Summary

Eliminates the TOCTOU / information-disclosure hazard in importGPGKey(): the private key is now piped to gpg --batch --import via stdin instead of being written to a fixed, predictable path in os.tmpdir().

Motivation

The previous implementation:

const PRIVATE_KEY_FILE = path.join(tmpdir(), 'private-key.asc');
await fsPromises.writeFile(PRIVATE_KEY_FILE, privateKey);
await spawnProcess('gpg', ['--batch', '--import', PRIVATE_KEY_FILE]);
await fsPromises.unlink(PRIVATE_KEY_FILE);

On Linux, /tmp is mode 1777 (world-writable, with the sticky bit). The path is deterministic, so:

1. Read race: any co-resident process on the runner can read the key between writeFile and unlink.
2. Write redirect via symlink: an attacker who wins a race to ln -s /some/target /tmp/private-key.asc before the writeFile call causes Craft to overwrite /some/target with the private key.
3. Crash persistence: an unexpected exit between writeFile and unlink leaves the key on disk indefinitely.

Fix

Pass the key via stdin. gpg --batch --import reads a key from stdin when no file argument is given. spawnProcess already supports a stdin option — no new infrastructure needed.

await spawnProcess('gpg', ['--batch', '--import'], {}, { stdin: privateKey });

Benefits vs. mkdtemp(0o700) alternative:

• Zero filesystem contact — no dir creation, no file write, no cleanup path to get wrong.
• Key no longer appears in argv either, so it doesn't show up in ps / /proc/<pid>/cmdline.

Tests

src/utils/__tests__/gpg.test.ts is rewritten to assert the new invariants:

• spawnProcess is called with ['--batch', '--import'] and { stdin: KEY }.
• No fs.writeFile / fs.unlink happens.
• The key is not embedded in any argv entry (regression guard against future reintroduction).

pnpm test src/utils/__tests__/gpg.test.ts → 3 tests pass. Full lint / build clean.

Callers

Only src/targets/maven.ts:271 calls importGPGKey. The signature is unchanged (importGPGKey(privateKey: string): Promise<void>) — no caller updates needed.