Ignore zero-length key ID

See gh-3
spring-io · Nov 19, 2024 · 115a2a1 · 115a2a1
1 parent 3701fa3
commit 115a2a1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/src/main/java/io/spring/github/actions/artifactorydeploy/openpgp/ArmoredAsciiSigner.java b/src/main/java/io/spring/github/actions/artifactorydeploy/openpgp/ArmoredAsciiSigner.java
@@ -99,7 +99,7 @@ private PGPSecretKey getSigningKey(PGPSecretKeyRingCollection keyrings, String k
 		for (PGPSecretKeyRing keyring : keyrings) {
 			Iterable<PGPSecretKey> secretKeys = keyring::getSecretKeys;
 			for (PGPSecretKey candidate : secretKeys) {
-				if (keyId != null) {
+				if (keyId != null && keyId.length() > 0) {
 					String candidateKeyId = String.format("%08X", 0xFFFFFFFFL & candidate.getKeyID());
 					if (keyId.equals(candidateKeyId)) {
 						return candidate;

diff --git a/...test/java/io/spring/github/actions/artifactorydeploy/openpgp/ArmoredAsciiSignerTests.java b/...test/java/io/spring/github/actions/artifactorydeploy/openpgp/ArmoredAsciiSignerTests.java
@@ -97,6 +97,12 @@ void getWhenSigningKeyIsKeyAndIdMatchesReturnsSigner() throws Exception {
 		assertThat(signer.sign(this.sourceContent)).isEqualTo(this.expectedSignature);
 	}
 
+	@Test
+	void getWhenSigningKeyIsKeyAndIdIsEmptyReturnsSigner() throws Exception {
+		ArmoredAsciiSigner signer = ArmoredAsciiSigner.get(FIXED, this.signingKeyContent, this.passphrase, "");
+		assertThat(signer.sign(this.sourceContent)).isEqualTo(this.expectedSignature);
+	}
+
 	@Test
 	void getWhenSigningKeyIsSubkeyAndIdMatchesReturnsSigner() throws Exception {
 		ArmoredAsciiSigner signer = ArmoredAsciiSigner.get(FIXED, this.signingSubkeyContent, this.passphrase,