Fix JetBrains hotfix version selection and cache precedence

.github/workflows/e2e-versions.yml

@@ -51,15 +51,6 @@ jobs:
           - distribution: microsoft
             os: macos-latest
             version: 25
-          - distribution: microsoft
-            os: windows-latest
-            version: '25.0.5+0.2'
-          - distribution: microsoft
-            os: ubuntu-latest
-            version: '25.0.5+0.2'
-          - distribution: microsoft
-            os: macos-latest
-            version: '25.0.5+0.2'
           - distribution: kona
             os: windows-latest
             version: 25

README.md

@@ -225,7 +225,6 @@ Additional distribution notes:
 
 - Oracle OpenJDK builds are archived after a limited number of releases and no longer receive security updates. To continue receiving security patches, use Oracle JDK or another vendor.
 - Azul Zulu maps `arm64` to `aarch64` when querying the Azul Metadata API.
-- Microsoft Build of OpenJDK uses Microsoft's live version manifest, falling back to the bundled version list when no release matches. Version `25.0.5.0.2` can also be requested as `25.0.5+0.2`.
 - GraalVM Community is available as `distribution: graalvm-community` for stable JDK 17 and later releases.
 - On Ubuntu runners, commands executed with `sudo` do not inherit the `JAVA_HOME` and `PATH` set by `setup-java` and may fall back to the system-default JDK.
 

__tests__/distributors/jetbrains-installer.test.ts

@@ -9,6 +9,9 @@ import {
   afterAll
 } from '@jest/globals';
 import https from 'https';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
 import {HttpClient, HttpClientResponse} from '@actions/http-client';
 import type {IncomingMessage} from 'http';
 import {Readable} from 'stream';
@@ -476,6 +479,109 @@ describe('findPackageForDownload', () => {
     }
   );
 
