mirror of
https://github.com/actions/setup-java.git
synced 2026-07-31 22:51:39 +08:00
* Verify JDK downloads with vendor checksums Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Handle missing vendor checksum values Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Preserve checksum error during cleanup failure Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Validate checksum metadata value types Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Clarify checksum documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Expand vendor checksum verification Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Accept SHA-256 or SHA-512 for JetBrains checksum sibling JetBrains publishes a single, generically-named ".checksum" sibling whose digest algorithm isn't disclosed by the filename. Older JBR 11 builds (e.g. jbrsdk_nomod-11_0_16-*-b2043.64.tar.gz) publish a SHA-256 digest there, while newer builds publish SHA-512. The JetBrains installer previously assumed SHA-512 unconditionally, so verification failed with "Malformed sha512 checksum metadata ... expected a 128-character hexadecimal digest" for those older builds, breaking the jetbrains 11 e2e job on macOS and Windows. fetchChecksum now accepts a list of candidate algorithms and infers the actual algorithm from the returned digest's length, preferring the strongest match. The JetBrains installer passes ['sha512', 'sha256']; all other callers are unaffected since they already pass a single, vendor-disclosed algorithm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Use SapMachine archive checksum files Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
286 lines
8.9 KiB
TypeScript
286 lines
8.9 KiB
TypeScript
import * as core from '@actions/core';
|
|
import * as tc from '@actions/tool-cache';
|
|
|
|
import fs from 'fs';
|
|
import path from 'path';
|
|
import semver from 'semver';
|
|
import * as gpg from '../../gpg.js';
|
|
|
|
import {ADOPTIUM_PUBLIC_KEY} from './adoptium-key.js';
|
|
import {JavaBase} from '../base-installer.js';
|
|
import {ITemurinAvailableVersions} from './models.js';
|
|
import {MACOS_JAVA_CONTENT_POSTFIX} from '../../constants.js';
|
|
import {
|
|
JavaDownloadRelease,
|
|
JavaInstallerOptions,
|
|
JavaInstallerResults
|
|
} from '../base-models.js';
|
|
import {
|
|
extractJdkFile,
|
|
getNextPageUrlFromLinkHeader,
|
|
getDownloadArchiveExtension,
|
|
isVersionSatisfies,
|
|
renameWinArchive,
|
|
MAX_PAGINATION_PAGES,
|
|
validatePaginationUrl
|
|
} from '../../util.js';
|
|
|
|
export {ADOPTIUM_PUBLIC_KEY} from './adoptium-key.js';
|
|
|
|
export enum TemurinImplementation {
|
|
Hotspot = 'Hotspot'
|
|
}
|
|
|
|
export class TemurinDistribution extends JavaBase {
|
|
private readonly includeJmods: boolean;
|
|
|
|
constructor(
|
|
installerOptions: JavaInstallerOptions,
|
|
private readonly jvmImpl: TemurinImplementation
|
|
) {
|
|
super(`Temurin-${jvmImpl}`, installerOptions);
|
|
this.includeJmods = this.packageType === 'jdk+jmods';
|
|
}
|
|
|
|
/**
|
|
* @internal For cross-distribution reuse only. Not intended as a public API.
