Stop GPG agent before verification home cleanup

Co-authored-by: brunoborges <129743+brunoborges@users.noreply.github.com>

README.md

@@ -150,7 +150,7 @@ steps:
 | `java-version-file` | Path to `.java-version`, `.tool-versions`, or `.sdkmanrc`. Used when `java-version` is not set. | |
 | `distribution` | Java distribution keyword. Values are case-sensitive and must match one of the supported keywords below. Required unless `java-version-file` points to `.sdkmanrc` with a recognized distribution suffix. | |
 | `java-package` | Package variant such as `jdk`, `jre`, `jdk+fx`, `jre+fx`, `jdk+crac`, `jre+crac`, `jdk+jmods`, `jdk+jcef`, `jre+jcef`, `jdk+ft`, or `jre+ft`. Support varies by distribution. | `jdk` |
-| `architecture` | Package architecture. Canonical values are `x86`, `x64`, `armv7`, `aarch64`, `ppc64le`, `ppc64`, and `s390x`. Aliases `ia32`, `amd64`, `arm`, and `arm64` are normalized. | Runner architecture |
+| `architecture` | Package architecture. Canonical values are `x86`, `x64`, `armv7`, `aarch64`, `ppc64le`, `ppc64`, `riscv64`, and `s390x`. Aliases `ia32`, `amd64`, `arm`, and `arm64` are normalized. | Runner architecture |
 | `jdk-file` | Local compressed JDK archive. Requires `distribution: jdkfile`. | |
 | `check-latest` | Check remote metadata for the latest version satisfying the version spec before using the runner tool cache. | `false` |
 | `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |

__tests__/distributors/liberica-installer.test.ts

@@ -253,6 +253,39 @@ describe('findPackageForDownload', () => {
     expect(result.version).toBe(expected);
   });
 
+  describe('compound build versions', () => {
+    beforeEach(() => {
+      distribution['getAvailableVersions'] = async () =>
+        ['1', '1.1', '1.2', '1.10'].map(build => ({
+          featureVersion: 25,
+          interimVersion: 0,
+          updateVersion: 4,
+          buildVersion: 1,
+          version: `25.0.4+${build}`,
+          downloadUrl: `https://download.bell-sw.com/java/25.0.4+${build}/bellsoft-jdk25.0.4+${build}-macos-aarch64.tar.gz`
+        }));
+    });
+
+    it.each([
+      ['25.0.4+1.1', '25.0.4+1.1'],
+      ['25.0.4+1', '25.0.4+1'],
+      ['25.0.4', '25.0.4+1.10'],
+      ['25', '25.0.4+1.10']
+    ])('version is %s -> %s', async (input, expected) => {
+      const result = await distribution['findPackageForDownload'](input);
+      expect(result).toEqual({
+        version: expected,
+        url: `https://download.bell-sw.com/java/${expected}/bellsoft-jdk${expected}-macos-aarch64.tar.gz`
+      });
+    });
+
+    it('does not substitute a different compound build', async () => {
+      await expect(
+        distribution['findPackageForDownload']('25.0.4+1.3')
+      ).rejects.toThrow(/No matching version found for SemVer/);
+    });
+  });
+
   it('should throw an error', async () => {
     await expect(distribution['findPackageForDownload']('17')).rejects.toThrow(
       /No matching version found for SemVer/
@@ -335,6 +368,36 @@ describe('convertVersionToSemver', () => {
         buildVersion: 13
       },
       '11.0.0+13'
+    ],
+    [
+      {
+        version: '25.0.4+1.1',
+        featureVersion: 25,
+        interimVersion: 0,
+        updateVersion: 4,
+        buildVersion: 1
+      },
+      '25.0.4+1.1'
+    ],
+    [
+      {
+        version: '25+36',
+        featureVersion: 25,
+        interimVersion: 0,
+        updateVersion: 0,
+        buildVersion: 36
+      },
+      '25.0.0+36'
+    ],
+    [
+      {
+        version: '8u202',
+        featureVersion: 8,
+        interimVersion: 0,
+        updateVersion: 202,
+        buildVersion: 8
+      },
+      '8.0.202+8'
     ]
   ])('%s -> %s', (input, expected) => {
     const actual = distributions['convertVersionToSemver']({

__tests__/distributors/temurin-installer.test.ts

@@ -293,7 +293,8 @@ describe('getAvailableVersions', () => {
   it.each([
     ['amd64', 'x64'],
     ['arm', 'arm'],
-    ['arm64', 'aarch64']
+    ['arm64', 'aarch64'],
+    ['riscv64', 'riscv64']
   ])(
     'defaults to os.arch(): %s mapped to distro arch: %s',
     async (osArch: string, distroArch: string) => {