+  describe('hotfix releases', () => {
+    beforeEach(() => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4b508.27', false),
+          release('jbr-release-25.0.4.1b635.9', false),
+          release('jbr-release-25.0.4.1b635.79', false),
+          release('jbr-release-25.0.3.2b1000.1', false)
+        ]
+      });
+      jest.spyOn(HttpClient.prototype, 'head').mockResolvedValue(response(200));
+    });
+
+    it.each(['linux', 'osx', 'windows'])(
+      'selects the patched JBR archive and checksum on %s',
+      async platform => {
+        const distribution = new JetBrainsDistribution({
+          version: '25',
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+        distribution['getPlatformOption'] = () => platform;
+        const url = `https://cache-redirector.jetbrains.com/intellij-jbr/jbrsdk-25.0.4.1-${platform}-x64-b635.79.tar.gz`;
+
+        const result = await distribution['findPackageForDownload']('25');
+
+        expect(result).toEqual({
+          version: '25.0.4+1.635.79',
+          url,
+          checksum: {
+            algorithm: 'sha512',
+            value: JETBRAINS_CHECKSUM,
+            source: `${url}.checksum`
+          }
+        });
+        expect(HttpClient.prototype.head).toHaveBeenCalledWith(url);
+        expect(spyHttpClientGet).toHaveBeenCalledTimes(1);
+        expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.checksum`);
+      }
+    );
+
+    it.each([
+      ['latest', '25.0.4+1.635.79'],
+      ['25.0.4', '25.0.4+1.635.79'],
+      ['25.0.4.0', '25.0.4+508.27'],
+      ['25.0.4.1', '25.0.4+1.635.79'],
+      ['25.0.4.1+635.79', '25.0.4+1.635.79'],
+      ['25.0.4+1.635.9', '25.0.4+1.635.9'],
+      ['25.0.4+508.27', '25.0.4+508.27']
+    ])('resolves %s to %s', async (input, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: input,
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: expected});
+    });
+
+    it('resolves early-access hotfix releases separately', async () => {
+      jest.spyOn(HttpClient.prototype, 'getJson').mockResolvedValue({
+        statusCode: 200,
+        headers: {},
+        result: [
+          release('jbr-release-25.0.4.1b635.79', true),
+          release('jbr-release-25.0.4.2b636.1', false)
+        ]
+      });
+      const distribution = new JetBrainsDistribution({
+        version: '25.0.4.1-ea',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: true
+      });
+
+      await expect(
+        distribution['findPackageForDownload'](distribution['version'])
+      ).resolves.toMatchObject({version: '25.0.4+1.635.79'});
+    });
+
+    it.each(['25.0.4.2', '25.0.4.1+635.80'])(
+      'does not substitute another patch or build for %s',
+      async input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: true
+        });
+
+        await expect(
+          distribution['findPackageForDownload'](distribution['version'])
+        ).rejects.toThrow(/No matching version found/);
+      }
+    );
+  });
+
   it('version is not found', async () => {
     const distribution = new JetBrainsDistribution({
       version: '8.0.452',
@@ -569,4 +675,84 @@ describe('findPackageForDownload', () => {
       source: `${result.url}.checksum`
     });
   });
+
+  describe('compareVersions', () => {
+    it.each([
+      ['25.0.4+1.635.79', '25.0.4+508.27', 1],
+      ['25.0.5+1.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+10.1.1', '25.0.4+2.999.99', 1],
+      ['25.0.4+1.635.79', '25.0.4+1.635.9', 1],
+      ['25.0.4+1.636.1', '25.0.4+1.635.79', 1],
+      ['25.0.4+0.635.79', '25.0.4+635.79', 0],
+      ['11.0.11+1522', '11.0.11+1522.1', -1],
+      ['25.0.4', '25.0.4+508.27', -1]
+    ])('compares %s with %s', (first, second, expected) => {
+      const distribution = new JetBrainsDistribution({
+        version: '25',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+
+      expect(Math.sign(distribution['compareVersions'](first, second))).toBe(
+        expected
+      );
+      expect(
+        Math.sign(distribution['compareVersions'](second, first)) || 0
+      ).toBe(-expected || 0);
+    });
+  });
+
+  describe('hotfix releases in the tool cache', () => {
+    let cacheRoot: string;
+    const previousToolcache = process.env['RUNNER_TOOL_CACHE'];
+
+    beforeEach(async () => {
+      cacheRoot = await fs.promises.mkdtemp(
+        path.join(os.tmpdir(), 'jetbrains-')
+      );
+      process.env['RUNNER_TOOL_CACHE'] = cacheRoot;
+      for (const version of ['25.0.4-508.27', '25.0.4-1.635.79']) {
+        const javaPath = path.join(
+          cacheRoot,
+          'Java_JetBrains_jdk',
+          version,
+          'x64'
+        );
+        await fs.promises.mkdir(javaPath, {recursive: true});
+        await fs.promises.writeFile(`${javaPath}.complete`, '');
+      }
+    });
+
+    afterEach(async () => {
+      if (previousToolcache === undefined) {
+        delete process.env['RUNNER_TOOL_CACHE'];
+      } else {
+        process.env['RUNNER_TOOL_CACHE'] = previousToolcache;
+      }
+      await fs.promises.rm(cacheRoot, {recursive: true, force: true});
+    });
+
+    it.each(['25', '25.0.4.1', '25.0.4.1+635.79'])(
+      'reuses the patched JBR for %s',
+      input => {
+        const distribution = new JetBrainsDistribution({
+          version: input,
+          architecture: 'x64',
+          packageType: 'jdk',
+          checkLatest: false
+        });
+
+        expect(distribution['findInToolcache']()).toEqual({
+          version: '25.0.4+1.635.79',
+          path: path.join(
+            cacheRoot,
+            'Java_JetBrains_jdk',
+            '25.0.4-1.635.79',
+            'x64'
+          )
+        });
+      }
+    );
+  });
 });

__tests__/distributors/microsoft-installer.test.ts

@@ -216,90 +216,6 @@ describe('findPackageForDownload', () => {
     expect(result.signatureUrl).toBe(`${url}.sig`);
   });
 
