Fix alpine failures by switching default back to only warn on verification failures. To prevent build failures due to missing GPG or rotated vendor keys. (#1262)

Also allow multiple GPG keys to be provided.

Co-authored-by: John <1615532+johnoliver@users.noreply.github.com>
This commit is contained in:
Bruno Borges
2026-09-03 13:27:24 -04:00
committed by GitHub
parent 4889c4aff5
commit 0781fc6af3
27 changed files with 575 additions and 136 deletions
+4 -1
View File
@@ -30801,6 +30801,7 @@ module.exports = {
/* harmony export */ jv: () => (/* binding */ MAVEN_CENTRAL_REPOSITORY_URL),
/* harmony export */ kM: () => (/* binding */ INPUT_JDK_FILE),
/* harmony export */ kN: () => (/* binding */ MAVEN_NO_TRANSFER_PROGRESS_LONG_FLAG),
/* harmony export */ kQ: () => (/* binding */ SIGNATURE_VERIFICATION_FAILURE_HELP),
/* harmony export */ ko: () => (/* binding */ MAVEN_GPG_PASSPHRASE_DEFAULT_ENV),
/* harmony export */ m7: () => (/* binding */ INPUT_MVN_TOOLCHAIN_VENDOR),
/* harmony export */ nr: () => (/* binding */ INPUT_MVN_TOOLCHAIN_ID),
@@ -30821,7 +30822,7 @@ module.exports = {
/* harmony export */ xg: () => (/* binding */ MAVEN_CENTRAL_REPOSITORY_ID),
/* harmony export */ xp: () => (/* binding */ INPUT_DEFAULT_SERVER_PASSWORD)
/* harmony export */ });
/* unused harmony exports INPUT_CACHE_READ_ONLY, INPUT_JOB_STATUS */
/* unused harmony exports SIGNATURE_VERIFICATION_DOCUMENTATION_URL, INPUT_CACHE_READ_ONLY, INPUT_JOB_STATUS */
const MACOS_JAVA_CONTENT_POSTFIX = 'Contents/Home';
const INPUT_JAVA_VERSION = 'java-version';
const INPUT_JAVA_VERSION_FILE = 'java-version-file';
@@ -30836,6 +30837,8 @@ const INPUT_SET_DEFAULT = 'set-default';
const INPUT_PROBLEM_MATCHER = 'problem-matcher';
const INPUT_VERIFY_SIGNATURE = 'verify-signature';
const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
const SIGNATURE_VERIFICATION_DOCUMENTATION_URL = 'https://github.com/actions/setup-java#download-integrity-and-signatures';
const SIGNATURE_VERIFICATION_FAILURE_HELP = `If this is a legitimate vendor signing-key rotation, see ${SIGNATURE_VERIFICATION_DOCUMENTATION_URL} for instructions to configure the updated public key or temporarily disable signature verification.`;
const INPUT_MVN_SERVER_CREDENTIALS = 'mvn-server-credentials';
const INPUT_MVN_REPOSITORIES = 'mvn-repositories';
const INPUT_MVN_REPOSITORIES_INCLUDE_CENTRAL = 'mvn-repositories-include-central';