feat: Add verify-signature plumbing and Temurin+Microsoft verification support

[johnoliver]

This pull request introduces support for signature verification of downloaded Java packages from the Temurin distribution. It adds a new option to enable signature verification, updates the documentation to reflect this feature, and extends the test data and CI workflows to validate this functionality.

Key changes:

Feature: Signature Verification for Temurin

• Added a new verify-signature option to enable signature verification for Java packages when using the Temurin distribution. If enabled for unsupported distributions, the action will fail. (README.md)

Continuous Integration / Testing

• Introduced a new CI job (setup-java-temurin-signature-verification) that runs signature verification tests for Temurin Java versions 17 and 21 across major operating systems. (.github/workflows/e2e-versions.yml)

Test Data Updates

• Extended the Temurin test data (temurin.json) to include signature_link fields for all relevant Java package entries, enabling automated tests to access signature files for verification. (__tests__/data/temurin.json) [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21]Description:
  Describe your changes.

Related issue:
Add link to the related issue.

Check list:

• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

This pull request adds optional GPG signature verification for downloaded Temurin JDK archives in actions/setup-java, including new action inputs, Temurin manifest plumbing for signature URLs, and CI/tests to validate the behavior.

Changes:

• Add verify-signature (and public-key override plumbing) to installer options and enforce “unsupported distribution” failures centrally in JavaBase.
• Implement Temurin signature verification using a bundled Adoptium public key (with an optional user-provided override key) and new signature_link manifest support.
• Extend unit tests, Temurin test manifest data, and E2E workflow coverage to exercise signature verification.

Reviewed changes

Copilot reviewed 15 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/setup-java.ts	Reads new inputs and forwards signature-verification options into installer configuration.
src/gpg.ts	Adds verifyPackageSignature() helper that downloads a detached signature and verifies it via gpg.
src/distributions/temurin/models.ts	Extends Temurin manifest typing with optional signature_link.
src/distributions/temurin/installer.ts	Plumbs signatureUrl into releases and performs verification when enabled; declares Temurin supports verification.
src/distributions/temurin/adoptium-key.ts	Adds bundled Adoptium ASCII-armored public key for default verification.
src/distributions/base-models.ts	Extends installer options and download release model with signature-related fields.
src/distributions/base-installer.ts	Adds centralized guard to fail when verification is enabled for unsupported distributions.
src/constants.ts	Adds new input name constants for signature verification.
README.md	Documents the new verify-signature input (but currently misses the public-key override input).
action.yml	Adds new action inputs verify-signature and verify-signature-public-key.
.github/workflows/e2e-versions.yml	Adds an E2E job matrix to validate Temurin signature verification across OSes and JDK versions.
tests/gpg.test.ts	Adds unit coverage for verifyPackageSignature() behavior.
tests/distributors/temurin-installer.test.ts	Adds unit coverage for Temurin verification flow and key override behavior.
tests/distributors/base-installer.test.ts	Adds unit coverage ensuring unsupported distributions fail when verification is enabled.
tests/data/temurin.json	Adds signature_link fields to Temurin test data entries for verification tests.
dist/setup/index.js	Updates bundled build output to include new inputs and verification logic.
dist/cleanup/index.js	Updates bundled build output to include new constants and GPG helper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 17 changed files in this pull request and generated 1 comment.

[brunoborges]

@johnoliver can you check the failing builds?

[gdams]

LGTM

[gdams]

I actually feel looking at this again that we really should be enabling signature verification by default where possible. To me verify-signature should be set as true by default for distros that support GPG verification and then this can be disabled by setting verify-signature: false. We could do a quick sanity check for gpg in the path too I guess?

[johnoliver]

So I think while it would absolutely be the correct behaviour to default to true, but to avoid any breaking changes I would roll out a version with it false by default for now. Then we can make sure the verification works live before enabling it by default.