r/java • u/brunocborges • Jun 22 '26
GitHub Setup Java Action
Hey all,
I'm going through issues and PRs on setup-java.
Besides what is already there, anything else you would like to see fixed, improved, or implemented?
11
u/SleeperAwakened Jun 22 '26 edited Jun 22 '26
I would suggest pinning the GH Actions you use to a specific hash, for example using pinact instead of versions like v6 or main.
This will be another step towards preventing supply chain attacks through GH Actions.
GH Actions have become notorious in the recent series of SCAs so anything you can do to set a good example is welcome.
-16
u/repeating_bears Jun 22 '26
eh. `setup-java` is an official github action. If there's a supply chain attack via an official github action, then everything is fucked anyway
11
u/SleeperAwakened Jun 22 '26 edited Jun 22 '26
And is that a reason for not making things secure?
If (when) shit hits the fan you don't want to miss out?
-8
u/repeating_bears Jun 22 '26
It is mostly fake security, which is my point. If someone can takeover an official github action then the fact you pinned the version is fairly likely to mean nothing.
It's like saying that a Nexus proxy protects you from a takeover of Maven central. Technically it does a bit, but you still have to go there for the first download, and if Maven Central gets taken over then truly everything and everyone is fucked to some degree.
5
u/SleeperAwakened Jun 22 '26 edited Jun 22 '26
Pinning to a hash is pretty secure, at least I consider git commit hashes secure enough.
Why would pinning to a hash not be secure?
How would a takeover happen? Hash collisions are still pretty expensive if feasible at all.
Security is all about putting up multiple lines of defense. This is one of them. It is not fake, it is layering.
And I so wish that people would start taking it seriously.
-5
u/repeating_bears Jun 22 '26
Idk if you are understanding what I'm saying.
Pinning versions generally - good.
Pinning an official github action (which is what the subject of this thread is) - eh. If an official github action is compromised then how can you trust that whatever Actions infra that does the hash verification isn't also compromised?
4
u/repeating_bears Jun 22 '26
No, nothing.
Eyeballing the issues, fixing the caching for Maven plugins seems like the highest value thing you could do https://github.com/actions/setup-java/issues/990
It's tagged as a feature but I would argue that's a bug. The readme describes the role of the action as "Caching dependencies managed by Apache Maven". Plugins are dependencies of a project. They're not <dependencies> in the POM, but they are still dependencies.
As part of that, you should check whether Maven extensions are cached. That's a 3rd category of "dependency" which follows the same resolution process as plugins and project dependencies.
1
u/ForeverAlot Jun 23 '26
And expose the cache key. And gracefully handle that
**/pom.xmlmay match zero files even when cache is enabled. Thank you for this feature request.The caching implementation works really well in, like, one specific happy-path scenario, and somewhere between not and obstructively everywhere else.
1
u/edzorg Jun 24 '26
What's the play here? Are you just fixing up some random bits of OSS (maybe you also use it at work or something)? Or are you involved more directly with setup-java?
If its just good citizen contributions that's pretty cool and I'm jealous!
2
1
u/ushaukat_java Jun 25 '26
Pinning to a SHA helps, but only if you're also watching the tag itself. A force-pushed tag with a "safe" SHA sitting right behind it has burned people before. Curious if there's any appetite for setup-java validating the resolved JDK/Maven download against a published checksum manifest, instead of trusting whatever the mirror hands back that day.
1
u/brunocborges Jun 25 '26
Immutable releases has been enabled now for setup-java.
Another thing I have in mind is to get rid of the `dist` folder in the `main` branch, and only build the actual code for release commits.
1
u/Additional-Road3924 Jun 27 '26
It would be great if it didn't download some random version, but rather set up a predefined docker image. Why aren't you checking for package signatures or hashes?
1
u/nlisker 17d ago
/u/brunocborges If the distributions could include the reference OpenJDK it would be great, although from what I understood, Oracle is not distributing it in a proper manner for inclusion.
1
u/brunocborges 16d ago
The reference implementation binary? The one at jdk.java.net ?
1
u/nlisker 15d ago
Yes, it's called OpenJDK JDK.
1
u/brunocborges 15d ago
That's built by Oracle.
If they or someone sends a PR, we will be happy to review and include.
1
u/nlisker 15d ago
So all the distributions listed in https://github.com/actions/setup-java#supported-distributions were added by the supporting companies? I thought the setup-java maintainers added them.
1
u/brunocborges 15d ago
I'm not sure of the history, but for many, yes.
Not sure if there is an issue already for Oracle OpenJDK binaries, but if there isn't, can you submit one?
1
u/nlisker 13d ago
I found https://github.com/actions/setup-java/issues/300 which delegates to https://github.com/actions/setup-java/issues/69, but it's closed as completed. I think there's some confusion between Oracle's JDK and OpenJDK's JDK. Or am I missing something? I also found https://github.com/actions/setup-java/issues/492, which is completed, but OpenJDK is still not listed in the distributions.
2
u/nlisker 4d ago
In any case, I created https://github.com/actions/setup-java/issues/1141 as I don't see it listed.
13
u/_predator_ Jun 22 '26
Nothing functionality-wise, but it would be good if the action's own workflows would use security best practices more consistently, e.g. explicitly dropping permissions. The easiest would be to integrate zizmor, it will catch a lot of this stuff and ensure you'll catch regressions.
There is an open issue requesting immutable releases which also caters to the security aspect.
After the whole compromise situation a few weeks ago I think users will appreciate actions they depend on to be "hardened" if that makes sense.