dependabot-hex 0.400.0 → 0.401.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a877c5d2f36da38478b60463d5c7e59412e7fe9cd21e359adef7722d27e0c89
-  data.tar.gz: 3cf02dbb102fcc70fe9d6f16cd7aae294712c88fc4ed7135cd4126e0579ce9d7
+  metadata.gz: 7f6798814b3d2cfec821cee72650b3daee5a11ce0fee0338d7342b5f5654e1f0
+  data.tar.gz: bc88669f4e924f01390b8b1afcdd61e041676fa135b0904fe8c73837a3014d9f
 SHA512:
-  metadata.gz: fbe307319ec11c9400a5763756eeb5e3d23bf481a9648e5b1eb412830c56b1231a2f03223cf2ac936dff7b9a5a9e0b8abd66eec036c53745664ae507f3e0b732
-  data.tar.gz: 30d3982a3d9cfc31cfd612154d208f6d5cabf008aff033cf87f5cce33a51f9b82078d4b8ee5d90f829d5f824d84e797461c99af5bb25a6b3bc4a1d594273b0fb
+  metadata.gz: d5e4b1bf83ba0d953e0fd787ee41f3ecb284dee877703abddf1e5743eede7e9cf50acbdc876127f72e14f9ac9010fc511d74278994d78fa9d84ba112f2770043
+  data.tar.gz: ee94615705c6b28f562404742af836caef582488566be55e6f7c8f44148f91e58cbaf6dbb3c62bdd4be29bfebc4a16f34e627a0e72a737715824cd4be0cf540b

data/helpers/lib/run.exs

@@ -97,8 +97,8 @@ defmodule DependencyHelper do
     set_credentials(tail)
   end
 
-  defp set_credentials(["hex_repository", repo, url, auth_key, fingerprint | tail]) do
-    case fetch_public_key(repo, url, auth_key, fingerprint) do
+  defp set_credentials(["hex_repository", repo, url, auth_key, fingerprint, public_key | tail]) do
+    case resolve_public_key(repo, url, auth_key, fingerprint, public_key) do
       {:ok, public_key} ->
         update_repos(repo, %{auth_key: auth_key, public_key: public_key, url: url})
 
@@ -120,21 +120,21 @@ defmodule DependencyHelper do
     |> Hex.Config.update_repos()
   end
 
+  # Some registries (e.g. JFrog Artifactory) don't serve /public_key, so a
+  # configured key is used instead of downloading it.
+  defp resolve_public_key(repo, url, auth_key, fingerprint, public_key)
+       when public_key in [nil, ""] do
+    fetch_public_key(repo, url, auth_key, fingerprint)
+  end
+
+  defp resolve_public_key(repo, _url, _auth_key, fingerprint, public_key) do
+    verify_public_key(repo, public_key, fingerprint)
+  end
+
   defp fetch_public_key(repo, repo_url, auth_key, fingerprint) do
     case Hex.Repo.get_public_key(%{trusted: true, url: repo_url, auth_key: auth_key}) do
       {:ok, {200, _headers, key}} ->
-        try do
-          if public_key_matches?(key, fingerprint) do
-            {:ok, key}
-          else
-            {:error, "Public key fingerprint mismatch for repo \"#{repo}\""}
-          end
-        rescue
-          e in FunctionClauseError ->
-            {:error,
-             "Failed to decode public key for repo \"#{repo}\": " <>
-               "#{Exception.message(e)} (#{inspect(e.__struct__)})"}
-        end
+        verify_public_key(repo, key, fingerprint)
 
       {:ok, {code, _headers, _body}} ->
         {:error, "Downloading public key for repo \"#{repo}\" failed with code: #{inspect(code)}"}
@@ -144,6 +144,19 @@ defmodule DependencyHelper do
     end
   end
 
+  defp verify_public_key(repo, key, fingerprint) do
+    if public_key_matches?(key, fingerprint) do
+      {:ok, key}
+    else
+      {:error, "Public key fingerprint mismatch for repo \"#{repo}\""}
+    end
+  rescue
+    e in FunctionClauseError ->
+      {:error,
+       "Failed to decode public key for repo \"#{repo}\": " <>
+         "#{Exception.message(e)} (#{inspect(e.__struct__)})"}
+  end
+
   defp public_key_matches?(_public_key, _fingerprint = ""), do: true
 
   defp public_key_matches?(public_key, fingerprint) do

data/lib/dependabot/hex/credential_helpers.rb

@@ -26,12 +26,20 @@ module Dependabot
       def self.repo_credentials(credentials)
         # Credentials are serialized as an array that may not have optional fields. Using a
         # default ensures that the array is always the same length, even if values are empty.
-        defaults = Dependabot::Credential.new({ "url" => "", "auth_key" => "", "public_key_fingerprint" => "" })
-        keys = %w(type repo url auth_key public_key_fingerprint)
+        defaults = Dependabot::Credential.new(
+          { "url" => "", "auth_key" => "", "public_key_fingerprint" => "", "public_key" => "" }
+        )
+        keys = %w(type repo url auth_key public_key_fingerprint public_key)
 
         credentials
           .select { |cred| cred["type"] == "hex_repository" }
-          .flat_map { |cred| defaults.merge(cred).slice(*keys).values }
+          .flat_map { |cred| defaults.merge(underscore_keys(cred)).slice(*keys).values }
+      end
+
+      # Job credentials use the dependabot.yml spelling of keys (e.g. `public-key-fingerprint`).
+      sig { params(credential: Dependabot::Credential).returns(Dependabot::Credential) }
+      def self.underscore_keys(credential)
+        Dependabot::Credential.new(credential.to_h.transform_keys { |key| key.tr("-", "_") })
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.400.0
+  version: 0.401.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.401.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.400.0
+        version: 0.401.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -274,7 +274,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.400.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.401.0
 rdoc_options: []
 require_paths:
 - lib