|
|
*/
|
|
public async findPackageForDownload(
|
|
version: string
|
|
): Promise<JavaDownloadRelease> {
|
|
return this.resolvePackage(
|
|
version,
|
|
this.includeJmods ? 'jdk' : this.packageType
|
|
);
|
|
}
|
|
|
|
private async resolvePackage(
|
|
version: string,
|
|
imageType: string
|
|
): Promise<JavaDownloadRelease> {
|
|
const availableVersionsRaw = await this.getAvailableVersions(imageType);
|
|
const availableVersionsWithBinaries = availableVersionsRaw
|
|
.filter(item => item.binaries.length > 0)
|
|
.map(item => {
|
|
// normalize 17.0.0-beta+33.0.202107301459 to 17.0.0+33.0.202107301459 for earlier access versions
|
|
const formattedVersion = this.stable
|
|
? item.version_data.semver
|
|
: item.version_data.semver.replace('-beta+', '+');
|
|
return {
|
|
version: formattedVersion,
|
|
url: item.binaries[0].package.link,
|
|
signatureUrl: item.binaries[0].package.signature_link,
|
|
checksum: {
|
|
algorithm: 'sha256',
|
|
value: item.binaries[0].package.checksum,
|
|
source: item.binaries[0].package.checksum_link
|
|
}
|
|
} as JavaDownloadRelease;
|
|
});
|
|
|
|
const satisfiedVersions = availableVersionsWithBinaries
|
|
.filter(item => isVersionSatisfies(version, item.version))
|
|
.sort((a, b) => {
|
|
return -semver.compareBuild(a.version, b.version);
|
|
});
|
|
|
|
const resolvedFullVersion =
|
|
satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
|
|
if (!resolvedFullVersion) {
|
|
const availableVersionStrings = availableVersionsWithBinaries.map(
|
|
item => item.version
|
|
);
|
|
throw this.createVersionNotFoundError(version, availableVersionStrings);
|
|
}
|
|
|
|
return resolvedFullVersion;
|
|
}
|
|
|
|
protected async downloadTool(
|
|
javaRelease: JavaDownloadRelease
|
|
): Promise<JavaInstallerResults> {
|
|
core.info(
|
|
`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`
|
|
);
|
|
let javaArchivePath = await this.downloadPackage(javaRelease);
|
|
|
|
core.info(`Extracting Java archive...`);
|
|
const extension = getDownloadArchiveExtension();
|
|
if (process.platform === 'win32') {
|
|
javaArchivePath = renameWinArchive(javaArchivePath);
|
|
}
|
|
const extractedJavaPath = await extractJdkFile(javaArchivePath, extension);
|
|
|
|
const archiveName = fs.readdirSync(extractedJavaPath)[0];
|
|
const archivePath = path.join(extractedJavaPath, archiveName);
|
|
const javaHome =
|
|
process.platform === 'darwin'
|
|
? path.join(archivePath, MACOS_JAVA_CONTENT_POSTFIX)
|
|
: archivePath;
|
|
if (this.includeJmods && !fs.existsSync(path.join(javaHome, 'jmods'))) {
|
|
await this.installJmods(javaRelease.version, javaHome);
|
|
}
|
|
const version = this.getToolcacheVersionName(javaRelease.version);
|
|
|
|
const javaPath = await tc.cacheDir(
|
|
archivePath,
|
|
this.toolcacheFolderName,
|
|
version,
|
|
this.architecture
|
|
);
|
|
|
|
return {version: javaRelease.version, path: javaPath};
|
|
}
|
|
|
|
protected supportsSignatureVerification(): boolean {
|
|
return true;
|
|
}
|
|
|
|
private async downloadPackage(release: JavaDownloadRelease): Promise<string> {
|
|
const archivePath = await this.downloadAndVerify(release);
|
|
|
|
if (this.verifySignature) {
|
|
if (!release.signatureUrl) {
|
|
throw new Error(
|
|
`Input 'verify-signature' is enabled, but no signature URL was found for Temurin version ${release.version}.`
|
|
);
|
|
}
|
|
core.info(`Verifying Java package signature...`);
|
|
try {
|
|
await gpg.verifyPackageSignature(
|
|
archivePath,
|
|
release.signatureUrl,
|
|
this.verifySignaturePublicKey ?? ADOPTIUM_PUBLIC_KEY
|
|
);
|
|
} catch (error) {
|
|
throw new Error(
|
|
`Failed to verify signature for Temurin version ${release.version} from ${release.signatureUrl}: ${
|
|
(error as Error).message
|
|
}`,
|
|
{cause: error}
|
|
);
|
|
}
|
|
}
|
|
|
|