-  describe.each(['25.0.5.0.2', '25.0.5+0.2', '25.0.5'])(
-    'version %s missing from the live manifest',
-    version => {
-      it.each([
-        ['darwin', 'x64', 'macos', 'tar.gz'],
-        ['linux', 'x64', 'linux', 'tar.gz'],
-        ['win32', 'x64', 'windows', 'zip'],
-        ['darwin', 'aarch64', 'macos', 'tar.gz'],
-        ['linux', 'aarch64', 'linux', 'tar.gz'],
-        ['win32', 'aarch64', 'windows', 'zip']
-      ])(
-        'resolves the bundled release for %s/%s',
-        async (platform, architecture, osType, extension) => {
-          mockOsPlatform.mockReturnValue(platform);
-          const distro = new MicrosoftDistributions({
-            version,
-            architecture,
-            packageType: 'jdk',
-            checkLatest: false
-          });
-
-          const result = await distro['findPackageForDownload'](
-            distro['version']
-          );
-          const url = `https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-${osType}-${architecture}.${extension}`;
-
-          expect(result).toEqual({
-            version: '25.0.5+0.2',
-            url,
-            signatureUrl: `${url}.sig`,
-            checksum: {
-              algorithm: 'sha256',
-              value: MICROSOFT_CHECKSUM,
-              source: `${url}.sha256sum.txt`
-            }
-          });
-          expect(spyHttpClientGet).toHaveBeenCalledWith(`${url}.sha256sum.txt`);
-        }
-      );
-    }
-  );
-
-  it('prefers the live manifest when it contains the requested release', async () => {
-    mockOsPlatform.mockReturnValue('linux');
-    const url =
-      'https://example.test/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz';
-    spyGetManifestFromRepo.mockResolvedValue({
-      result: [
-        {
-          version: '25.0.5+0.2',
-          stable: true,
-          release_url: 'https://aka.ms/download-jdk',
-          files: [
-            {
-              filename: 'microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz',
-              arch: 'x64',
-              platform: 'linux',
-              download_url: url
-            }
-          ]
-        }
-      ],
-      statusCode: 200,
-      headers: {}
-    });
-
-    const result = await distribution['findPackageForDownload']('25.0.5+0.2');
-
-    expect(result.version).toBe('25.0.5+0.2');
-    expect(result.url).toBe(url);
-    expect(spyGetManifestFromRepo).toHaveBeenCalledWith(
-      'https://aka.ms/download-jdk/microsoft-openjdk-versions.json',
-      {accept: 'application/json'}
-    );
-  });
-
-  it('preserves the error when the live manifest cannot be loaded', async () => {
-    spyGetManifestFromRepo.mockRejectedValue(new Error('Network error'));
-
-    await expect(
-      distribution['findPackageForDownload']('25.0.5+0.2')
-    ).rejects.toThrow('Could not load manifest for Microsoft Build of OpenJDK');
-  });
-
   it.each([
     ['amd64', 'x64'],
     ['arm64', 'aarch64']

