Skip to content

Add gpg signature verification#4

Draft
Copilot wants to merge 6 commits into
mainfrom
copilot/include-signature-verification
Draft

Add gpg signature verification#4
Copilot wants to merge 6 commits into
mainfrom
copilot/include-signature-verification

Conversation

Copilot AI commented Jun 17, 2026

Copy link
Copy Markdown

gpg.ts contained ADOPTIUM_SIGNATURE_KEY_FINGERPRINT as an exported constant and used it as the default for keyFingerprint in verifyPackageSignature(), making the module look Adoptium-specific despite being a shared utility.

Changes:

  • src/gpg.ts: Removed ADOPTIUM_SIGNATURE_KEY_FINGERPRINT constant; made keyFingerprint a required parameter in verifyPackageSignature() (no distro-specific default); removed Adoptium-specific comment
  • src/distributions/temurin/installer.ts: Added export const ADOPTIUM_SIGNATURE_KEY_FINGERPRINT here, where it belongs; updated call site to use the local constant
  • Tests: Updated gpg.test.ts to pass an explicit fingerprint; updated temurin-installer.test.ts to import the constant from the temurin installer instead of gpg

Check list:

  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.

Copilot AI and others added 2 commits June 17, 2026 14:52
@johnoliver johnoliver changed the title refactor: make gpg.ts generic across all distributions Add gpg signature verification Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants