{{ message }}
Repository navigation
Verify JDK downloads with vendor checksums - #1167
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Contributor
There was a problem hiding this comment.
Pull request overview
Adds shared, automatic integrity verification for downloaded JDK archives by propagating vendor-provided checksum metadata through the download model and verifying the archive digest (SHA-256/SHA-512) before extraction/caching. This strengthens download integrity across multiple supported distributions while keeping existing GPG signature verification unchanged.
Changes:
- Extend
JavaDownloadReleasewith optional checksum metadata and introduce a shareddownloadAndVerifypath in the base installer. - Implement streaming checksum calculation/verification with sanitized error messages and cleanup of failed downloads.
- Add unit + distributor contract tests, an E2E forced-download path (Corretto), and update docs/action metadata; rebuild the bundled
distoutput.
Show a summary per file
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 30/31 changed files
- Comments generated: 2
- Review effort level: Low
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
JetBrains publishes a single, generically-named ".checksum" sibling whose digest algorithm isn't disclosed by the filename. Older JBR 11 builds (e.g. jbrsdk_nomod-11_0_16-*-b2043.64.tar.gz) publish a SHA-256 digest there, while newer builds publish SHA-512. The JetBrains installer previously assumed SHA-512 unconditionally, so verification failed with "Malformed sha512 checksum metadata ... expected a 128-character hexadecimal digest" for those older builds, breaking the jetbrains 11 e2e job on macOS and Windows. fetchChecksum now accepts a list of candidate algorithms and infers the actual algorithm from the returned digest's length, preferring the strongest match. The JetBrains installer passes ['sha512', 'sha256']; all other callers are unaffected since they already pass a single, vendor-disclosed algorithm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Downloaded JDK archives were extracted and cached without a common integrity check even when vendors published authoritative digests. This adds automatic streaming SHA-256/SHA-512 verification before extraction, removes failed downloads, and keeps diagnostics free of signed URL credentials.
Checksum metadata is sourced from authoritative vendor APIs or checksum siblings for Temurin, Semeru, Adopt, Corretto, Dragonwell, Kona, SapMachine, GraalVM, GraalVM Community, Zulu, Oracle, Oracle OpenJDK, Microsoft, and JetBrains. Distributions or releases without a strong authoritative digest continue normally with debug-level visibility. Existing opt-in GPG verification for Temurin and Microsoft remains complementary and unchanged.
The change also adds unit and distributor contract coverage, a forced-download Corretto E2E path, user documentation, and a rebuilt action bundle.
Related issue:
Fixes: #1166
Check list:
npm run checklocally (format, lint, build, test) and all checks pass.