
try { try {
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os__WEBPACK_IMPORTED_MODULE_1__.tmpdir()); const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
} }
catch (error) { catch (error) {
try { try {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
} }
catch { catch {
// ignore cleanup failures // ignore cleanup failures
@@ -382,19 +380,19 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
? publicKeyContent ? publicKeyContent
: [publicKeyContent]; : [publicKeyContent];
const publicKeyFiles = publicKeys.map((publicKey, index) => { const publicKeyFiles = publicKeys.map((publicKey, index) => {
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_2__.join(gpgHome, `public-key-${index}.asc`); const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' }); fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
return toGpgPath(publicKeyFile); return toGpgPath(publicKeyFile);
}); });
const options = { silent: true }; const options = { silent: true };
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
'--import', '--import',
...publicKeyFiles ...publicKeyFiles
], options); ], options);
await _actions_exec__WEBPACK_IMPORTED_MODULE_5__/* .exec */ .m('gpg', [ await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
'--homedir', '--homedir',
toGpgPath(gpgHome), toGpgPath(gpgHome),
'--batch', '--batch',
@@ -404,8 +402,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
], options); ], options);
} }
finally { finally {
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(signaturePath); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
await _actions_io__WEBPACK_IMPORTED_MODULE_4__/* .rmRF */ .Yz(gpgHome); await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
} }
} }
src/gpg.ts
+3 -3
View File
@@ -1,5 +1,4 @@
import * as fs from 'fs'; import * as fs from 'fs';
import * as os from 'os';
import * as path from 'path'; import * as path from 'path';
import {randomUUID} from 'crypto'; import {randomUUID} from 'crypto';
import * as io from '@actions/io'; import * as io from '@actions/io';
@@ -111,8 +110,9 @@ export async function verifyPackageSignature(
const signaturePath = await tc.downloadTool(signatureUrl); const signaturePath = await tc.downloadTool(signatureUrl);
let gpgHome: string; let gpgHome: string;
try { try {
// Long RUNNER_TEMP paths can exceed macOS's 104-byte gpg-agent socket limit. // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, os.tmpdir()); const tempDir = process.platform === 'darwin' ? '/tmp' : util.getTempDir();
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
} catch (error) { } catch (error) {
try { try {
await io.rmRF(signaturePath); await io.rmRF(signaturePath);