__tests__/gpg.test.ts

@@ -236,7 +236,12 @@ describe('gpg tests', () => {
         process.env['RUNNER_TEMP'] = tempDir;
       });
 
-      it.each(['success', 'import failure', 'verification failure'])(
+      it.each([
+        'success',
+        'import failure',
+        'verification failure',
+        'gpgconf unavailable'
+      ])(
         'uses a short macOS home or RUNNER_TEMP elsewhere and cleans up after %s',
         async outcome => {
           const longRunnerTemp = path.join(
@@ -257,9 +262,16 @@ describe('gpg tests', () => {
           fs.writeFileSync(signaturePath, 'signature');
           (tc.downloadTool as jest.Mock<any>).mockResolvedValue(signaturePath);
           (exec.exec as jest.Mock<any>).mockImplementation(
-            async (_command: string, args: string[]) => {
+            async (command: string, args: string[]) => {
               gpgHome = path.join(expectedParent, path.posix.basename(args[1]));
               expect(args[1]).toBe(gpg.toGpgPath(gpgHome));
+              if (command === 'gpgconf') {
+                expect(fs.existsSync(gpgHome)).toBe(true);
+                if (outcome === 'gpgconf unavailable') {
+                  throw new Error('gpgconf unavailable');
+                }
+                return 0;
+              }
               if (process.platform === 'darwin') {
                 expect(
                   Buffer.byteLength(path.join(gpgHome, 'S.gpg-agent.browser'))
@@ -287,13 +299,18 @@ describe('gpg tests', () => {
             'https://example.com/jdk.tar.gz.sig',
             'public key'
           );
-          if (outcome === 'success') {
+          if (outcome === 'success' || outcome === 'gpgconf unavailable') {
             await verification;
           } else {
             await expect(verification).rejects.toThrow(outcome);
           }
           expect(exec.exec).toHaveBeenCalledTimes(
-            outcome === 'import failure' ? 1 : 2
+            outcome === 'import failure' ? 2 : 3
+          );
+          expect(exec.exec).toHaveBeenLastCalledWith(
+            'gpgconf',
+            ['--homedir', gpg.toGpgPath(gpgHome), '--kill', 'gpg-agent'],
+            {silent: true, ignoreReturnCode: true}
           );
           expect(fs.existsSync(gpgHome)).toBe(false);
           expect(fs.existsSync(signaturePath)).toBe(false);
@@ -368,7 +385,7 @@ describe('gpg tests', () => {
         ],
         expect.objectContaining({silent: true})
       );
-      expect(exec.exec).toHaveBeenCalledTimes(2);
+      expect(exec.exec).toHaveBeenCalledTimes(3);
     });
   });
 });

__tests__/java-platform-contract.test.ts

@@ -25,6 +25,7 @@ describe('Java platform capabilities', () => {
     ['aarch64', 'aarch64'],
     ['arm64', 'aarch64'],
     ['ppc64le', 'ppc64le'],
+    ['RiScV64', 'riscv64'],
     ['s390x', 's390x']
   ])('normalizes architecture %s to %s', (input, expected) => {
     expect(normalizeArchitecture(input)).toBe(expected);
@@ -68,6 +69,12 @@ describe('Java platform capabilities', () => {
     );
   });
 
+  it('allows Temurin on Linux riscv64', () => {
+    expect(validateJavaPlatform('temurin', 'linux', 'riscv64', '25')).toBe(
+      'riscv64'
+    );
+  });
+
   it('rejects OS-specific restrictions with a consistent diagnostic', () => {
     expect(() =>
       validateJavaPlatform('oracle', 'win32', 'arm64', '21')
@@ -115,6 +122,7 @@ describe('Java platform capabilities', () => {
         'aarch64',
         'ppc64le',
         'ppc64',
+        'riscv64',
         's390x'
       ]) {
         expect(content).toContain(architecture);

__tests__/util.test.ts

@@ -276,6 +276,7 @@ describe('getVersionFromFileContent', () => {
       ['java=21.0.5-graal', '21.0.5', 'graalvm'],
       ['java=17.0.9-graalce', '17.0.9', 'graalvm'],
       ['java=11.0.25-librca', '11.0.25', 'liberica'],
+      ['java=25.0.4+1.1-librca', '25.0.4+1.1', 'liberica'],
       ['java=11.0.25-ms', '11.0.25', 'microsoft'],
       ['java=21.0.5-oracle', '21.0.5', 'oracle'],
       ['java=11.0.25-sapmchn', '11.0.25', 'sapmachine'],

