blank_blank 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +9 -0
- data/.rspec +2 -0
- data/.travis.yml +4 -0
- data/Gemfile +4 -0
- data/README.md +24 -0
- data/Rakefile +1 -0
- data/bin/console +14 -0
- data/bin/setup +8 -0
- data/blank_blank.gemspec +24 -0
- data/exe/blank_blank +55 -0
- data/lib/blank_blank.rb +5 -0
- data/lib/blank_blank/version.rb +3 -0
- metadata +98 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 839a613569607f25db66c4a6c74ca49c812bfccf
|
4
|
+
data.tar.gz: b173b34ca65efbcb41eb43cfa7def6966770970f
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: 6507104505e88450396c162b418895d4459a7d01e5cfc32722856375dd6ddc773a93dfcd021c4c0f291eb7c7c41a4027fd48ce6e3d12abe7ac0bbfb26fdf3109
|
7
|
+
data.tar.gz: d16b93f774fd0ec790a1cee12553700813273d39a76886aa911cb0c8004a491ac2aec9d6a1e0c07a9a0550982bb8aac0bd56dc3b611a5c369c21a1c4ba697a94
|
data/.gitignore
ADDED
data/.rspec
ADDED
data/.travis.yml
ADDED
data/Gemfile
ADDED
data/README.md
ADDED
@@ -0,0 +1,24 @@
|
|
1
|
+
# BlankBlank
|
2
|
+
|
3
|
+
Verify existing gems for malicious gem replacement (see http://blog.rubygems.org/2016/04/06/gem-replacement-vulnerability-and-mitigation.html).
|
4
|
+
|
5
|
+
## Installation and Usage
|
6
|
+
|
7
|
+
```console
|
8
|
+
$ gem install 'blank_blank'
|
9
|
+
```
|
10
|
+
|
11
|
+
And then execute:
|
12
|
+
|
13
|
+
$ blank_blank [some git repository]
|
14
|
+
|
15
|
+
## Development
|
16
|
+
|
17
|
+
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
18
|
+
|
19
|
+
To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
|
20
|
+
|
21
|
+
## Contributing
|
22
|
+
|
23
|
+
Bug reports and pull requests are welcome on GitHub at https://github.com/cbeer/blank_blank.
|
24
|
+
|
data/Rakefile
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
require "bundler/gem_tasks"
|
data/bin/console
ADDED
@@ -0,0 +1,14 @@
|
|
1
|
+
#!/usr/bin/env ruby
|
2
|
+
|
3
|
+
require "bundler/setup"
|
4
|
+
require "blank_blank"
|
5
|
+
|
6
|
+
# You can add fixtures and/or initialization code here to make experimenting
|
7
|
+
# with your gem easier. You can also use a different console, if you like.
|
8
|
+
|
9
|
+
# (If you use this, don't forget to add pry to your Gemfile!)
|
10
|
+
# require "pry"
|
11
|
+
# Pry.start
|
12
|
+
|
13
|
+
require "irb"
|
14
|
+
IRB.start
|
data/bin/setup
ADDED
data/blank_blank.gemspec
ADDED
@@ -0,0 +1,24 @@
|
|
1
|
+
# coding: utf-8
|
2
|
+
lib = File.expand_path('../lib', __FILE__)
|
3
|
+
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
+
require 'blank_blank/version'
|
5
|
+
|
6
|
+
Gem::Specification.new do |spec|
|
7
|
+
spec.name = "blank_blank"
|
8
|
+
spec.version = BlankBlank::VERSION
|
9
|
+
spec.authors = ["Chris Beer"]
|
10
|
+
spec.email = ["chris@cbeer.info"]
|
11
|
+
|
12
|
+
spec.summary = %q{Verify existing gems for malicious gem replacement}
|
13
|
+
spec.description = %q{}
|
14
|
+
|
15
|
+
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
16
|
+
spec.bindir = "exe"
|
17
|
+
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
18
|
+
spec.require_paths = ["lib"]
|
19
|
+
|
20
|
+
spec.add_dependency "git"
|
21
|
+
|
22
|
+
spec.add_development_dependency "bundler", "~> 1.11"
|
23
|
+
spec.add_development_dependency "rake", "~> 10.0"
|
24
|
+
end
|
data/exe/blank_blank
ADDED
@@ -0,0 +1,55 @@
|
|
1
|
+
#!/usr/bin/env ruby
|
2
|
+
|
3
|
+
require "tmpdir"
|
4
|
+
require "optparse"
|
5
|
+
require "blank_blank"
|
6
|
+
require 'git'
|
7
|
+
|
8
|
+
options = {}
|
9
|
+
OptionParser.new do |opts|
|
10
|
+
opts.banner = "Usage: blank_blank [options] path_to_repository"
|
11
|
+
opts.on("-h", "--help", "Prints this help") do
|
12
|
+
puts opts
|
13
|
+
exit
|
14
|
+
end
|
15
|
+
end.parse!
