gem-checkout 0.0.5 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ee28067ee5184c515081a3cfad38b70eda8c9bb7
-  data.tar.gz: e3a3abe9fa00964bfa733ead7414a266baa961ac
+  metadata.gz: 3c3ac04887cf0d974da2a2c50c35f1a74410515b
+  data.tar.gz: 0cb624321ec30843de7b3e2e7093e10d836c83b5
 SHA512:
-  metadata.gz: 8a55d5ba004b3989f3020f892bf5112a1016a9d867a41ce16bc969c8e256511c674559cafa7e95d9ff3120ecbf34763c10628d5d542fafc93091a427f569ca38
-  data.tar.gz: 2ab5e1fb93f34b50f3e44899bc292765737960c99e3cc2c6060b5241fa30007d9a435376be850a2e8d5f95eb9de2ded837fc05ef02f7c51b604cb71788fb0c44
+  metadata.gz: 083a70f4aa6bb4826494d20a062da913c32f530e5260a294456e22ad8000a664b5579a3582f77765b4759d6a0bded7fcab8cbd1c2aaa8696ec9bb97467aabeb2
+  data.tar.gz: 30a7347b10ed81c0e6464dc00e96ebfa2b38521a53d1b90a8dc213a9e1a5abe2b63878ff0b1aca7f308016ad868ea005b032c85531c74531b846eb2f67b9be47

data/README.md

@@ -17,34 +17,35 @@ will checkout the GitHub source code (into the current dir) for the `nenv` gem a
 
 ## Installation
 
-Add this line to your application's Gemfile:
-
 ```sh
 gem install gem-checkout
 ```
 
 ## Usage
 
-Proof of concept right now, so open issues and/or PRs for improvements.
+Proof of concept right now, so check or open issues and/or PRs for improvements.
 
 Options:
 
 ```
--d LEVEL
+-d LEVEL # sets debug level, where 0=debug, 1=warn, and so on...
 ```
-sets the debug level, where 0=debug, 1=warn, and so on...
 
 ```
--v, --version VERSION
+-v, --version VERSION # gem version to you want the sources for.
 ```
 
-The version of the gem to you want to hack on - the repo and revision will be discovered.
-
 (If you don't provide this option, the latest version will be used).
 
+```
+-s, --verify # compare gem built from sources with released version
+```
+
+(If it's identical, you can assume the released gem was build from these exact chechecked out sources).
+
 ## FAQ
 
-None yet, so open an issue...
+None yet, so open issues and ask for improvements/features ...
 
 
 ## Development

data/lib/gem-checkout/source.rb

@@ -97,10 +97,14 @@ module Gem
         end
       end
 
+      attr_reader :version
+
       def initialize(name, version=nil)
-        Gem::Checkout.logger.debug "Gathering infor about #{name} (#{version || 'latest'})"
+        Gem::Checkout.logger.debug "Gathering info about #{name} (#{version || 'latest'})"
         object = Spec.info(name, version)
 
+        @version = object.version
+
         @name = name
 
         repository = RepositoryInfo.detect(object)

data/lib/gem-checkout/spec.rb

@@ -63,7 +63,6 @@ module Gem
         def initialize(name, version, remote)
           @data = find_by_name(name, version)
           @name = name
-          @version = version
           @remote = remote
         end
 
@@ -90,7 +89,7 @@ module Gem
         end
 
         def version
-          read(:version)
+          read(:version).to_s
         end
 
         def alternative
@@ -212,7 +211,7 @@ module Gem
             info['number'] == version
           end
 
-          fail Error::NoSuchGem, "Could not find #{name} on rubygems.org" unless version
+          fail Error::NoSuchGem, "Could not find #{name} at #{version} on rubygems.org (yanked gem?)" unless version
           Gem::Checkout.logger.debug "Found info matching gem version #{@version}"
           OpenStruct.new(version)
         end