action.yml

@@ -17,7 +17,7 @@ inputs:
     required: false
     default: 'jdk'
   architecture:
-    description: "The architecture of the package (`x86`, `x64`, `armv7`, `aarch64`, `ppc64le`, `ppc64`, or `s390x`). Aliases `ia32`, `amd64`, `arm`, and `arm64` are normalized to `x86`, `x64`, `armv7`, and `aarch64`. Supported values vary by distribution and operating system. Defaults to the action runner's architecture."
+    description: "The architecture of the package (`x86`, `x64`, `armv7`, `aarch64`, `ppc64le`, `ppc64`, `riscv64`, or `s390x`). Aliases `ia32`, `amd64`, `arm`, and `arm64` are normalized to `x86`, `x64`, `armv7`, and `aarch64`. Supported values vary by distribution and operating system. Defaults to the action runner's architecture."
     required: false
   jdk-file:
     description: 'Path to where the compressed JDK is located'

dist/cleanup/index.js

@@ -35832,13 +35832,16 @@ async function removeGpgHome(gpgHome) {
     if (!external_fs_.existsSync(resolvedGpgHome)) {
         return;
     }
+    await stopGpgAgent(resolvedGpgHome);
+    await lib_io/* rmRF */.Yz(resolvedGpgHome);
+}
+async function stopGpgAgent(gpgHome) {
     try {
-        await lib_exec/* exec */.m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
+        await lib_exec/* exec */.m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
     }
     catch {
         // gpgconf may be unavailable, but directory removal must still be attempted.
     }
-    await lib_io/* rmRF */.Yz(resolvedGpgHome);
 }
 async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
     const signaturePath = await tc.downloadTool(signatureUrl);
@@ -35884,6 +35887,7 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
         ], options);
     }
     finally {
+        await stopGpgAgent(gpgHome);
         await io.rmRF(signaturePath);
         await io.rmRF(gpgHome);
     }

dist/setup/220.index.js

@@ -263,13 +263,16 @@ async function removeGpgHome(gpgHome) {
     if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
         return;
     }
+    await stopGpgAgent(resolvedGpgHome);
+    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
+}
+async function stopGpgAgent(gpgHome) {
     try {
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
     }
     catch {
         // gpgconf may be unavailable, but directory removal must still be attempted.
     }
-    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
 }
 async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
     const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
@@ -315,6 +318,7 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
         ], options);
     }
     finally {
+        await stopGpgAgent(gpgHome);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
     }

dist/setup/463.index.js

@@ -375,13 +375,16 @@ async function removeGpgHome(gpgHome) {
     if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
         return;
     }
+    await stopGpgAgent(resolvedGpgHome);
+    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
+}
+async function stopGpgAgent(gpgHome) {
     try {
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
     }
     catch {
         // gpgconf may be unavailable, but directory removal must still be attempted.
     }
-    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
 }
 async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
     const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
@@ -427,6 +430,7 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
         ], options);
     }
     finally {
+        await stopGpgAgent(gpgHome);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
     }

dist/setup/63.index.js

@@ -128,7 +128,8 @@ class LibericaDistributions extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
         }
     }
     convertVersionToSemver(version) {
-        const { buildVersion, featureVersion, interimVersion, updateVersion } = version;
+        const { featureVersion, interimVersion, updateVersion } = version;
+        const buildVersion = version.version.split('+')[1] || version.buildVersion;
         const mainVersion = [featureVersion, interimVersion, updateVersion].join('.');
         if (buildVersion != 0) {
             return `${mainVersion}+${buildVersion}`;

dist/setup/81.index.js

@@ -350,13 +350,16 @@ async function removeGpgHome(gpgHome) {
     if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
         return;
     }
+    await stopGpgAgent(resolvedGpgHome);
+    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
+}
+async function stopGpgAgent(gpgHome) {
     try {
-        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
     }
     catch {
         // gpgconf may be unavailable, but directory removal must still be attempted.
     }
-    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
 }
 async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
     const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
@@ -402,6 +405,7 @@ async function verifyPackageSignature(archivePath, signatureUrl, publicKeyConten
         ], options);
     }
     finally {
+        await stopGpgAgent(gpgHome);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
         await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
     }

dist/setup/index.js

@@ -31022,7 +31022,14 @@ function createUnsupportedPackageError(distributionName, packageType, supportedP
 
 
 const X64_ARM64 = ['x64', 'aarch64'];
-const STANDARD_LINUX = ['x64', 'x86', 'aarch64', 'ppc64le', 's390x'];
+const STANDARD_LINUX = [
+    'x64',
+    'x86',
+    'aarch64',
+    'ppc64le',
+    'riscv64',
+    's390x'
+];
 const JAVA_PLATFORM_CAPABILITIES = {
     [_package_types_js__WEBPACK_IMPORTED_MODULE_2__/* .JavaDistribution */ .zS.Temurin]: {
         platforms: {
@@ -31164,6 +31171,7 @@ const CANONICAL_ARCHITECTURES = [
     'aarch64',
     'ppc64le',
     'ppc64',
+    'riscv64',
     's390x'
 ];
 const PLATFORM_ALIASES = {

docs/advanced-usage.md

@@ -649,7 +649,7 @@ absent from a vendor catalog.
 