dist/setup/220.index.js

@@ -0,0 +1,330 @@
+export const id = 220;
+export const ids = [220];
+export const modules = {
+
+/***/ 3220:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  MicrosoftDistributions: () => (/* binding */ MicrosoftDistributions)
+});
+
+// UNUSED EXPORTS: MICROSOFT_PUBLIC_KEY
+
+// EXTERNAL MODULE: ./src/distributions/base-installer.ts + 2 modules
+var base_installer = __webpack_require__(6242);
+// EXTERNAL MODULE: ./src/util.ts
+var util = __webpack_require__(4527);
+// EXTERNAL MODULE: ./src/gpg.ts
+var gpg = __webpack_require__(8343);
+;// CONCATENATED MODULE: ./src/distributions/microsoft/microsoft-key.ts
+// Microsoft Build of OpenJDK GPG signing key
+// Retrieved from: https://download.visualstudio.microsoft.com/download/pr/b90071e2-e0cf-4411-98be-dbeb09d67bf0/8622862bcd54206e158c5abca0582c9b/464279_464280_aoc_20210208.asc
+const MICROSOFT_PUBLIC_KEY = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: BSN Pgp v1.1.0.0
+
+mQENBGAhlWcBCADCQjj6huLTenvZSLej35e9YKEHm4lix2uvPOONexMaU8V2v7KL
+RGdoXF7jwHci7efnPZ+9zpS2+g3rhvv8M7yWy9E/1psEtGzvmp1IL/qIabMEQqi+
+UlhPGh7MQ/BkXAlic8Dyl3XYqr0EXS11iCiTr6Zkxs9Ee4V54gxL4gogRn4wk9sl
+/nrjgDzMsUwla0pynoQQvYpqCdiAr3gKKllT1skCDqgVOMMyZxsx9HjZxg/3AJz6
+r5i512L2R+3Hkv+XmxT+mnGBCFcny0DM7PjNXEmIK3ZSkro1tQML90zx3Fyh5esx
+fpVvuIXGFV75o35VVCBZoiD3hcfOnIJsPQ9nABEBAAG0OE1pY3Jvc29mdCBKYXZh
+IEVuZ2luZWVyaW5nIDxqYXZhcGxhdGluZnJhQG1pY3Jvc29mdC5jb20+iQE4BBMB
+CAAiBQJgIZVnAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRA1Ux0xWyHB
+icwTCACJO2FGNocNvdUtAb+eDKuGwt0chAJdCES2ZtgBScwrwDyWpxpRznoXWBHL
+MJeLyxJoKsCG3vVlY4uh48psCzVm3OKvi7MCPT955t8W6TzfSBxTpjR8zRgJkjPJ
+EGhHTlusUfz7TtM5etJF0qscSJH1grcNsgtee97mk4QyEzT8Di83NQmYxKcBrliq
+yK/SWWt8VkTyYAEO6L5PoB4L9r8ka27uQs+jgCw+/Z0JMtNmmhyNGY3+a1YtPeoy
+JdQaI9LphfKGbVaz6SK2aol7vj+c2TG3TLUYdOYGMH1OZlri2GTkCVjwna2GC7p4
+Fa133tP85xzJEq1XeXm8WeLFo2wV
+=rHCS
+-----END PGP PUBLIC KEY BLOCK-----`;
+
+// EXTERNAL MODULE: ./src/constants.ts
+var constants = __webpack_require__(7242);
+// EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
+var core = __webpack_require__(3838);
+// EXTERNAL MODULE: ./node_modules/@actions/tool-cache/lib/tool-cache.js + 2 modules
+var tool_cache = __webpack_require__(9805);
+// EXTERNAL MODULE: external "fs"
+var external_fs_ = __webpack_require__(9896);
+var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
+// EXTERNAL MODULE: external "path"
+var external_path_ = __webpack_require__(6928);
+var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
+;// CONCATENATED MODULE: ./src/distributions/microsoft/installer.ts
+
+
+
+
+
+
+
+
+
+
+class MicrosoftDistributions extends base_installer/* JavaBase */.O {
+    constructor(installerOptions) {
+        super('Microsoft', installerOptions);
+    }
+    async downloadTool(javaRelease) {
+        core/* info */.pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
+        let javaArchivePath = await this.downloadAndVerify(javaRelease);
+        if (this.verifySignature) {
+            try {
+                if (!javaRelease.signatureUrl) {
+                    throw new Error(`Input 'verify-signature' is enabled, but no signature URL was found for Microsoft Build of OpenJDK version ${javaRelease.version}.`);
+                }
+                core/* info */.pq(`Verifying Java package signature...`);
+                try {
+                    await gpg/* verifyPackageSignature */.Yi(javaArchivePath, javaRelease.signatureUrl, this.verifySignaturePublicKey ?? MICROSOFT_PUBLIC_KEY);
+                }
+                catch (error) {
+                    throw new Error(`Failed to verify signature for Microsoft Build of OpenJDK version ${javaRelease.version}. Signature URL: ${javaRelease.signatureUrl}. Error: ${error.message} ${constants/* SIGNATURE_VERIFICATION_FAILURE_HELP */.kQ}`, { cause: error });
+                }
+            }
+            catch (error) {
+                if (this.verifySignatureExplicitlyRequested) {
+                    throw error;
+                }
+                core/* warning */.$e(error instanceof Error ? error.message : `Unknown error: ${error}`);
+            }
+        }
+        core/* info */.pq(`Extracting Java archive...`);
+        const extension = (0,util/* getDownloadArchiveExtension */.ag)();
+        if (process.platform === 'win32') {
+            javaArchivePath = (0,util/* renameWinArchive */.n2)(javaArchivePath);
+        }
+        const extractedJavaPath = await (0,util/* extractJdkFile */.PE)(javaArchivePath, extension);
+        const archiveName = external_fs_default().readdirSync(extractedJavaPath)[0];
+        const archivePath = external_path_default().join(extractedJavaPath, archiveName);
+        const javaPath = await (0,util/* cacheJdkDir */.Vj)(archivePath, this.toolcacheFolderName, this.getToolcacheVersionName(javaRelease.version), this.architecture);
+        return { version: javaRelease.version, path: javaPath };
+    }
+    async findPackageForDownload(range) {
+        const arch = this.distributionArchitecture();
+        if (arch !== 'x64' && arch !== 'aarch64') {
+            throw new Error(`Unsupported architecture: ${this.architecture}`);
+        }
+        if (!this.stable) {
+            throw new Error('Early access versions are not supported');
+        }
+        if (this.packageType !== 'jdk') {
+            throw new Error('Microsoft Build of OpenJDK provides only the `jdk` package type');
+        }
+        const manifest = await this.getAvailableVersions();
+        if (!manifest) {
+            throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
+        }
+        const foundRelease = await tool_cache/* findFromManifest */.DC(range, true, manifest, arch);
+        if (!foundRelease) {
+            const availableVersionStrings = manifest.map(item => item.version);
+            throw this.createVersionNotFoundError(range, availableVersionStrings);
+        }
+        const file = foundRelease.files[0];
+        const signatureUrl = file.signature_url ?? `${file.download_url}.sig`;
+        return {
+            url: file.download_url,
+            signatureUrl,
+            version: foundRelease.version,
+            checksum: await this.fetchChecksum(`${file.download_url}.sha256sum.txt`, 'sha256')
+        };
+    }
+    supportsSignatureVerification() {
+        return true;
+    }
+    async getAvailableVersions() {
+        let releases = null;
+        const fileUrl = `https://aka.ms/download-jdk/microsoft-openjdk-versions.json`;
+        // Avoid leaking the GitHub token to a non-GitHub host (aka.ms redirects to a CDN).
+        const headers = { accept: 'application/json' };
+        let response = null;
+        if (core/* isDebug */._o()) {
+            console.time('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
+        }
+        try {
+            response = await this.http.getJson(fileUrl, headers);
+            if (!response.result) {
+                return null;
+            }
+        }
+        catch (err) {
+            core/* debug */.Yz(`Http request for microsoft-openjdk-versions.json failed with status code: ${response?.statusCode}. Error: ${err}`);
+            return null;
+        }
+        if (response.result) {
+            releases = response.result;
+        }
+        if (core/* isDebug */._o() && releases) {
+            core/* startGroup */.Oh('Print information about available versions');
+            console.timeEnd('Retrieving available versions for Microsoft took'); // eslint-disable-line no-console
+            core/* debug */.Yz(`Available versions: [${releases.length}]`);
+            core/* debug */.Yz(releases.map(item => item.version).join(', '));
+            core/* endGroup */.N4();
+        }
+        return releases;
+    }
+}
+
+
+/***/ }),
+
+/***/ 8343:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   Fh: () => (/* binding */ importKey),
+/* harmony export */   Yi: () => (/* binding */ verifyPackageSignature),
+/* harmony export */   mS: () => (/* binding */ removeGpgHome),
+/* harmony export */   nY: () => (/* binding */ toGpgPath),
+/* harmony export */   o6: () => (/* binding */ isGpgAvailable)
+/* harmony export */ });
+/* unused harmony export GPG_HOME_PREFIX */
+/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9896);
+/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6928);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6982);
+/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var _actions_io__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8701);
+/* harmony import */ var _actions_exec__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5260);
+/* harmony import */ var _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9805);
+/* harmony import */ var _util_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(4527);
+
+
+
+
+
+
+
+const GPG_HOME_PREFIX = 'setup-java-gpg-';
+const VERIFY_GPG_HOME_PREFIX = 'verify-signature-gpg-home-';
+async function isGpgAvailable() {
+    return Boolean(await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .which */ .K7('gpg', false));
+}
+// Convert a Windows path (D:\a\_temp\...) to a POSIX path (/d/a/_temp/...).
+// The Git-bundled GPG on Windows (MSYS2-based) uses POSIX path conventions
+// internally. Passing Windows paths with backslashes can cause fatal GPG errors
+// (exit code 2), so all paths passed to GPG must be in POSIX format on Windows.
+function toGpgPath(p) {
+    if (process.platform !== 'win32')
+        return p;
