Description:
Add shared checksum verification for downloaded JDK archives when the selected distribution publishes an authoritative digest.
Today JavaDownloadRelease carries the archive URL and an optional signature URL, and GPG verification is available for Temurin and Microsoft when verify-signature is enabled. Other distributions may publish SHA-256 or SHA-512 checksums but the action has no common way to represent or verify them before extraction and caching.
Extend the download model with optional checksum metadata containing the algorithm, expected digest, and source where useful. Add a shared streaming verifier that computes the archive digest after download and before extraction or insertion into the tool cache. A mismatch must delete or avoid caching the archive and fail with a message containing the distribution, version, algorithm, expected digest, and actual digest without exposing credentials or signed URL query parameters.
Adopt checksum verification incrementally for distributions whose official API or release metadata exposes a trustworthy digest. Do not scrape checksums from untrusted or loosely coupled pages. Preserve existing GPG signature verification for Temurin and Microsoft; checksum verification should complement rather than replace signatures.
Define clear behavior for distributions that do not publish checksums. If checksum verification is automatic, log at debug level when no authoritative digest is available. If exposed through a user input, fail explicitly when the selected distribution cannot support it rather than silently continuing.
Add unit tests for SHA-256 and SHA-512 success, mismatch, malformed metadata, file read errors, cleanup after failure, and URLs containing sensitive query parameters. Add distributor contract tests confirming that checksum metadata is sourced from authoritative vendor responses and an E2E path for at least one supported distribution.
Justification:
Checksum verification detects corrupted, truncated, or unexpectedly modified JDK archives before they are extracted and persisted in the runner tool cache. A shared implementation avoids distributor-specific verification code and makes integrity coverage explicit and testable while retaining stronger signature verification where available.
Are you willing to submit a PR?
Yes.
Description:
Add shared checksum verification for downloaded JDK archives when the selected distribution publishes an authoritative digest.
Today
JavaDownloadReleasecarries the archive URL and an optional signature URL, and GPG verification is available for Temurin and Microsoft whenverify-signatureis enabled. Other distributions may publish SHA-256 or SHA-512 checksums but the action has no common way to represent or verify them before extraction and caching.Extend the download model with optional checksum metadata containing the algorithm, expected digest, and source where useful. Add a shared streaming verifier that computes the archive digest after download and before extraction or insertion into the tool cache. A mismatch must delete or avoid caching the archive and fail with a message containing the distribution, version, algorithm, expected digest, and actual digest without exposing credentials or signed URL query parameters.
Adopt checksum verification incrementally for distributions whose official API or release metadata exposes a trustworthy digest. Do not scrape checksums from untrusted or loosely coupled pages. Preserve existing GPG signature verification for Temurin and Microsoft; checksum verification should complement rather than replace signatures.
Define clear behavior for distributions that do not publish checksums. If checksum verification is automatic, log at debug level when no authoritative digest is available. If exposed through a user input, fail explicitly when the selected distribution cannot support it rather than silently continuing.
Add unit tests for SHA-256 and SHA-512 success, mismatch, malformed metadata, file read errors, cleanup after failure, and URLs containing sensitive query parameters. Add distributor contract tests confirming that checksum metadata is sourced from authoritative vendor responses and an E2E path for at least one supported distribution.
Justification:
Checksum verification detects corrupted, truncated, or unexpectedly modified JDK archives before they are extracted and persisted in the runner tool cache. A shared implementation avoids distributor-specific verification code and makes integrity coverage explicit and testable while retaining stronger signature verification where available.
Are you willing to submit a PR?
Yes.