 | Distribution | Linux | macOS | Windows | Other / version restrictions |
 | --- | --- | --- | --- | --- |
-| `temurin` | `x64`, `x86`, `armv7`, `aarch64`, `ppc64le`, `s390x` | `x64`, `aarch64` | `x64`, `x86`, `aarch64` | Linux `armv7` is available through Java 17. |
+| `temurin` | `x64`, `x86`, `armv7`, `aarch64`, `ppc64le`, `riscv64`, `s390x` | `x64`, `aarch64` | `x64`, `x86`, `aarch64` | Linux `armv7` is available through Java 17. |
 | `zulu` | `x64`, `x86`, `armv7`, `aarch64` | `x64`, `aarch64` | `x64`, `x86`, `aarch64` | |
 | `liberica` | `x64`, `x86`, `armv7`, `aarch64`, `ppc64le` | `x64`, `aarch64` | `x64`, `x86`, `aarch64` | Solaris: `x64`. |
 | `liberica-nik` | `x64`, `aarch64` | `x64`, `aarch64` | `x64`, `aarch64` | |

src/distributions/liberica/installer.ts

@@ -166,8 +166,8 @@ export class LibericaDistributions extends JavaBase {
   }
 
   private convertVersionToSemver(version: LibericaVersion): string {
-    const {buildVersion, featureVersion, interimVersion, updateVersion} =
-      version;
+    const {featureVersion, interimVersion, updateVersion} = version;
+    const buildVersion = version.version.split('+')[1] || version.buildVersion;
     const mainVersion = [featureVersion, interimVersion, updateVersion].join(
       '.'
     );

src/distributions/platform-types.ts

@@ -5,7 +5,14 @@ import {JavaDistribution} from './package-types.js';
 export type JavaPlatform = 'linux' | 'macos' | 'windows' | 'solaris';
 
 export type JavaArchitecture =
-  'x86' | 'x64' | 'armv7' | 'aarch64' | 'ppc64le' | 'ppc64' | 's390x';
+  | 'x86'
+  | 'x64'
+  | 'armv7'
+  | 'aarch64'
+  | 'ppc64le'
+  | 'ppc64'
+  | 'riscv64'
+  | 's390x';
 
 interface VersionedArchitecture {
   architecture: JavaArchitecture;
@@ -27,7 +34,14 @@ export type JavaPlatformCapability =
   RestrictedPlatformCapability | UnrestrictedPlatformCapability;
 
 const X64_ARM64 = ['x64', 'aarch64'] as const;
-const STANDARD_LINUX = ['x64', 'x86', 'aarch64', 'ppc64le', 's390x'] as const;
+const STANDARD_LINUX = [
+  'x64',
+  'x86',
+  'aarch64',
+  'ppc64le',
+  'riscv64',
+  's390x'
+] as const;
 
 export const JAVA_PLATFORM_CAPABILITIES: Record<
   JavaDistribution,
@@ -174,6 +188,7 @@ const CANONICAL_ARCHITECTURES: readonly JavaArchitecture[] = [
   'aarch64',
   'ppc64le',
   'ppc64',
+  'riscv64',
   's390x'
 ];
 

src/gpg.ts

@@ -89,17 +89,20 @@ export async function removeGpgHome(gpgHome: string): Promise<void> {
     return;
   }
 
+  await stopGpgAgent(resolvedGpgHome);
+  await io.rmRF(resolvedGpgHome);
+}
+
+async function stopGpgAgent(gpgHome: string): Promise<void> {
   try {
     await exec.exec(
       'gpgconf',
-      ['--homedir', toGpgPath(resolvedGpgHome), '--kill', 'gpg-agent'],
+      ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'],
       {silent: true, ignoreReturnCode: true}
     );
   } catch {
     // gpgconf may be unavailable, but directory removal must still be attempted.
   }
-
-  await io.rmRF(resolvedGpgHome);
 }
 
 export async function verifyPackageSignature(
@@ -160,6 +163,7 @@ export async function verifyPackageSignature(
       options
     );
   } finally {
+    await stopGpgAgent(gpgHome);
     await io.rmRF(signaturePath);
     await io.rmRF(gpgHome);
   }