+    return p
+        .replace(/\\/g, '/')
+        .replace(/^([A-Za-z]):\//, (_, drive) => `/${drive.toLowerCase()}/`);
+}
+function createGpgHome(prefix, tempDir = _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4()) {
+    const gpgHome = fs__WEBPACK_IMPORTED_MODULE_0__.mkdtempSync(path__WEBPACK_IMPORTED_MODULE_1__.join(tempDir, prefix));
+    if (process.platform !== 'win32') {
+        fs__WEBPACK_IMPORTED_MODULE_0__.chmodSync(gpgHome, 0o700);
+    }
+    return gpgHome;
+}
+async function importKey(privateKey) {
+    const gpgHome = createGpgHome(GPG_HOME_PREFIX);
+    const privateKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `private-key-${(0,crypto__WEBPACK_IMPORTED_MODULE_2__.randomUUID)()}.asc`);
+    try {
+        fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(privateKeyFile, privateKey, {
+            encoding: 'utf-8',
+            flag: 'wx',
+            mode: 0o600
+        });
+        try {
+            await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
+                '--homedir',
+                toGpgPath(gpgHome),
+                '--batch',
+                '--import',
+                toGpgPath(privateKeyFile)
+            ], { silent: true });
+        }
+        finally {
+            fs__WEBPACK_IMPORTED_MODULE_0__.rmSync(privateKeyFile, { force: true });
+        }
+        return gpgHome;
+    }
+    catch (error) {
+        await removeGpgHome(gpgHome);
+        throw error;
+    }
+}
+async function removeGpgHome(gpgHome) {
+    if (!gpgHome) {
+        return;
+    }
+    const resolvedGpgHome = path__WEBPACK_IMPORTED_MODULE_1__.resolve(gpgHome);
+    const resolvedTempDir = path__WEBPACK_IMPORTED_MODULE_1__.resolve(_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4());
+    if (path__WEBPACK_IMPORTED_MODULE_1__.dirname(resolvedGpgHome) !== resolvedTempDir ||
+        !path__WEBPACK_IMPORTED_MODULE_1__.basename(resolvedGpgHome).startsWith(GPG_HOME_PREFIX)) {
+        throw new Error(`Refusing to remove unexpected GPG home: ${gpgHome}`);
+    }
+    if (!fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(resolvedGpgHome)) {
+        return;
+    }
+    await stopGpgAgent(resolvedGpgHome);
+    await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(resolvedGpgHome);
+}
+async function stopGpgAgent(gpgHome) {
+    try {
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpgconf', ['--homedir', toGpgPath(gpgHome), '--kill', 'gpg-agent'], { silent: true, ignoreReturnCode: true });
+    }
+    catch {
+        // gpgconf may be unavailable, but directory removal must still be attempted.
+    }
+}
+async function verifyPackageSignature(archivePath, signatureUrl, publicKeyContent) {
+    const signaturePath = await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .downloadTool */ .bq(signatureUrl);
+    let gpgHome;
+    try {
+        // Both RUNNER_TEMP and TMPDIR can exceed macOS's 104-byte agent socket limit.
+        const tempDir = process.platform === 'darwin' ? '/tmp' : _util_js__WEBPACK_IMPORTED_MODULE_6__/* .getTempDir */ .G4();
+        gpgHome = createGpgHome(VERIFY_GPG_HOME_PREFIX, tempDir);
+    }
+    catch (error) {
+        try {
+            await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
+        }
+        catch {
+            // ignore cleanup failures
+        }
+        throw new Error(`Failed to create temporary GPG home directory for signature verification: ${error.message}`, { cause: error });
+    }
+    try {
+        const publicKeys = Array.isArray(publicKeyContent)
+            ? publicKeyContent
+            : [publicKeyContent];
+        const publicKeyFiles = publicKeys.map((publicKey, index) => {
+            const publicKeyFile = path__WEBPACK_IMPORTED_MODULE_1__.join(gpgHome, `public-key-${index}.asc`);
+            fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(publicKeyFile, publicKey, { encoding: 'utf-8' });
+            return toGpgPath(publicKeyFile);
+        });
+        const options = { silent: true };
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
+            '--homedir',
+            toGpgPath(gpgHome),
+            '--batch',
+            '--import',
+            ...publicKeyFiles
+        ], options);
+        await _actions_exec__WEBPACK_IMPORTED_MODULE_4__/* .exec */ .m('gpg', [
+            '--homedir',
+            toGpgPath(gpgHome),
+            '--batch',
+            '--verify',
+            toGpgPath(signaturePath),
+            toGpgPath(archivePath)
+        ], options);
+    }
+    finally {
+        await stopGpgAgent(gpgHome);
+        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(signaturePath);
+        await _actions_io__WEBPACK_IMPORTED_MODULE_3__/* .rmRF */ .Yz(gpgHome);
+    }
+}
+
+
+/***/ })
+
+};

