* Isolate Maven signing keys
Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix cleanup state assertion
Account for isolated GPG-home cleanup when cache saving is disabled.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update generated action bundles
Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address isolated GPG home review feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
* Migrate to ESM and upgrade dependencies
* fix: update import statement for JSON module in kona-installer test
---------
Co-authored-by: George Adams <georgeadams1995@gmail.com>
* Add verify-signature plumbing and Temurin verification support
* Rebuild dist after signature verification changes
* Refine signature verification errors and regenerate dist
* refactor: make gpg.ts generic, move Adoptium-specific constant to temurin distribution
* fix: mock renameWinArchive in temurin tests and add signature e2e job
* refactor: bundle Adoptium public key, replace keyserver lookup with local import
* feat: add verify-signature-public-key input to allow custom GPG key override
* refactor: extract Adoptium public key to adoptium-key.ts; tighten gpg.ts cleanup scope
* Add verify-signature plumbing and Temurin verification support
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Add Microsoft signature verification support
* Regenerate dist bundles for Microsoft signature checks
* Harden Microsoft signature URL handling
* Add setup-java-microsoft-signature-verification e2e job
* chore: regenerate dist files
* Fix e2e-versions: remove duplicate job, update signature jobs to checkout@v7 with env vars
* Fix Prettier formatting in test files
* fix: mock renameWinArchive in microsoft-installer tests to fix Windows CI failure
* fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility
The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert
Windows-style paths in environment variables like GNUPGHOME. This caused GPG
to fail with exit code 2 when verifying Microsoft JDK signatures on Windows,
because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid
POSIX path.
Fix: pass --homedir as an explicit command-line argument to both gpg --import
and gpg --verify. MSYS2 does correctly convert Windows paths in command-line
arguments, so this approach works reliably on Windows, Linux, and macOS.
* fix: convert Windows paths to POSIX format for MSYS2 GPG on Windows
The Git-bundled GPG on Windows (C:\Program Files\Git\usr\bin\gpg.exe) is
an MSYS2-based binary that uses POSIX path conventions internally. When
Windows-style paths with backslashes and drive letters (D:\a\_temp\...)
are passed as arguments, GPG may fail to resolve them correctly, resulting
in a fatal error (exit code 2).
Fix: add a toGpgPath() helper that converts Windows paths to MSYS2 POSIX
format (/d/a/_temp/...) before passing them to any gpg command. On Linux
and macOS the helper is a no-op.
Applied to all four paths used in verifyPackageSignature:
- gpgHome (--homedir argument)
- publicKeyFile (--import argument)
- signaturePath (--verify signature argument)
- archivePath (--verify data argument)
* Fix gpg test formatting
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
* Refactor error handling for version not found cases across multiple installers
* Mock core.error in tests to suppress error logs
* fix(graalvm): improve error messages for EA version not found scenarios
* refactor(tests): update error messages for version not found scenarios
* fix(graalvm): enhance error messages for version not found scenarios
* fix(graalvm): improve error messages for version not found scenarios with updated download URL
* fix(graalvm): improve error handling for EA version not found scenarios with clearer messages
* Added Windows Arm64 Support for Windows Arm64 Runners
* microsoft test file update and tool-version test file
* Delete .DS_Store
* added test cases for windows and linux for zulu, liberica and microsoft
* adding different data files for each OS
* added changes to distribution files
* added more version support for microsoft
* Add microsoft distribution of the JDK.
* Fix formatting to match prettier.
* Rebuild js.
* Fix archive suffix for Windows.
* Update src/distributions/microsoft/installer.ts
Co-authored-by: Brian Cristante <33549821+brcrista@users.noreply.github.com>
* Update src/distributions/microsoft/installer.ts
Co-authored-by: Brian Cristante <33549821+brcrista@users.noreply.github.com>
* Add support for the microsoft distribution.
* revert lockfile changes
* npm run format
* fix e2e-versions.yml
* eliminate duplication in version numbers
* Fix test
Co-authored-by: Brendan Burns <brendan.d.burns@gmail.com>
Co-authored-by: Brian Cristante <33549821+brcrista@users.noreply.github.com>
Julien Dubois