Verify JDK downloads with vendor checksums - #1167
Merged
brunoborges merged 8 commits intoJul 29, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Adds shared, automatic integrity verification for downloaded JDK archives by propagating vendor-provided checksum metadata through the download model and verifying the archive digest (SHA-256/SHA-512) before extraction/caching. This strengthens download integrity across multiple supported distributions while keeping existing GPG signature verification unchanged.
Changes:
- Extend JavaDownloadRelease with optional checksum metadata and introduce a shared downloadAndVerify path in the base installer.
- Implement streaming checksum calculation/verification with sanitized error messages and cleanup of failed downloads.
- Add unit + distributor contract tests, an E2E forced-download path (Corretto), and update docs/action metadata; rebuild the bundled dist output.
| File | Description |
|---|---|
| src/distributions/zulu/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/temurin/installer.ts | Populate checksum metadata from vendor API; use shared download+verification. |
| src/distributions/semeru/installer.ts | Populate checksum metadata from vendor API; use shared download+verification. |
| src/distributions/sapmachine/installer.ts | Attach checksum metadata and use shared download+verification. |
| src/distributions/oracle/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/openjdk/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/microsoft/installer.ts | Switch download flow to shared download+verification helper (signature flow remains). |
| src/distributions/liberica/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/liberica-nik/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/kona/installer.ts | Add checksum metadata sourced from Kona releases JSON; use shared download+verification. |
| src/distributions/jetbrains/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/graalvm/installer.ts | Switch download flow to shared download+verification helper. |
| src/distributions/dragonwell/installer.ts | Attach checksum metadata when present; use shared download+verification. |
| src/distributions/corretto/installer.ts | Add checksum metadata sourced from Corretto versions JSON; use shared download+verification. |
| src/distributions/base-models.ts | Add checksum types and optional checksum field on releases. |
| src/distributions/base-installer.ts | Add downloadAndVerify helper integrating checksum verification + cleanup. |
| src/checksum.ts | New checksum calculation/verification implementation with sanitized source handling. |
| README.md | Document automatic checksum verification behavior and relationship to signatures. |
| dist/setup/index.js | Rebuilt bundle including checksum logic and updated installers. |
| action.yml | Clarify signature verification as complementary to automatic checksum verification. |
| .github/workflows/e2e-versions.yml | Add E2E job that forces a Corretto download to exercise verification path. |
| tests/distributors/temurin-installer.test.ts | Assert Temurin checksum metadata is sourced from vendor response. |
| tests/distributors/semeru-installer.test.ts | Assert Semeru checksum metadata is sourced from vendor response. |
| tests/distributors/sapmachine-installer.test.ts | Assert SapMachine checksum shape/format is present. |
| tests/distributors/kona-installer.test.ts | Assert Kona checksum metadata when present (incl. source URL). |
| tests/distributors/dragonwell-installer.test.ts | Assert Dragonwell checksum shape/format is present. |
| tests/distributors/corretto-installer.test.ts | Assert Corretto checksum metadata includes expected source URL. |
| tests/distributors/base-installer.test.ts | Add unit coverage for download+verify success, mismatch cleanup, and “no checksum” debug behavior. |
| tests/distributors/adopt-installer.test.ts | Assert Adopt checksum metadata is sourced from vendor response. |
| tests/checksum.test.ts | Add unit coverage for sha256/sha512 success, mismatch messaging, malformed metadata, source sanitization, and read errors. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 30/31 changed files
- Comments generated: 2
- Review effort level: Low
Sorry, something went wrong.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
JetBrains publishes a single, generically-named ".checksum" sibling whose digest algorithm isn't disclosed by the filename. Older JBR 11 builds (e.g. jbrsdk_nomod-11_0_16-*-b2043.64.tar.gz) publish a SHA-256 digest there, while newer builds publish SHA-512. The JetBrains installer previously assumed SHA-512 unconditionally, so verification failed with "Malformed sha512 checksum metadata ... expected a 128-character hexadecimal digest" for those older builds, breaking the jetbrains 11 e2e job on macOS and Windows. fetchChecksum now accepts a list of candidate algorithms and infers the actual algorithm from the returned digest's length, preferring the strongest match. The JetBrains installer passes ['sha512', 'sha256']; all other callers are unaffected since they already pass a single, vendor-disclosed algorithm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Downloaded JDK archives were extracted and cached without a common integrity check even when vendors published authoritative digests. This adds automatic streaming SHA-256/SHA-512 verification before extraction, removes failed downloads, and keeps diagnostics free of signed URL credentials.
Checksum metadata is sourced from authoritative vendor APIs or checksum siblings for Temurin, Semeru, Adopt, Corretto, Dragonwell, Kona, SapMachine, GraalVM, GraalVM Community, Zulu, Oracle, Oracle OpenJDK, Microsoft, and JetBrains. Distributions or releases without a strong authoritative digest continue normally with debug-level visibility. Existing opt-in GPG verification for Temurin and Microsoft remains complementary and unchanged.
The change also adds unit and distributor contract coverage, a forced-download Corretto E2E path, user documentation, and a rebuilt action bundle.
Related issue:
Fixes: #1166
Check list: