fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility

The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert
Windows-style paths in environment variables like GNUPGHOME. This caused GPG
to fail with exit code 2 when verifying Microsoft JDK signatures on Windows,
because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid
POSIX path.

Fix: pass --homedir as an explicit command-line argument to both gpg --import
and gpg --verify. MSYS2 does correctly convert Windows paths in command-line
arguments, so this approach works reliably on Windows, Linux, and macOS.

__tests__/gpg.test.ts

@@ -76,13 +76,26 @@ describe('gpg tests', () => {
         expect(exec.exec).toHaveBeenNthCalledWith(
           1,
           'gpg',
-          ['--batch', '--import', expect.stringContaining('public-key.asc')],
+          [
+            '--homedir',
+            expect.any(String),
+            '--batch',
+            '--import',
+            expect.stringContaining('public-key.asc')
+          ],
           expect.objectContaining({silent: true})
         );
         expect(exec.exec).toHaveBeenNthCalledWith(
           2,
           'gpg',
-          ['--batch', '--verify', '/tmp/jdk.tar.gz.sig', '/tmp/jdk.tar.gz'],
+          [
+            '--homedir',
+            expect.any(String),
+            '--batch',
+            '--verify',
+            '/tmp/jdk.tar.gz.sig',
+            '/tmp/jdk.tar.gz'
+          ],
           expect.objectContaining({silent: true})
         );
       });

dist/cleanup/index.js

@@ -52374,13 +52374,12 @@ function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
             }
             throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
         }
-        const env = Object.assign(Object.assign({}, process.env), { GNUPGHOME: gpgHome });
         try {
             const publicKeyFile = path.join(gpgHome, 'public-key.asc');
             fs.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
-            const options = { silent: true, env };
+            const options = { silent: true };
-            yield exec.exec('gpg', ['--batch', '--import', publicKeyFile], options);
+            yield exec.exec('gpg', ['--homedir', gpgHome, '--batch', '--import', publicKeyFile], options);
-            yield exec.exec('gpg', ['--batch', '--verify', signaturePath, archivePath], options);
+            yield exec.exec('gpg', ['--homedir', gpgHome, '--batch', '--verify', signaturePath, archivePath], options);
         }
         finally {
             yield io.rmRF(signaturePath);

dist/setup/index.js

@@ -81154,13 +81154,12 @@ function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
             }
             throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`);
         }
-        const env = Object.assign(Object.assign({}, process.env), { GNUPGHOME: gpgHome });
         try {
             const publicKeyFile = path.join(gpgHome, 'public-key.asc');
             fs.writeFileSync(publicKeyFile, publicKeyContent, { encoding: 'utf-8' });
-            const options = { silent: true, env };
+            const options = { silent: true };
-            yield exec.exec('gpg', ['--batch', '--import', publicKeyFile], options);
+            yield exec.exec('gpg', ['--homedir', gpgHome, '--batch', '--import', publicKeyFile], options);
-            yield exec.exec('gpg', ['--batch', '--verify', signaturePath, archivePath], options);
+            yield exec.exec('gpg', ['--homedir', gpgHome, '--batch', '--verify', signaturePath, archivePath], options);
         }
         finally {
             yield io.rmRF(signaturePath);

src/gpg.ts

@@ -78,16 +78,18 @@ export async function verifyPackageSignature(
       }`
     );
   }
-  const env = {...process.env, GNUPGHOME: gpgHome};
-
   try {
     const publicKeyFile = path.join(gpgHome, 'public-key.asc');
     fs.writeFileSync(publicKeyFile, publicKeyContent, {encoding: 'utf-8'});
-    const options: ExecOptions = {silent: true, env};
+    const options: ExecOptions = {silent: true};
-    await exec.exec('gpg', ['--batch', '--import', publicKeyFile], options);
     await exec.exec(
       'gpg',
-      ['--batch', '--verify', signaturePath, archivePath],
+      ['--homedir', gpgHome, '--batch', '--import', publicKeyFile],
+      options
+    );
+    await exec.exec(
+      'gpg',
+      ['--homedir', gpgHome, '--batch', '--verify', signaturePath, archivePath],
       options
     );
   } finally {