gem-index-dumper 1.0.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/.project

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>gem-index-dumper</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+	</buildSpec>
+	<natures>
+		<nature>com.aptana.ruby.core.rubynature</nature>
+	</natures>
+</projectDescription>

data/.rspec

@@ -0,0 +1 @@
+--color

data/Gemfile

@@ -0,0 +1,11 @@
+source "http://rubygems.org"
+gem "bundler", "~> 1.0.0"
+
+# Add dependencies to develop your gem here.
+# Include everything needed to run rake, tests, features, etc.
+group :development do
+  gem "rspec", "~> 2.1.0"
+  gem "bundler", "~> 1.0.0"
+  gem "jeweler", "~> 1.5.1"
+  gem "rcov", ">= 0"
+end

data/Gemfile.lock

@@ -0,0 +1,28 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    diff-lcs (1.1.2)
+    git (1.2.5)
+    jeweler (1.5.1)
+      bundler (~> 1.0.0)
+      git (>= 1.2.5)
+      rake
+    rake (0.8.7)
+    rcov (0.9.9)
+    rspec (2.1.0)
+      rspec-core (~> 2.1.0)
+      rspec-expectations (~> 2.1.0)
+      rspec-mocks (~> 2.1.0)
+    rspec-core (2.1.0)
+    rspec-expectations (2.1.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.1.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 1.0.0)
+  jeweler (~> 1.5.1)
+  rcov
+  rspec (~> 2.1.0)

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2010 Victor Costan
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,38 @@
+= gem-index-dumper
+
+Spot-checks on the gem index.
+
+== Usage
+
+The gem installs a command-line tool gem-index-dumper which can be used as
+follows.
+
+    gem-index-dumper
+    
+Dumps all the gem index entry (all gems, all versions, all platforms).
+
+    gem-index-dumper ^a
+    
+Selects the gems starting with a and dumps the latest version of each gem,
+together with SHA-1s for the gem files. 
+
+    gem-index-dumper ^a \\.0$
+    
+Selects the gems starting with a and dumps the versions of each gem that end
+in .0 (e.g. 1.0, 2.0, 3.1.0), together with SHA-1s for the gem files.
+
+
+== Contributing to gem-index-dumper
+ 
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
+* Fork the project
+* Start a feature/bugfix branch
+* Commit and push until you are happy with your contribution
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2010 Victor Costan. See LICENSE.txt for further details.
+

data/Rakefile

@@ -0,0 +1,50 @@
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
+  gem.name = "gem-index-dumper"
+  gem.homepage = "http://github.com/pwnall/gem-index-dumper"
+  gem.license = "MIT"
+  gem.summary = %Q{Spot-checks on the gem index.}
+  gem.description = %Q{Command-line utility to perform queries on the gem index that are useful for detecting MITM attacks. }
+  gem.email = "victor@costan.us"
+  gem.authors = ["Victor Costan"]
+  # Include your dependencies below. Runtime dependencies are required when using your gem,
+  # and development dependencies are only needed for development (ie running rake tasks, tests, etc)
+  gem.add_runtime_dependency 'bundler', '~> 1.0.0'
+  #  gem.add_development_dependency 'rspec', '> 1.2.3'
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+  spec.pattern = FileList['spec/**/*_spec.rb']
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |spec|
+  spec.pattern = 'spec/**/*_spec.rb'
+  spec.rcov = true
+end
+
+task :default => :spec
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  version = File.exist?('VERSION') ? File.read('VERSION') : ""
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "gem-index-dumper #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+1.0.0

data/bin/gem-index-dumper

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+require 'rubygems'
+require 'gem-index-dumper'
+
+case ARGV.length
+when 0
+  print GemIndexDumper.dump_remote_gems
+when 1
+  print GemIndexDumper.dump_gem_digests Regexp.new(ARGV[0])
+when 2
+  print GemIndexDumper.dump_gem_digests Regexp.new(ARGV[0]), Regexp.new(ARGV[1])
+else
+  print <<END
+Usage: #{$0} [name_pattern] [version_pattern]
+
+If no pattern is given, dumps all the gem entries in the index.
+
+If a name pattern is given, dumps the SHA-1 hash of the latest version for each
+gem whose name matches the pattern. 
+END
+end

