mirror of
https://gitea.com/actions/setup-java.git
synced 2026-08-07 02:31:20 +00:00
Import Maven signing keys into an isolated GPG home (#1214)
* Isolate Maven signing keys Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix cleanup state assertion Account for isolated GPG-home cleanup when cache saving is disabled. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated action bundles Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address isolated GPG home review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
This commit is contained in:
Julien Dubois
Vendored
+83
-52
@@ -30769,13 +30769,12 @@ module.exports = {
|
||||
|
||||
/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ Ch: () => (/* binding */ INPUT_CACHE_READ_ONLY),
|
||||
/* harmony export */ Fi: () => (/* binding */ STATE_GPG_HOME),
|
||||
/* harmony export */ GL: () => (/* binding */ INPUT_CACHE_JDK),
|
||||
/* harmony export */ gk: () => (/* binding */ INPUT_CACHE),
|
||||
/* harmony export */ wG: () => (/* binding */ INPUT_JOB_STATUS),
|
||||
/* harmony export */ wm: () => (/* binding */ STATE_GPG_PRIVATE_KEY_FINGERPRINT),
|
||||
/* harmony export */ wz: () => (/* binding */ INPUT_GPG_PRIVATE_KEY)
|
||||
/* harmony export */ wG: () => (/* binding */ INPUT_JOB_STATUS)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
|
||||
/* unused harmony exports MACOS_JAVA_CONTENT_POSTFIX, INPUT_JAVA_VERSION, INPUT_JAVA_VERSION_FILE, INPUT_ARCHITECTURE, INPUT_JAVA_PACKAGE, INPUT_DISTRIBUTION, INPUT_JDK_FILE, INPUT_JDK_FILE_DEPRECATED, INPUT_CHECK_LATEST, INPUT_FORCE_DOWNLOAD, INPUT_SET_DEFAULT, INPUT_PROBLEM_MATCHER, INPUT_VERIFY_SIGNATURE, INPUT_VERIFY_SIGNATURE_PUBLIC_KEY, INPUT_SERVER_ID, INPUT_SERVER_USERNAME_ENV_VAR, INPUT_SERVER_PASSWORD_ENV_VAR, INPUT_SERVER_USERNAME_DEPRECATED, INPUT_SERVER_PASSWORD_DEPRECATED, INPUT_SETTINGS_PATH, INPUT_OVERWRITE_SETTINGS, INPUT_GPG_PRIVATE_KEY, INPUT_GPG_PASSPHRASE_ENV_VAR, INPUT_GPG_PASSPHRASE_DEPRECATED, INPUT_DEFAULT_SERVER_USERNAME, INPUT_DEFAULT_SERVER_PASSWORD, INPUT_DEFAULT_GPG_PRIVATE_KEY, INPUT_DEFAULT_GPG_PASSPHRASE, MAVEN_GPG_PASSPHRASE_DEFAULT_ENV, GPG_PASSPHRASE_PROFILE_ID, INPUT_CACHE_DEPENDENCY_PATH, INPUT_CACHE_PATH, M2_DIR, MVN_SETTINGS_FILE, MVN_TOOLCHAINS_FILE, INPUT_MVN_TOOLCHAIN_ID, INPUT_MVN_TOOLCHAIN_VENDOR, INPUT_SHOW_DOWNLOAD_PROGRESS, MAVEN_ARGS_ENV, MAVEN_NO_TRANSFER_PROGRESS_FLAG, MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG, DISTRIBUTIONS_ONLY_MAJOR_VERSION */
|
||||
const MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
|
||||
const INPUT_JAVA_VERSION = 'java-version';
|
||||
const INPUT_JAVA_VERSION_FILE = 'java-version-file';
|
||||
@@ -30816,7 +30815,7 @@ const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path';
|
||||
const INPUT_CACHE_PATH = 'cache-path';
|
||||
const INPUT_CACHE_READ_ONLY = 'cache-read-only';
|
||||
const INPUT_JOB_STATUS = 'job-status';
|
||||
const STATE_GPG_PRIVATE_KEY_FINGERPRINT = 'gpg-private-key-fingerprint';
|
||||
const STATE_GPG_HOME = 'gpg-home';
|
||||
const M2_DIR = '.m2';
|
||||
const MVN_SETTINGS_FILE = 'settings.xml';
|
||||
const MVN_TOOLCHAINS_FILE = 'toolchains.xml';
|
||||
@@ -34222,10 +34221,11 @@ const lowercaseKeys = (obj) => Object.keys(obj).reduce((c, k) => ((c[k.toLowerCa
|
||||
/* harmony export */ Ck: () => (/* binding */ mkdir),
|
||||
/* harmony export */ H8: () => (/* binding */ IS_WINDOWS),
|
||||
/* harmony export */ Qh: () => (/* binding */ isRooted),
|
||||
/* harmony export */ rm: () => (/* binding */ rm),
|
||||
/* harmony export */ t2: () => (/* binding */ exists),
|
||||
/* harmony export */ vr: () => (/* binding */ tryGetExecutablePath)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports chmod, copyFile, lstat, open, readdir, rename, rm, rmdir, stat, symlink, unlink, readlink, UV_FS_O_EXLOCK, READONLY, isDirectory, getCmdPath */
|
||||
/* unused harmony exports chmod, copyFile, lstat, open, readdir, rename, rmdir, stat, symlink, unlink, readlink, UV_FS_O_EXLOCK, READONLY, isDirectory, getCmdPath */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(9896);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6928);
|
||||
var __awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