|
16
|
+
|
17
|
+
ARGV.each do |repo|
|
18
|
+
$stderr.puts "#{repo}"
|
19
|
+
|
20
|
+
Dir.mktmpdir do |dir|
|
21
|
+
Dir.chdir(dir) do
|
22
|
+
puts `git clone #{repo} repo 2>&1`
|
23
|
+
|
24
|
+
Dir.chdir('repo') do
|
25
|
+
g = Git.open(Dir.pwd)
|
26
|
+
g.tags.sort_by(&:name).each do |tag|
|
27
|
+
g.checkout(tag)
|
28
|
+
|
29
|
+
Dir.glob('*.gemspec') do |gemspec|
|
30
|
+
gem_build_output = `gem build #{gemspec} -f 2>&1`
|
31
|
+
|
32
|
+
gem_name = gem_build_output.scan(/Name: (.*)/).flatten.first
|
33
|
+
gem_version = gem_build_output.scan(/Version: (.*)/).flatten.first
|
34
|
+
gem_file = gem_build_output.scan(/File: (.*)/).flatten.first
|
35
|
+
|
36
|
+
begin
|
37
|
+
fail "Unexpected gem output: #{gem_build_output}" if gem_name.nil? || gem_version.nil?
|
38
|
+
|
39
|
+
`gem unpack #{gem_name} -v #{gem_version} --target #{dir}/#{gem_name}-#{gem_version}-rubygems`
|
40
|
+
`gem unpack #{gem_file} --target #{dir}/#{gem_name}-#{gem_version}-newly-built`
|
41
|
+
|
42
|
+
diff_output = `diff -r #{dir}/#{gem_name}-#{gem_version}-rubygems #{dir}/#{gem_name}-#{gem_version}-newly-built`
|
43
|
+
fail diff_output unless $CHILD_STATUS == 0
|
44
|
+
|
45
|
+
puts "#{gem_name} #{gem_version}: [ OK ]"
|
46
|
+
rescue => e
|
47
|
+
puts "#{gem_name} #{gem_version}: [ FAIL ]"
|
48
|
+
puts e.message
|
49
|
+
end
|
50
|
+
end
|
51
|
+
end
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
data/lib/blank_blank.rb
ADDED
metadata
ADDED
@@ -0,0 +1,98 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: blank_blank
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.0.1
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Chris Beer
|
8
|
+
autorequire:
|
9
|
+
bindir: exe
|
10
|
+
cert_chain: []
|
11
|
+
date: 2016-04-07 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: git
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - ">="
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '0'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - ">="
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '0'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: bundler
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '1.11'
|
34
|
+
type: :development
|
35
|
+
prerelease: false
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
37
|
+
requirements:
|
38
|
+
- - "~>"
|
39
|
+
- !ruby/object:Gem::Version
|
40
|
+
version: '1.11'
|
41
|
+
- !ruby/object:Gem::Dependency
|
42
|
+
name: rake
|
43
|
+
requirement: !ruby/object:Gem::Requirement
|
44
|
+
requirements:
|
45
|
+
- - "~>"
|
46
|
+
- !ruby/object:Gem::Version
|
47
|
+
version: '10.0'
|
48
|
+
type: :development
|
49
|
+
prerelease: false
|
50
|
+
version_requirements: !ruby/object:Gem::Requirement
|
51
|
+
requirements:
|
52
|
+
- - "~>"
|
53
|
+
- !ruby/object:Gem::Version
|
54
|
+
version: '10.0'
|
55
|
+
description: ''
|
56
|
+
email:
|
57
|
+
- chris@cbeer.info
|
58
|
+
executables:
|
59
|
+
- blank_blank
|
60
|
+
extensions: []
|
61
|
+
extra_rdoc_files: []
|
62
|
+
files:
|
63
|
+
- ".gitignore"
|
64
|
+
- ".rspec"
|
65
|
+
- ".travis.yml"
|
66
|
+
- Gemfile
|
67
|
+
- README.md
|
68
|
+
- Rakefile
|
69
|
+
- bin/console
|
70
|
+
- bin/setup
|
71
|
+
- blank_blank.gemspec
|
72
|
+
- exe/blank_blank
|
73
|
+
- lib/blank_blank.rb
|
74
|
+
- lib/blank_blank/version.rb
|
75
|
+
homepage:
|
76
|
+
licenses: []
|
77
|
+
metadata: {}
|
78
|
+
post_install_message:
|
79
|
+
rdoc_options: []
|
80
|
+
require_paths:
|
81
|
+
- lib
|
82
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
83
|
+
requirements:
|
84
|
+
- - ">="
|
85
|
+
- !ruby/object:Gem::Version
|
86
|
+
version: '0'
|
87
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
88
|
+
requirements:
|
89
|
+
- - ">="
|
90
|
+
- !ruby/object:Gem::Version
|
91
|
+
version: '0'
|
92
|
+
requirements: []
|
93
|
+
rubyforge_project:
|
94
|
+
rubygems_version: 2.4.5.1
|
95
|
+
signing_key:
|
96
|
+
specification_version: 4
|
97
|
+
summary: Verify existing gems for malicious gem replacement
|
98
|
+
test_files: []
|