Add support for Amazon Corretto binaries

[giltene]

With work being done towards adding additional binary distributions of OpenJDK as options (likely under the "distro" option, see e.g. #67), it would be useful to include Amazon Corretto among the distro options.

[alvdavi]

Corretto member here.

Looking at #67, yes, that seems to be a valid framework for us

[WtfJoke]

Would be also interested.

The releases can be found in:
https://github.com/corretto/corretto-8/releases
or
https://github.com/corretto/corretto-11/releases
or
https://github.com/corretto/corretto-jdk/releases (jdk15+)

I could imagine to contribute towards it, but we dont have any GITHUB TOKEN available in order to make authenticated github api calls (to query the releases). So this might be a dealbreaker to support coretto in this action.

[WtfJoke]

@dmitry-shibanov @konradpabjan any ideas how we can solve that restriction with the github api calls? Would introduce an optional github token a viable solution?

[maxim-lobanov]

Does Corretto provides any API except GitHub Repos API?
There is a way to use GitHub System token but I worry that anyway, it will require a huge number of API calls since you will have to paginate a lot of pages with releases through GitHub API that will impact action performance.

[eddumelendez]

why don't use foojay api which provide urls for all providers

See #142

[maxim-lobanov]

#142 (comment)

I do have have some security concerns too that might make this a blocker (following up on this). Using the Disco API introduces a single point of failure that if compromised could for example lead to malicious binaries being downloaded. Given that the Disco API is outside of the control of GitHub and the attack surface this could be very concerning for a lot of our customers (Enterprise in particular). The API is also fairly new (~3 months).

[giltene]

If the distro selected provides signatures (which Corretto, in this example does) and the foojay disco API provided those signatures, we can easily verify the authenticity of the binary pulled, and rule out any possibility of an intermediate party being g compromised and maliciously pointing to wrong binaries. All it will take is for setup-java to have a [statically maintained] set of known/trusted distro signers.

[WtfJoke]

Does Corretto provides any API except GitHub Repos API?

According to Correto Documentation 8/11/16 it seems like the only way to access older version is github (across these 3 repos).

However they provide the latest version as a permalink in following format:
https://corretto.aws/latest/amazon-corretto-[corretto_version]-[cpu_arch]-[os]-[package_type].[file_extension]

For example:
https://corretto.aws/downloads/latest/amazon-corretto-11-x64-linux-jdk.tar.gz
redirects to
https://corretto.aws/downloads/resources/11.0.11.9.1/amazon-corretto-11.0.11.9.1-linux-x64.tar.gz

So I guess you could construct urls to download specific versions (or latest). But as they seem to have their own versioning format you wont be able to use unspecific versions like 11.0.11 (without crawling release names before).

EDIT:
About the versioning format:

The source code for each release is recorded by a branch or a tag with a name of this form. XXX stands for the OpenJDK 8 update number, YY for the OpenJDK 8 build number, and Z for the Corretto-specific revision number. The latter starts at 1 and is incremented in subsequent releases as long as the update and build number remain constant.

@alvdavi do you know if you provide any sort of api for coretto?

EDIT2: I guess fetching all tags of those repos could be a way without doing too many requests and get to know the versions.

[joschi]

@alvdavi do you know if you provide any sort of api for coretto?

@benty-amzn @hyandell @cliveverghese Any input on this? 😃