return archivePath;
|
|
}
|
|
|
|
private async installJmods(version: string, javaHome: string): Promise<void> {
|
|
const jmodsRelease = await this.resolvePackage(version, 'jmods');
|
|
core.info(
|
|
`Downloading JMODs ${jmodsRelease.version} (${this.distribution}) from ${jmodsRelease.url} ...`
|
|
);
|
|
let jmodsArchivePath = await this.downloadPackage(jmodsRelease);
|
|
if (process.platform === 'win32') {
|
|
jmodsArchivePath = renameWinArchive(jmodsArchivePath);
|
|
}
|
|
const extractedJmodsPath = await extractJdkFile(
|
|
jmodsArchivePath,
|
|
getDownloadArchiveExtension()
|
|
);
|
|
const jmodsDirectory = path.join(
|
|
extractedJmodsPath,
|
|
fs.readdirSync(extractedJmodsPath)[0]
|
|
);
|
|
fs.cpSync(jmodsDirectory, path.join(javaHome, 'jmods'), {recursive: true});
|
|
}
|
|
|
|
private async getAvailableVersions(
|
|
imageType = this.includeJmods ? 'jdk' : this.packageType
|
|
): Promise<ITemurinAvailableVersions[]> {
|
|
const platform = this.getPlatformOption();
|
|
const arch = this.distributionArchitecture();
|
|
const versionRange = encodeURI('[1.0,100.0]'); // retrieve all available versions
|
|
const releaseType = this.stable ? 'ga' : 'ea';
|
|
|
|
if (core.isDebug()) {
|
|
console.time('Retrieving available versions for Temurin took'); // eslint-disable-line no-console
|
|
}
|
|
|
|
const baseRequestArguments = [
|
|
`project=jdk`,
|
|
'vendor=adoptium',
|
|
`heap_size=normal`,
|
|
'sort_method=DEFAULT',
|
|
'sort_order=DESC',
|
|
`os=${platform}`,
|
|
`architecture=${arch}`,
|
|
`image_type=${imageType}`,
|
|
`release_type=${releaseType}`,
|
|
`jvm_impl=${this.jvmImpl.toLowerCase()}`
|
|
].join('&');
|
|
|
|
const requestArguments = `${baseRequestArguments}&page_size=20&page=0`;
|
|
let availableVersionsUrl: string | null =
|
|
`https://api.adoptium.net/v3/assets/version/${versionRange}?${requestArguments}`;
|
|
const availableVersions: ITemurinAvailableVersions[] = [];
|
|
let pageCount = 0;
|
|
if (core.isDebug()) {
|
|
core.debug(`Gathering available versions from '${availableVersionsUrl}'`);
|
|
}
|
|
|
|
while (availableVersionsUrl) {
|
|
pageCount++;
|
|
const response =
|
|
await this.http.getJson<ITemurinAvailableVersions[]>(
|
|
availableVersionsUrl
|
|
);
|
|
const paginationPage = response.result;
|
|
const nextUrl = getNextPageUrlFromLinkHeader(response.headers);
|
|
if (
|
|
nextUrl &&
|
|
!validatePaginationUrl(nextUrl, 'https://api.adoptium.net')
|
|
) {
|
|
core.warning(
|
|
`Ignoring pagination link with unexpected origin: ${nextUrl}`
|
|
);
|
|
availableVersionsUrl = null;
|
|
} else {
|
|
availableVersionsUrl = nextUrl;
|
|
}
|
|
|
|
if (paginationPage === null || paginationPage.length === 0) {
|
|
break;
|
|
}
|
|
|
|
availableVersions.push(...paginationPage);
|
|
|
|
if (pageCount >= MAX_PAGINATION_PAGES) {
|
|
core.warning(
|
|
`Reached pagination safeguard limit (${MAX_PAGINATION_PAGES} pages) while listing Temurin releases.`
|
|
);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (core.isDebug()) {
|
|
core.startGroup('Print information about available versions');
|
|
console.timeEnd('Retrieving available versions for Temurin took'); // eslint-disable-line no-console
|
|
core.debug(`Available versions: [${availableVersions.length}]`);
|
|
core.debug(
|
|
availableVersions.map(item => item.version_data.semver).join(', ')
|
|
);
|
|
core.endGroup();
|
|
}
|
|
|
|
return availableVersions;
|
|
}
|
|
|
|
private getPlatformOption(): string {
|
|
// Adoptium has own platform names so need to map them
|
|
switch (process.platform) {
|
|
case 'darwin':
|
|
return 'mac';
|
|
case 'win32':
|
|
return 'windows';
|
|
case 'linux':
|
|
if (fs.existsSync('/etc/alpine-release')) {
|
|
return 'alpine-linux';
|
|
}
|
|
return 'linux';
|
|
default:
|
|
return process.platform;
|
|
}
|
|
}
|
|
}
|