dist/setup/282.index.js

@@ -34,16 +34,16 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
     async findPackageForDownload(range) {
         const versionsRaw = await this.getAvailableVersions();
         const versions = versionsRaw.map(v => {
-            const formattedVersion = `${v.semver}+${v.build}`;
+            const formattedVersion = (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .normalizeJavaVersionToSemver */ .zZ)(`${v.semver}+${v.build}`);
             return {
                 version: formattedVersion,
                 url: v.url
             };
         });
         const satisfiedVersions = versions
-            .filter(item => (0,_util_js__WEBPACK_IMPORTED_MODULE_5__/* .isVersionSatisfies */ .y)(range, item.version))
+            .filter(item => this.isVersionSatisfied(range, item.version))
             .sort((a, b) => {
-            return -semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(a.version, b.version);
+            return -this.compareVersions(a.version, b.version);
         });
         const resolvedFullVersion = satisfiedVersions.length > 0 ? satisfiedVersions[0] : null;
         if (!resolvedFullVersion) {
@@ -59,6 +59,44 @@ class JetBrainsDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_
             checksum: await this.fetchChecksum(`${resolvedFullVersion.url}.checksum`, ['sha512', 'sha256'])
         };
     }
+    normalizeVersion(version) {
+        const normalized = super.normalizeVersion(version);
+        if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+            // A patch-only request must match any JBR build of that patch.
+            normalized.version = version.replace(/-ea$/, '');
+        }
+        return normalized;
+    }
+    isVersionSatisfied(range, version) {
+        const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+        if (patchRequest) {
+            const candidate = semver__WEBPACK_IMPORTED_MODULE_3___default().parse(version);
+            return (candidate !== null &&
+                semver__WEBPACK_IMPORTED_MODULE_3___default().eq(patchRequest[1], candidate) &&
+                (candidate.build.slice(0, -2).join('.') || '0') ===
+                    patchRequest[2].slice(1));
+        }
+        return super.isVersionSatisfied(range, version);
+    }
+    compareVersions(a, b) {
+        const mainComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compare(a, b);
+        if (mainComparison !== 0) {
+            return mainComparison;
+        }
+        // JBR builds have two components (one in older releases). Any preceding
+        // metadata components are Java patch fields and take priority over builds.
+        const first = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(a).build;
+        const second = new (semver__WEBPACK_IMPORTED_MODULE_3___default().SemVer)(b).build;
+        const firstPatch = first.slice(0, -2);
+        const secondPatch = second.slice(0, -2);
+        for (let index = 0; index < Math.max(firstPatch.length, secondPatch.length); index++) {
+            const patchComparison = semver__WEBPACK_IMPORTED_MODULE_3___default().compareIdentifiers(firstPatch[index] ?? '0', secondPatch[index] ?? '0');
+            if (patchComparison !== 0) {
+                return patchComparison;
+            }
+        }
+        return semver__WEBPACK_IMPORTED_MODULE_3___default().compareBuild(first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0', second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0');
+    }
     async downloadTool(javaRelease) {
         _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .info */ .pq(`Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`);
         const javaArchivePath = await this.downloadAndVerify(javaRelease);

dist/setup/index.js

@@ -36681,7 +36681,7 @@ async function getJavaDistribution(distributionName, installerOptions, jdkFile)
             return new LibericaNikDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Microsoft: {
-            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(772)]).then(__nccwpck_require__.bind(__nccwpck_require__, 4772));
+            const { MicrosoftDistributions } = await Promise.all(/* import() */[__nccwpck_require__.e(242), __nccwpck_require__.e(220)]).then(__nccwpck_require__.bind(__nccwpck_require__, 3220));
             return new MicrosoftDistributions(normalizedInstallerOptions);
         }
         case package_types/* JavaDistribution */.zS.Semeru: {

src/distributions/jetbrains/installer.ts

@@ -16,8 +16,8 @@ import {
   extractJdkFile,
   getGitHubToken,
   getNextPageUrlFromLinkHeader,
-  isVersionSatisfies,
   MAX_PAGINATION_PAGES,
+  normalizeJavaVersionToSemver,
   validatePaginationUrl
 } from '../../util.js';
 import {OutgoingHttpHeaders} from 'http';
@@ -38,7 +38,9 @@ export class JetBrainsDistribution extends JavaBase {
     const versionsRaw = await this.getAvailableVersions();
 
     const versions = versionsRaw.map(v => {
-      const formattedVersion = `${v.semver}+${v.build}`;
+      const formattedVersion = normalizeJavaVersionToSemver(
+        `${v.semver}+${v.build}`
+      );
 
       return {
         version: formattedVersion,
@@ -47,9 +49,9 @@ export class JetBrainsDistribution extends JavaBase {
     });
 
     const satisfiedVersions = versions
-      .filter(item => isVersionSatisfies(range, item.version))
+      .filter(item => this.isVersionSatisfied(range, item.version))
       .sort((a, b) => {
-        return -semver.compareBuild(a.version, b.version);
+        return -this.compareVersions(a.version, b.version);
       });
 
     const resolvedFullVersion =
@@ -74,6 +76,61 @@ export class JetBrainsDistribution extends JavaBase {
     };
   }
 