|
||||
@@ -34415,9 +34415,10 @@ function getCmdPath() {
|
||||
|
||||
/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ K7: () => (/* binding */ which),
|
||||
/* harmony export */ U$: () => (/* binding */ mkdirP)
|
||||
/* harmony export */ U$: () => (/* binding */ mkdirP),
|
||||
/* harmony export */ Yz: () => (/* binding */ rmRF)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports cp, mv, rmRF, findInPath */
|
||||
/* unused harmony exports cp, mv, findInPath */
|
||||
/* harmony import */ var assert__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(2613);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6928);
|
||||
/* harmony import */ var _io_util_js__WEBPACK_IMPORTED_MODULE_2__ = __nccwpck_require__(90);
|
||||
@@ -34510,7 +34511,7 @@ function mv(source_1, dest_1) {
|
||||
*/
|
||||
function rmRF(inputPath) {
|
||||
return __awaiter(this, void 0, void 0, function* () {
|
||||
if (ioUtil.IS_WINDOWS) {
|
||||
if (_io_util_js__WEBPACK_IMPORTED_MODULE_2__/* .IS_WINDOWS */ .H8) {
|
||||
// Check for invalid characters
|
||||
// https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file
|
||||
if (/[*"<>|]/.test(inputPath)) {
|
||||
@@ -34519,7 +34520,7 @@ function rmRF(inputPath) {
|
||||
}
|
||||
try {
|
||||
// note if path does not exist, error is silent
|
||||
yield ioUtil.rm(inputPath, {
|
||||
yield _io_util_js__WEBPACK_IMPORTED_MODULE_2__.rm(inputPath, {
|
||||
force: true,
|
||||
maxRetries: 3,
|
||||
recursive: true,
|
||||
@@ -35733,6 +35734,8 @@ var cleanup_java_core = __nccwpck_require__(3838);
|
||||
var external_fs_ = __nccwpck_require__(9896);
|
||||
// EXTERNAL MODULE: external "path"
|
||||
var external_path_ = __nccwpck_require__(6928);
|
||||
// EXTERNAL MODULE: external "crypto"
|
||||
var external_crypto_ = __nccwpck_require__(6982);
|
||||
// EXTERNAL MODULE: ./node_modules/@actions/io/lib/io.js
|
||||
var lib_io = __nccwpck_require__(8701);
|
||||
// EXTERNAL MODULE: ./node_modules/@actions/exec/lib/exec.js + 2 modules
|
||||
@@ -35748,8 +35751,9 @@ var src_util = __nccwpck_require__(4527);
|
||||
|
||||
|
||||
|
||||
const PRIVATE_KEY_FILE = external_path_.join(src_util/* getTempDir */.G4(), 'private-key.asc');
|
||||
const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
|
||||
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
// internally. Passing Windows paths with backslashes can cause fatal GPG errors
|
||||
@@ -35761,41 +35765,67 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
fs.writeFileSync(PRIVATE_KEY_FILE, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'w'
|
||||
});
|
||||
let output = '';
|
||||
const options = {
|
||||
silent: true,
|
||||
listeners: {
|
||||
stdout: (data) => {
|
||||
output += data.toString();
|
||||
}
|
||||
}
|
||||
};
|
||||
await exec.exec('gpg', [
|
||||
'--batch',
|
||||
'--import-options',
|
||||
'import-show',
|
||||
'--import',
|
||||
PRIVATE_KEY_FILE
|
||||
], options);
|
||||
await io.rmRF(PRIVATE_KEY_FILE);
|
||||
const match = output.match(PRIVATE_KEY_FINGERPRINT_REGEX);
|
||||
return match && match[0];
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
async function deleteKey(keyFingerprint) {
|
||||
await lib_exec/* exec */.m('gpg', ['--batch', '--yes', '--delete-secret-and-public-key', keyFingerprint], {
|
||||
silent: true
|
||||
});
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path.join(gpgHome, `private-key-${randomUUID()}.asc`);
|
||||
try {
|
||||
fs.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'wx',
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await exec.exec('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(privateKeyFile)
|
||||
], { silent: true });
|
||||
}
|
||||
finally {
|
||||
fs.rmSync(privateKeyFile, { force: true });
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
catch (error) {
|
||||
await removeGpgHome(gpgHome);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = external_path_.resolve(gpgHome);
|
||||
const resolvedTempDir = external_path_.resolve(src_util/* getTempDir */.G4());
|
||||