data/gem-index-dumper.gemspec

@@ -0,0 +1,75 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE DIRECTLY
+# Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = %q{gem-index-dumper}
+  s.version = "1.0.0"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Victor Costan"]
+  s.date = %q{2010-11-19}
+  s.default_executable = %q{gem-index-dumper}
+  s.description = %q{Command-line utility to perform queries on the gem index that are useful for detecting MITM attacks. }
+  s.email = %q{victor@costan.us}
+  s.executables = ["gem-index-dumper"]
+  s.extra_rdoc_files = [
+    "LICENSE.txt",
+    "README.rdoc"
+  ]
+  s.files = [
+    ".document",
+    ".project",
+    ".rspec",
+    "Gemfile",
+    "Gemfile.lock",
+    "LICENSE.txt",
+    "README.rdoc",
+    "Rakefile",
+    "VERSION",
+    "bin/gem-index-dumper",
+    "gem-index-dumper.gemspec",
+    "lib/gem-index-dumper.rb",
+    "spec/gem-index-dumper_spec.rb",
+    "spec/spec_helper.rb"
+  ]
+  s.homepage = %q{http://github.com/pwnall/gem-index-dumper}
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = %q{1.3.7}
+  s.summary = %q{Spot-checks on the gem index.}
+  s.test_files = [
+    "spec/gem-index-dumper_spec.rb",
+    "spec/spec_helper.rb"
+  ]
+
+  if s.respond_to? :specification_version then
+    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_development_dependency(%q<rspec>, ["~> 2.1.0"])
+      s.add_development_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_development_dependency(%q<jeweler>, ["~> 1.5.1"])
+      s.add_development_dependency(%q<rcov>, [">= 0"])
+      s.add_runtime_dependency(%q<bundler>, ["~> 1.0.0"])
+    else
+      s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_dependency(%q<rspec>, ["~> 2.1.0"])
+      s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_dependency(%q<jeweler>, ["~> 1.5.1"])
+      s.add_dependency(%q<rcov>, [">= 0"])
+      s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+    end
+  else
+    s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+    s.add_dependency(%q<rspec>, ["~> 2.1.0"])
+    s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+    s.add_dependency(%q<jeweler>, ["~> 1.5.1"])
+    s.add_dependency(%q<rcov>, [">= 0"])
+    s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+  end
+end
+

data/lib/gem-index-dumper.rb

@@ -0,0 +1,51 @@
+require 'digest/sha1'
+require 'fileutils'
+require 'tempfile'
+
+require 'rubygems'
+require 'bundler'
+
+module GemIndexDumper
+  def self.all_remote_gems
+    Gem::SpecFetcher.new.list(true, true).values.first
+  end
+  
+  def self.dump_remote_gems(pattern = nil)
+    gems = all_remote_gems
+    gems.sort!
+    gems.map { |data| "#{data[0]} / #{data[2]}   v#{data[1].to_s}\n" }.join
+  end
+  
+  def self.gem_digest(info)
+    uri = Gem.sources.first
+    spec = Bundler::RemoteSpecification.new(info[0], info[1], info[2], uri)
+    gem_file = Tempfile.new 'gem'
+    gem_path = gem_file.path
+    gem_file.close true
+    
+    download_path = File.join(gem_path, 'cache')
+    FileUtils.mkdir_p download_path
+    gem_file = Gem::RemoteFetcher.fetcher.download(spec, uri, gem_path)
+    digest = Digest::SHA1.hexdigest File.read(gem_file)
+    FileUtils.rm_r gem_path
+    digest
+  end
+  
+  def self.dump_gem_digests(name_pattern, version_pattern = nil)
+    gems = all_remote_gems.select { |data| name_pattern =~ data[0] }
+    gems.sort!
+    if version_pattern
+      gems = gems.select { |data| version_pattern =~ data[1].to_s }
+    else
+      # Pick the most recent gems.      
+      gems_by_name = {}
+      gems.each { |data| gems_by_name[data[0]] = data }
+      gems = gems_by_name.values
+      gems.sort!
+    end
+    
+    gems.map { |data|
+      "#{data[0]} / #{data[2]}   v#{data[1].to_s}   = #{gem_digest(data)}\n"
+    }.join
+  end
+end