+  protected normalizeVersion(version: string) {
+    const normalized = super.normalizeVersion(version);
+    if (/^\d+\.\d+\.\d+(?:\.\d+)+(?:-ea)?$/.test(version)) {
+      // A patch-only request must match any JBR build of that patch.
+      normalized.version = version.replace(/-ea$/, '');
+    }
+    return normalized;
+  }
+
+  protected isVersionSatisfied(range: string, version: string): boolean {
+    const patchRequest = range.match(/^(\d+\.\d+\.\d+)((?:\.\d+)+)$/);
+    if (patchRequest) {
+      const candidate = semver.parse(version);
+      return (
+        candidate !== null &&
+        semver.eq(patchRequest[1], candidate) &&
+        (candidate.build.slice(0, -2).join('.') || '0') ===
+          patchRequest[2].slice(1)
+      );
+    }
+    return super.isVersionSatisfied(range, version);
+  }
+
+  protected compareVersions(a: string, b: string): number {
+    const mainComparison = semver.compare(a, b);
+    if (mainComparison !== 0) {
+      return mainComparison;
+    }
+
+    // JBR builds have two components (one in older releases). Any preceding
+    // metadata components are Java patch fields and take priority over builds.
+    const first = new semver.SemVer(a).build;
+    const second = new semver.SemVer(b).build;
+    const firstPatch = first.slice(0, -2);
+    const secondPatch = second.slice(0, -2);
+    for (
+      let index = 0;
+      index < Math.max(firstPatch.length, secondPatch.length);
+      index++
+    ) {
+      const patchComparison = semver.compareIdentifiers(
+        firstPatch[index] ?? '0',
+        secondPatch[index] ?? '0'
+      );
+      if (patchComparison !== 0) {
+        return patchComparison;
+      }
+    }
+
+    return semver.compareBuild(
+      first.length ? `0.0.0+${first.slice(-2).join('.')}` : '0.0.0',
+      second.length ? `0.0.0+${second.slice(-2).join('.')}` : '0.0.0'
+    );
+  }
+
   protected async downloadTool(
     javaRelease: JavaDownloadRelease
   ): Promise<JavaInstallerResults> {

src/distributions/microsoft/installer.ts

@@ -12,7 +12,6 @@ import {
 } from '../../util.js';
 import * as gpg from '../../gpg.js';
 import {MICROSOFT_PUBLIC_KEY} from './microsoft-key.js';
-import bundledVersions from './microsoft-openjdk-versions.json' with {type: 'json'};
 import {SIGNATURE_VERIFICATION_FAILURE_HELP} from '../../constants.js';
 import * as core from '@actions/core';
 import * as tc from '@actions/tool-cache';
@@ -109,9 +108,7 @@ export class MicrosoftDistributions extends JavaBase {
       throw new Error('Could not load manifest for Microsoft Build of OpenJDK');
     }
 
-    const foundRelease =
-      (await tc.findFromManifest(range, true, manifest, arch)) ??
-      (await tc.findFromManifest(range, true, bundledVersions, arch));
+    const foundRelease = await tc.findFromManifest(range, true, manifest, arch);
 
     if (!foundRelease) {
       const availableVersionStrings = manifest.map(item => item.version);

src/distributions/microsoft/microsoft-openjdk-versions.json

@@ -1,47 +1,4 @@
 [
-  {
-    "version": "25.0.5+0.2",
-    "stable": true,
-    "release_url": "https://aka.ms/download-jdk",
-    "files": [
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz",
-        "arch": "x64",
-        "platform": "darwin",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-x64.tar.gz"
-      },
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz",
-        "arch": "x64",
-        "platform": "linux",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-x64.tar.gz"
-      },
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-windows-x64.zip",
-        "arch": "x64",
-        "platform": "win32",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-x64.zip"
-      },
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz",
-        "arch": "aarch64",
-        "platform": "darwin",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-macos-aarch64.tar.gz"
-      },
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz",
-        "arch": "aarch64",
-        "platform": "linux",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-linux-aarch64.tar.gz"
-      },
-      {
-        "filename": "microsoft-jdk-25.0.5.0.2-windows-aarch64.zip",
-        "arch": "aarch64",
-        "platform": "win32",
-        "download_url": "https://aka.ms/download-jdk/microsoft-jdk-25.0.5.0.2-windows-aarch64.zip"
-      }
-    ]
-  },
   {
     "version": "25.0.3",
     "stable": true,