if (external_path_.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!external_path_.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!external_fs_.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await lib_exec/* exec */.m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await lib_io/* rmRF */.Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await tc.downloadTool(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = fs.mkdtempSync(path.join(util.getTempDir(), 'verify-signature-gpg-home-'));
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
@@ -35842,16 +35872,17 @@ var external_url_ = __nccwpck_require__(7016);
|
||||
|
||||
|
||||
|
||||
async function removePrivateKeyFromKeychain() {
|
||||
if (cleanup_java_core/* getInput */.V4(constants/* INPUT_GPG_PRIVATE_KEY */.wz, { required: false })) {
|
||||
cleanup_java_core/* info */.pq('Removing private key from keychain');
|
||||
try {
|
||||
const keyFingerprint = cleanup_java_core/* getState */.Gu(constants/* STATE_GPG_PRIVATE_KEY_FINGERPRINT */.wm);
|
||||
await deleteKey(keyFingerprint);
|
||||
}
|
||||
catch (error) {
|
||||
cleanup_java_core/* setFailed */.C1(`Failed to remove private key due to: ${error.message}`);
|
||||
}
|
||||
async function cleanup_java_removeGpgHome() {
|
||||
const gpgHome = cleanup_java_core/* getState */.Gu(constants/* STATE_GPG_HOME */.Fi);
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
cleanup_java_core/* info */.pq('Removing private key from isolated GPG home');
|
||||
try {
|
||||
await removeGpgHome(gpgHome);
|
||||
}
|
||||
catch (error) {
|
||||
cleanup_java_core/* setFailed */.C1(`Failed to remove isolated GPG home due to: ${error.message}`);
|
||||
}
|
||||
}
|
||||
/**
|
||||
@@ -35899,7 +35930,7 @@ async function ignoreError(promise) {
|
||||
});
|
||||
}
|
||||
async function run() {
|
||||
await removePrivateKeyFromKeychain();
|
||||
await cleanup_java_removeGpgHome();
|
||||
await ignoreError(saveCaches());
|
||||
}
|
||||
if (process.argv[1] === (0,external_url_.fileURLToPath)(import.meta.url)) {
|
||||
|
||||
Vendored
+74
-43
@@ -170,25 +170,30 @@ class MicrosoftDistributions extends base_installer/* JavaBase */.O {
|
||||
|
||||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ Fh: () => (/* binding */ importKey),
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature)
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature),
|
||||
/* harmony export */ mS: () => (/* binding */ removeGpgHome),
|
||||
/* harmony export */ nY: () => (/* binding */ toGpgPath)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports PRIVATE_KEY_FILE, toGpgPath, deleteKey */
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(4527);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
const PRIVATE_KEY_FILE = path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'private-key.asc');
|
||||
const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
|
||||
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
// internally. Passing Windows paths with backslashes can cause fatal GPG errors
|
||||
@@ -200,45 +205,71 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(PRIVATE_KEY_FILE, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'w'
|
||||
});
|
||||
let output = '';
|
||||
const options = {
|
||||
silent: true,
|
||||
listeners: {
|
||||
stdout: (data) => {
|
||||
output += data.toString();
|
||||
}
|
||||
}
|
||||
};
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
'--batch',
|
||||
'--import-options',
|
||||
'import-show',
|
||||
'--import',
|
||||
PRIVATE_KEY_FILE
|
||||
], options);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(PRIVATE_KEY_FILE);
|
||||
const match = output.match(PRIVATE_KEY_FINGERPRINT_REGEX);
|
||||
return match && match[0];
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
async function deleteKey(keyFingerprint) {
|
||||
await exec.exec('gpg', ['--batch', '--yes', '--delete-secret-and-public-key', keyFingerprint], {
|
||||
silent: true
|
||||
});
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'wx',
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(privateKeyFile)
|
||||
], { silent: true });
|
||||
}
|
||||
finally {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
catch (error) {
|
||||
await removeGpgHome(gpgHome);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'verify-signature-gpg-home-'));