data/spec/gem-index-dumper_spec.rb

@@ -0,0 +1,100 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe 'GemIndexDumper' do
+  describe 'gem_digest' do
+    let(:gem_info) { ['activerecord', Gem::Version.new('3.0.0'), 'ruby'] }
+    it 'should compute the digest correctly' do
+      GemIndexDumper.gem_digest(gem_info).should ==
+          'b4025f8396c9d784b26fa22c0dbf27e80a513469'
+    end
+  end
+  
+  describe 'all_remote_gems' do
+    before :all do
+      @all = GemIndexDumper.all_remote_gems
+    end
+    
+    it 'should include all versions for all gems' do
+      @all.should include(['activerecord', Gem::Version.new('3.0.0'), 'ruby'])
+      @all.should include(['activerecord', Gem::Version.new('3.0.3'), 'ruby'])
+    end
+  end
+  
+  describe 'dump_remote_gems' do
+    before do
+      GemIndexDumper.should_receive(:all_remote_gems).and_return([
+        ['activerecord', Gem::Version.new('3.0.2'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.3'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.0'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.1'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.1'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.0'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.2'), 'ruby'],
+        ['actionpack', Gem::Version.new('2.3.5'), 'ruby']
+      ])
+    end
+    
+    it 'without an argument should return all gems sorted' do
+      GemIndexDumper.dump_remote_gems.should == <<END
+actionpack / ruby   v2.3.5
+actionpack / ruby   v3.0.0
+actionpack / ruby   v3.0.1
+actionpack / ruby   v3.0.2
+activerecord / ruby   v3.0.0
+activerecord / ruby   v3.0.1
+activerecord / ruby   v3.0.2
+activerecord / ruby   v3.0.3
+END
+    end
+  end
+
+  describe 'dump_gem_digests' do
+    before do
+      GemIndexDumper.should_receive(:all_remote_gems).and_return([
+        ['activerecord', Gem::Version.new('3.0.2'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.3'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.0'), 'ruby'],
+        ['activerecord', Gem::Version.new('3.0.1'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.1'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.0'), 'ruby'],
+        ['actionpack', Gem::Version.new('3.0.2'), 'ruby'],
+        ['actionpack', Gem::Version.new('2.3.5'), 'ruby']
+      ])
+      GemIndexDumper.stub!(:gem_digest).
+          with(['actionpack', Gem::Version.new('3.0.2'), 'ruby']).
+          and_return('0011001100110011001100110011001100110011')
+      GemIndexDumper.stub!(:gem_digest).
+          with(['activerecord', Gem::Version.new('3.0.3'), 'ruby']).
+          and_return('2233223322332233223322332233223322332233')
+      GemIndexDumper.stub!(:gem_digest).
+          with(['activerecord', Gem::Version.new('3.0.2'), 'ruby']).
+          and_return('4455445544554455445544554455445544554455')
+    end
+
+    it 'without a version pattern should return the latest gem versions' do
+      GemIndexDumper.dump_gem_digests(/.*/).should == <<END
+actionpack / ruby   v3.0.2   = 0011001100110011001100110011001100110011
+activerecord / ruby   v3.0.3   = 2233223322332233223322332233223322332233
+END
+    end
+    
+    it 'with a version pattern should return specific versions' do
+      GemIndexDumper.dump_gem_digests(/.*/, /2$/).should == <<END
+actionpack / ruby   v3.0.2   = 0011001100110011001100110011001100110011
+activerecord / ruby   v3.0.2   = 4455445544554455445544554455445544554455
+END
+    end
+    
+    it 'with a name pattern should return the latest version' do
+      GemIndexDumper.dump_gem_digests(/pack/).should == <<END
+actionpack / ruby   v3.0.2   = 0011001100110011001100110011001100110011
+END
+    end
+    
+    it 'with name and version patterns should return that version' do
+      GemIndexDumper.dump_gem_digests(/record/, /2$/).should == <<END
+activerecord / ruby   v3.0.2   = 4455445544554455445544554455445544554455
+END
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,12 @@
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'rspec'
+require 'gem-index-dumper'
+
+# Requires supporting files with custom matchers and macros, etc,
+# in ./support/ and its subdirectories.
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each {|f| require f}
+
+RSpec.configure do |config|
+  
+end

metadata

@@ -0,0 +1,175 @@
+--- !ruby/object:Gem::Specification 
+name: gem-index-dumper
+version: !ruby/object:Gem::Version 
+  hash: 23
+  prerelease: false
+  segments: 
+  - 1
+  - 0
+  - 0
+  version: 1.0.0
+platform: ruby
+authors: 
+- Victor Costan
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2010-11-19 00:00:00 -05:00
+default_executable: gem-index-dumper
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: bundler
+  version_requirements: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  requirement: *id001
+  type: :runtime
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: rspec
+  version_requirements: &id002 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 11
+        segments: 
+        - 2
+        - 1
+        - 0
+        version: 2.1.0
+  requirement: *id002
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: bundler
+  version_requirements: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  requirement: *id003
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: jeweler
+  version_requirements: &id004 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 1
+        segments: 
+        - 1
+        - 5
+        - 1
+        version: 1.5.1
+  requirement: *id004
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: rcov
+  version_requirements: &id005 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  requirement: *id005
+  type: :development
+- !ruby/object:Gem::Dependency 
+  prerelease: false
+  name: bundler
+  version_requirements: &id006 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ~>
+      - !ruby/object:Gem::Version 
+        hash: 23
+        segments: 
+        - 1
+        - 0
+        - 0
+        version: 1.0.0
+  requirement: *id006
+  type: :runtime
+description: "Command-line utility to perform queries on the gem index that are useful for detecting MITM attacks. "
+email: victor@costan.us
+executables: 
+- gem-index-dumper
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE.txt
+- README.rdoc
+files: 
+- .document
+- .project
+- .rspec
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- VERSION
+- bin/gem-index-dumper
+- gem-index-dumper.gemspec
+- lib/gem-index-dumper.rb
+- spec/gem-index-dumper_spec.rb
+- spec/spec_helper.rb
+has_rdoc: true
+homepage: http://github.com/pwnall/gem-index-dumper
+licenses: 
+- MIT
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  none: false
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.7
+signing_key: 
+specification_version: 3
+summary: Spot-checks on the gem index.
+test_files: 
+- spec/gem-index-dumper_spec.rb
+- spec/spec_helper.rb