data/lib/gem-checkout/verifier.rb

@@ -0,0 +1,146 @@
+require 'digest/sha1'
+require 'pathname'
+
+require 'gem-checkout/logger'
+
+module Gem
+  module Checkout
+    class Verifier
+      class Gem
+        class << self
+          def fetch(name, version)
+            version_opts = ['-v', version]
+            fail "failed to fetch gem #{name}" unless system("gem", "fetch", "-V", *version_opts, name)
+          end
+
+          def build(gemspec)
+            fail "failed to build using #{gemspec}"  unless system("gem", "build", gemspec)
+          end
+        end
+      end
+
+      class Tar
+        class << self
+          def extract_file(archive, file)
+            fail "failed to untar #{file} from #{archive}" unless system("tar", "xf", archive, file)
+          end
+
+          def extract_compressed(archive)
+            fail "failed to untar#{archive}" unless system("tar", "zxf", archive)
+          end
+        end
+      end
+
+      class Error < RuntimeError
+        class DataMismatch < Error
+        end
+      end
+
+      def initialize(name, version)
+        @name = name
+        @version = version
+      end
+
+      def verify!
+        file = build_local_gem
+        local = get_payload_sum(file)
+        remote = get_remote_payload_sum
+
+        unless local == remote
+          local_files = local.map(&:last)
+          remote_files = remote.map(&:last)
+          if local_files != remote_files
+            logger.debug "Files present only in published gem: #{remote_files - local_files }"
+            logger.debug "Files present only in local gem: #{local_files - remote_files }"
+          else
+            diff = remote - local
+            diff.each do |checksum, f|
+              logger.debug "Checksum mismatch: #{checksum} #{f}"
+            end
+          end
+          fail Error::DataMismatch, "checksum mismatch (run in debug mode to see details)"
+        end
+
+      end
+
+      private
+
+      def name
+        @name
+      end
+
+      def version
+        @version
+      end
+
+      def digest(f)
+        Digest::SHA256.file(f).hexdigest
+      end
+
+      def logger
+        Checkout.logger
+      end
+
+      def build_local_gem
+        logger.debug "Building #{name}-#{version}.gem from sources..."
+        gemspec = detect_gemspec
+        Gem.build(gemspec)
+        File.expand_path("#{name}-#{version}.gem")
+      end
+
+      def detect_gemspec
+        gemspecs = Dir['*.gemspec']
+        fail "Too many gemspecs: #{gemspecs.inspect}" unless gemspecs.size == 1
+        gemspecs.first
+      end
+
+      def tempdir
+        Dir.mktmpdir do |dir|
+          Dir.chdir(dir) do
+            yield
+          end
+        end
+      end
+
+      def get_payload_sum(file)
+        full_path = File.expand_path(file)
+        logger.debug "Getting SHA digests for #{full_path}"
+
+        results = []
+        tempdir do
+          data_file = "data.tar.gz"
+          Tar.extract_file(full_path, data_file)
+
+          archive_path = File.expand_path(data_file)
+
+          tempdir do
+            Tar.extract_compressed(archive_path)
+            add_directory_sums(results, '.')
+          end
+        end
+        results
+      end
+
+      def get_remote_payload_sum
+        logger.debug "Fetching remote gem for verification"
+        tempdir do
+          Gem.fetch(name, version)
+          file = "#{name}-#{version}.gem"
+          return get_payload_sum(file)
+        end
+      end
+
+      def add_directory_sums(results, dir)
+        # TODO: check for filesystem loops/symlinks?
+        Pathname.new(dir).children.each do |f|
+          if File.directory?(f)
+            add_directory_sums(results, f)
+          else
+            logger.debug "SHA digest #{File.expand_path(f)}"
+            results << [digest(f), f]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gem-checkout/version.rb

@@ -0,0 +1,5 @@
+module Gem
+  module Checkout
+    VERSION = '0.1.0'
+  end
+end

data/lib/rubygems/commands/checkout_command.rb

@@ -1,6 +1,7 @@
 require 'logger'
 
 require 'gem-checkout/source'
+require 'gem-checkout/verifier'
 
 class Gem::Commands::CheckoutCommand < Gem::Command
   def initialize
@@ -12,6 +13,10 @@ class Gem::Commands::CheckoutCommand < Gem::Command
     add_option('-d', '--debug LEVEL', 'set debug mode (0=debug)') do |level, options|
       options[:debug_level] = Integer(level)
     end
+
+    add_option('-s', '--[no-]verify',  'verify sources match gem exactly') do |verify, options|
+      options[:verify] = verify
+    end
   end
 
   def arguments # :nodoc:
@@ -37,13 +42,22 @@ class Gem::Commands::CheckoutCommand < Gem::Command
 
     name = get_one_gem_name
     source = Gem::Checkout::Source.new(name, options[:version])
+    version = source.version
+
     repository = source.repository
     repository.clone(directory: name)
     Dir.chdir(name) do
       repository.checkout(source.source_reference)
+      if options[:verify]
+        verifier = Gem::Checkout::Verifier.new(name, version)
+        verifier.verify!
+      end
     end
   rescue Gem::Checkout::Repository::Error => ex
     alert_error ex.message
     terminate_interaction 1
+  rescue Gem::Checkout::Verifier::Error => ex
+    alert_error ex.message
+    terminate_interaction 1
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gem-checkout
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.1.0
 platform: ruby
 authors:
 - Cezary Baginski
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-10-21 00:00:00.000000000 Z
+date: 2015-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gems
@@ -54,6 +54,8 @@ files:
 - lib/gem-checkout/repository/git.rb
 - lib/gem-checkout/source.rb
 - lib/gem-checkout/spec.rb
+- lib/gem-checkout/verifier.rb
+- lib/gem-checkout/version.rb
 - lib/rubygems/commands/checkout_command.rb
 - lib/rubygems_plugin.rb
 homepage: https://github.com/e2/gem-checkout