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -249,14 +280,14 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, 'public-key.asc');
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(publicKeyFile)
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -266,8 +297,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Vendored
+74
-43
@@ -268,25 +268,30 @@ class TemurinDistribution extends base_installer/* JavaBase */.O {
|
||||
|
||||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ Fh: () => (/* binding */ importKey),
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature)
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature),
|
||||
/* harmony export */ mS: () => (/* binding */ removeGpgHome),
|
||||
/* harmony export */ nY: () => (/* binding */ toGpgPath)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports PRIVATE_KEY_FILE, toGpgPath, deleteKey */
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(4527);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
const PRIVATE_KEY_FILE = path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'private-key.asc');
|
||||
const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
|
||||
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
// internally. Passing Windows paths with backslashes can cause fatal GPG errors
|
||||
@@ -298,45 +303,71 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(PRIVATE_KEY_FILE, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'w'
|
||||
});
|
||||
let output = '';
|
||||
const options = {
|
||||
silent: true,
|
||||
listeners: {
|
||||
stdout: (data) => {
|
||||
output += data.toString();
|
||||
}
|
||||
}
|
||||
};
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
'--batch',
|
||||
'--import-options',
|
||||
'import-show',
|
||||
'--import',
|
||||
PRIVATE_KEY_FILE
|
||||
], options);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(PRIVATE_KEY_FILE);
|
||||
const match = output.match(PRIVATE_KEY_FINGERPRINT_REGEX);
|
||||
return match && match[0];
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
async function deleteKey(keyFingerprint) {
|
||||
await exec.exec('gpg', ['--batch', '--yes', '--delete-secret-and-public-key', keyFingerprint], {
|
||||
silent: true
|
||||
});
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'wx',
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(privateKeyFile)
|
||||
], { silent: true });
|
||||
}
|
||||
finally {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
catch (error) {
|
||||
await removeGpgHome(gpgHome);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'verify-signature-gpg-home-'));
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -347,14 +378,14 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, 'public-key.asc');
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(publicKeyFile)
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -364,8 +395,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Vendored
+83
-45
@@ -49,8 +49,15 @@ async function configureAuthentication() {
|
||||
await createAuthenticationSettings(id, usernameEnvVar, passwordEnvVar, settingsDirectory, overwriteSettings, gpgPassphraseEnvVar);
|
||||
if (gpgPrivateKey) {
|
||||
_actions_core__WEBPACK_IMPORTED_MODULE_1__/* .info */ .pq('Importing private gpg key');
|
||||
const keyFingerprint = (await _gpg_js__WEBPACK_IMPORTED_MODULE_5__/* .importKey */ .Fh(gpgPrivateKey)) || '';
|
||||
_actions_core__WEBPACK_IMPORTED_MODULE_1__/* .saveState */ .LZ(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .STATE_GPG_PRIVATE_KEY_FINGERPRINT */ .wm, keyFingerprint);
|
||||
const gpgHome = await _gpg_js__WEBPACK_IMPORTED_MODULE_5__/* .importKey */ .Fh(gpgPrivateKey);
|
||||
try {
|
||||
_actions_core__WEBPACK_IMPORTED_MODULE_1__/* .saveState */ .LZ(_constants_js__WEBPACK_IMPORTED_MODULE_7__/* .STATE_GPG_HOME */ .Fi, gpgHome);
|
||||
_actions_core__WEBPACK_IMPORTED_MODULE_1__/* .exportVariable */ .dN('GNUPGHOME', _gpg_js__WEBPACK_IMPORTED_MODULE_5__/* .toGpgPath */ .nY(gpgHome));
|
||||
}
|
||||
catch (error) {
|
||||
await _gpg_js__WEBPACK_IMPORTED_MODULE_5__/* .removeGpgHome */ .mS(gpgHome);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
}
|
||||
