diff --git a/__tests__/auth.test.ts b/__tests__/auth.test.ts index 7ed67561..0c0da081 100644 --- a/__tests__/auth.test.ts +++ b/__tests__/auth.test.ts @@ -228,9 +228,40 @@ describe('auth tests', () => { \${env.${username}} \${env.&<>"''"><&} + + + + setup-java-gpg + + ${gpgPassphrase} + + + + + setup-java-gpg + +`; + + expect(auth.generate(id, username, password, gpgPassphrase)).toEqual( + expectedSettings + ); + }); + + it('does not add a gpg profile when the passphrase env var is the maven-gpg-plugin default', () => { + const id = 'packages'; + const username = 'USER'; + const password = '&<>"\'\'"><&'; + const gpgPassphrase = 'MAVEN_GPG_PASSPHRASE'; + + const expectedSettings = ` + false + - gpg.passphrase - \${env.${gpgPassphrase}} + ${id} + \${env.${username}} + \${env.&<>"''"><&} `; diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index e710603c..40b7bac3 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -95849,6 +95849,12 @@ const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = (/* unused pure expression or super */ null && (undefined)); const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; const INPUT_CACHE = 'cache'; const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; const INPUT_JOB_STATUS = 'job-status'; diff --git a/dist/setup/index.js b/dist/setup/index.js index f3456691..ee21689e 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -73294,6 +73294,12 @@ const INPUT_GPG_PRIVATE_KEY = 'gpg-private-key'; const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; const INPUT_CACHE = 'cache'; const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; const constants_INPUT_JOB_STATUS = 'job-status'; @@ -127311,12 +127317,25 @@ function generate(id, username, password, gpgPassphrase) { } } }; - if (gpgPassphrase) { - const gpgServer = { - id: 'gpg.passphrase', - passphrase: `\${env.${gpgPassphrase}}` + // The maven-gpg-plugin reads the passphrase from the environment variable + // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE). + // Only configure it when the requested env var name differs from that default; + // otherwise the plugin already reads the right variable and no extra settings + // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails + // when the plugin's `bestPractices` mode is enabled. + if (gpgPassphrase && + gpgPassphrase !== MAVEN_GPG_PASSPHRASE_DEFAULT_ENV) { + xmlObj.settings.profiles = { + profile: { + id: GPG_PASSPHRASE_PROFILE_ID, + properties: { + 'gpg.passphraseEnvName': gpgPassphrase + } + } + }; + xmlObj.settings.activeProfiles = { + activeProfile: GPG_PASSPHRASE_PROFILE_ID }; - xmlObj.settings.servers.server.push(gpgServer); } return (0,lib/* create */.vt)(xmlObj).end({ headless: true, diff --git a/docs/advanced-usage.md b/docs/advanced-usage.md index 28c6d192..8a112afc 100644 --- a/docs/advanced-usage.md +++ b/docs/advanced-usage.md @@ -682,15 +682,27 @@ If you use `maven-gpg-plugin` older than 3.2.0, or you prefer signing with the ` MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} ``` -With these inputs, setup-java adds a `gpg.passphrase` server to the generated `settings.xml`: +The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, which defaults to `MAVEN_GPG_PASSPHRASE`. + +- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`. +- If `gpg-passphrase` is any other name, setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable: ```xml - - gpg.passphrase - ${env.MAVEN_GPG_PASSPHRASE} - + + + setup-java-gpg + + GPG_PASSPHRASE + + + + + setup-java-gpg + ``` +> **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead. + When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`: ```xml @@ -703,7 +715,7 @@ When signing with the `gpg` executable, the Maven GPG Plugin configuration in yo ``` -GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`. +GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to read the passphrase non-interactively. ***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher. diff --git a/src/auth.ts b/src/auth.ts index 2f0ac608..4d9dde82 100644 --- a/src/auth.ts +++ b/src/auth.ts @@ -93,12 +93,27 @@ export function generate( } }; - if (gpgPassphrase) { - const gpgServer = { - id: 'gpg.passphrase', - passphrase: `\${env.${gpgPassphrase}}` + // The maven-gpg-plugin reads the passphrase from the environment variable + // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE). + // Only configure it when the requested env var name differs from that default; + // otherwise the plugin already reads the right variable and no extra settings + // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails + // when the plugin's `bestPractices` mode is enabled. + if ( + gpgPassphrase && + gpgPassphrase !== constants.MAVEN_GPG_PASSPHRASE_DEFAULT_ENV + ) { + xmlObj.settings.profiles = { + profile: { + id: constants.GPG_PASSPHRASE_PROFILE_ID, + properties: { + 'gpg.passphraseEnvName': gpgPassphrase + } + } + }; + xmlObj.settings.activeProfiles = { + activeProfile: constants.GPG_PASSPHRASE_PROFILE_ID }; - xmlObj.settings.servers.server.push(gpgServer); } return xmlCreate(xmlObj).end({ diff --git a/src/constants.ts b/src/constants.ts index 2f7362b0..d3ac9c59 100644 --- a/src/constants.ts +++ b/src/constants.ts @@ -21,6 +21,14 @@ export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase'; export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined; export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE'; +// The default name of the environment variable the maven-gpg-plugin reads the +// passphrase from (property `gpg.passphraseEnvName`). When the configured +// passphrase env var name matches this, no extra configuration is required. +export const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE'; + +// Id of the settings.xml profile used to set `gpg.passphraseEnvName`. +export const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg'; + export const INPUT_CACHE = 'cache'; export const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path'; export const INPUT_JOB_STATUS = 'job-status';