function getInputWithDeprecatedAlias(inputName, deprecatedInputName, defaultValue) {
|
||||
@@ -124,25 +131,30 @@ async function write(directory, settings, overwriteSettings) {
|
||||
|
||||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ Fh: () => (/* binding */ importKey),
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature)
|
||||
/* harmony export */ Yi: () => (/* binding */ verifyPackageSignature),
|
||||
/* harmony export */ mS: () => (/* binding */ removeGpgHome),
|
||||
/* harmony export */ nY: () => (/* binding */ toGpgPath)
|
||||
/* harmony export */ });
|
||||
/* unused harmony exports PRIVATE_KEY_FILE, toGpgPath, deleteKey */
|
||||
/* unused harmony export GPG_HOME_PREFIX */
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
|
||||
/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
|
||||
/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(4527);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
|
||||
/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
|
||||
/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
|
||||
/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
|
||||
/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
|
||||
/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
const PRIVATE_KEY_FILE = path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'private-key.asc');
|
||||
const PRIVATE_KEY_FINGERPRINT_REGEX = /\w{40}/;
|
||||
|
||||
const GPG_HOME_PREFIX = 'setup-java-gpg-';
|
||||
const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
|
||||
// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
|
||||
// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
|
||||
// internally. Passing Windows paths with backslashes can cause fatal GPG errors
|
||||
@@ -154,45 +166,71 @@ function toGpgPath(p) {
|
||||
.replace(/\\/g, '/')
|
||||
.replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
|
||||
}
|
||||
async function importKey(privateKey) {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(PRIVATE_KEY_FILE, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'w'
|
||||
});
|
||||
let output = '';
|
||||
const options = {
|
||||
silent: true,
|
||||
listeners: {
|
||||
stdout: (data) => {
|
||||
output += data.toString();
|
||||
}
|
||||
}
|
||||
};
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
'--batch',
|
||||
'--import-options',
|
||||
'import-show',
|
||||
'--import',
|
||||
PRIVATE_KEY_FILE
|
||||
], options);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(PRIVATE_KEY_FILE);
|
||||
const match = output.match(PRIVATE_KEY_FINGERPRINT_REGEX);
|
||||
return match && match[0];
|
||||
function createGpgHome(prefix) {
|
||||
const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4(), prefix));
|
||||
if (process.platform !== 'win32') {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
async function deleteKey(keyFingerprint) {
|
||||
await exec.exec('gpg', ['--batch', '--yes', '--delete-secret-and-public-key', keyFingerprint], {
|
||||
silent: true
|
||||
});
|
||||
async function importKey(privateKey) {
|
||||
const gpgHome = createGpgHome(GPG_HOME_PREFIX);
|
||||
const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
|
||||
try {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'wx',
|
||||
mode: 0o600
|
||||
});
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(privateKeyFile)
|
||||
], { silent: true });
|
||||
}
|
||||
finally {
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
|
||||
}
|
||||
return gpgHome;
|
||||
}
|
||||
catch (error) {
|
||||
await removeGpgHome(gpgHome);
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
async function removeGpgHome(gpgHome) {
|
||||
if (!gpgHome) {
|
||||
return;
|
||||
}
|
||||
const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
|
||||
const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
|
||||
if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
|
||||
!path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
|
||||
throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
|
||||
}
|
||||
if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
|
||||
}
|
||||
catch {
|
||||
// gpgconf may be unavailable, but directory removal must still be attempted.
|
||||
}
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
|
||||
}
|
||||
async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_4__/* .downloadTool */ .bq(signatureUrl);
|
||||
const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
|
||||
let gpgHome;
|
||||
try {
|
||||
gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(_util_js__WEBPACK_IMPORTED_MODULE_5__/* .getTempDir */ .G4(), 'verify-signature-gpg-home-'));
|
||||
gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX);
|
||||
}
|
||||
catch (error) {
|
||||
try {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
}
|
||||
catch {
|
||||
// ignore cleanup failures
|
||||
@@ -203,14 +241,14 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, 'public-key.asc');
|
||||
fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
|
||||
const options = { silent: true };
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
'--import',
|
||||
toGpgPath(publicKeyFile)
|
||||
], options);
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_3__/* .exec */ .m('gpg', [
|
||||
await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
|
||||
'--homedir',
|
||||
toGpgPath(gpgHome),
|
||||
'--batch',
|
||||
@@ -220,8 +258,8 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
|
||||
], options);
|
||||
}
|
||||
finally {
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_2__/* .rmRF */ .Yz(gpgHome);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
|
||||
await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Vendored
+2
-2
@@ -30770,6 +30770,7 @@ module.exports = {
|
||||
/* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
|
||||
/* harmony export */ At: () => (/* binding */ INPUT_CACHE_DEPENDENCY_PATH),
|
||||
/* harmony export */ E8: () => (/* binding */ INPUT_SET_DEFAULT),
|
||||
/* harmony export */ Fi: () => (/* binding */ STATE_GPG_HOME),
|
||||
/* harmony export */ GL: () => (/* binding */ INPUT_CACHE_JDK),
|
||||
/* harmony export */ I9: () => (/* binding */ INPUT_FORCE_DOWNLOAD),
|
||||
/* harmony export */ K$: () => (/* binding */ GPG_PASSPHRASE_PROFILE_ID),
|
||||
@@ -30810,7 +30811,6 @@ module.exports = {
|
||||
/* harmony export */ vO: () => (/* binding */ MVN_SETTINGS_FILE),
|
||||
/* harmony export */ wX: () => (/* binding */ INPUT_SHOW_DOWNLOAD_PROGRESS),
|
||||
/* harmony export */ wc: () => (/* binding */ INPUT_JDK_FILE_DEPRECATED),
|
||||
/* harmony export */ wm: () => (/* binding */ STATE_GPG_PRIVATE_KEY_FINGERPRINT),
|
||||
/* harmony export */ wz: () => (/* binding */ INPUT_GPG_PRIVATE_KEY),
|
||||
/* harmony export */ xp: () => (/* binding */ INPUT_DEFAULT_SERVER_PASSWORD)
|
||||
/* harmony export */ });
|
||||
@@ -30855,7 +30855,7 @@ const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path';
|
||||
const INPUT_CACHE_PATH = 'cache-path';
|
||||
const INPUT_CACHE_READ_ONLY = 'cache-read-only';
|
||||
const INPUT_JOB_STATUS = 'job-status';
|
||||
const STATE_GPG_PRIVATE_KEY_FINGERPRINT = 'gpg-private-key-fingerprint';
|
||||
const STATE_GPG_HOME = 'gpg-home';
|
||||
const M2_DIR = '.m2';
|
||||
const MVN_SETTINGS_FILE = 'settings.xml';
|
||||
const MVN_TOOLCHAINS_FILE = 'toolchains.xml';
|
||||
|
||||
Reference in New Issue
Block a user