gitlab-labkit 0.22.0 → 0.23.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 447d8fe136f58c456c4e8dc1c90e3664a436915becf619f1b747d13af817afb6
-  data.tar.gz: '0978b44b4a1c4bb6098ec545be92b3c0f8253c048361c479fd308f76e479de38'
+  metadata.gz: 374f599a7aab8870d5294f5920d5f8563d8b694ea6788c1fa42ad7e8a50fd34a
+  data.tar.gz: f3d81d73ec48bf35b8faaf6cb8e5f43c27feb32a411acab08d1b5caddf112acb
 SHA512:
-  metadata.gz: 4211c733283c75b13ee3a38d6d616bff31501138c6fcd92c261d9a8733d056c5017a7920029a5f391c3c3386618ec941e63fde3d439ff9993277c1047f3e206a
-  data.tar.gz: dbbd0ac0b29b7a1ae401b94b32d5bcf0a959e09d7ed418977c1c1cb85ed3cf2ce4c2f7305cec9d931aa3199e8632ca71165a713993132e2db7d473f9efafe6e5
+  metadata.gz: daf3ba2cc04096dbcfd4ce9acb9a719b4437eba9aa9b2e4d3a39885f5b47dbd8dd5dc2696e775ecfd961cc729426f8eca5b7abe978a9c023876d3aac9e29168f
+  data.tar.gz: fe9648bd7092ff6852fbda09f54ca6356c5b3c8eb3974ff16839b8bb7e9f28ffb3d145e626383ab8d09f1e19dc1b6b2b10fedc910296e74e9af82c5b39155c4f

data/.rubocop.yml

@@ -60,3 +60,6 @@ Lint/RedundantSafeNavigation: # (new in 0.93)
   Enabled: true
 Style/ClassEqualityComparison: # (new in 0.93)
   Enabled: true
+
+CodeReuse/ActiveRecord:
+  Enabled: false

data/README.md

@@ -16,10 +16,11 @@ The changelog is available via [**tagged release notes**](https://gitlab.com/git
 
 ## Functionality
 
-LabKit-Ruby provides functionality in three areas:
+LabKit-Ruby provides functionality in a number of areas:
 
 1. `Labkit::Context` used for providing context information to log messages.
 1. `Labkit::Correlation` For accessing the correlation id. (Generated and propagated by `Labkit::Context`)
+1. `Labkit::FIPS` for checking for FIPS mode and using FIPS-compliant algorithms.
 1. `Labkit::Logging` for sanitizing log messages.
 1. `Labkit::Tracing` for handling and propagating distributed traces.
 

data/gitlab-labkit.gemspec

@@ -30,7 +30,7 @@ Gem::Specification.new do |spec|
   # Please maintain alphabetical order for dev dependencies
   spec.add_development_dependency "excon", "~> 0.78.1"
   spec.add_development_dependency "faraday", "~> 1.2.0"
-  spec.add_development_dependency "gitlab-dangerfiles"
+  spec.add_development_dependency "gitlab-dangerfiles", "~> 2.11.0"
   spec.add_development_dependency "gitlab-styles", "~> 6.2.0"
   spec.add_development_dependency "grpc-tools", ">= 1.37"
   spec.add_development_dependency "httparty", "~> 0.17.3"

data/lib/gitlab-labkit.rb

@@ -9,6 +9,7 @@ module Labkit
 
   autoload :Correlation, "labkit/correlation"
   autoload :Context, "labkit/context"
+  autoload :FIPS, "labkit/fips"
   autoload :Tracing, "labkit/tracing"
   autoload :Logging, "labkit/logging"
   autoload :Middleware, "labkit/middleware"

data/lib/labkit/fips.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Labkit
+  module Digest
+    module SHA2
+      def new(*args, &block)
+        bitlen = args.first || 256
+        ::OpenSSL::Digest.const_get("SHA#{bitlen}").new
+      end
+    end
+  end
+
+  class FIPS
+    OPENSSL_DIGESTS = %i[SHA1 SHA256 SHA384 SHA512].freeze
+
+    class << self
+      # Returns whether we should be running in FIPS mode or not
+      #
+      # @return [Boolean]
+      def enabled?
+        # Attempt to auto-detect FIPS mode from OpenSSL
+        return true if OpenSSL.fips_mode
+
+        # Otherwise allow it to be set manually via the env vars
+        return true if %w[1 true yes].include?(ENV["FIPS_MODE"])
+
+        false
+      end
+
+      # Swap Ruby's Digest::SHAx implementations for OpenSSL::Digest::SHAx.
+      def enable_fips_mode!
+        require "digest"
+        require "digest/sha2"
+
+        ::Digest::SHA2.singleton_class.prepend(Labkit::Digest::SHA2)
+        OPENSSL_DIGESTS.each { |alg| use_openssl_digest(alg, alg) }
+      end
+
+      private
+
+      def use_openssl_digest(ruby_algorithm, openssl_algorithm)
+        ::Digest.send(:remove_const, ruby_algorithm) # rubocop:disable GitlabSecurity/PublicSend
+        ::Digest.const_set(ruby_algorithm, OpenSSL::Digest.const_get(openssl_algorithm, false))
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.23.0
 platform: ruby
 authors:
 - Andrew Newdigate
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-02-02 00:00:00.000000000 Z
+date: 2022-06-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -158,16 +158,16 @@ dependencies:
   name: gitlab-dangerfiles
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 2.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 2.11.0
 - !ruby/object:Gem::Dependency
   name: gitlab-styles
   requirement: !ruby/object:Gem::Requirement
@@ -381,6 +381,7 @@ files:
 - lib/labkit/correlation/grpc/grpc_common.rb
 - lib/labkit/correlation/grpc/server_interceptor.rb
 - lib/labkit/excon_publisher.rb
+- lib/labkit/fips.rb
 - lib/labkit/httpclient_publisher.rb
 - lib/labkit/logging.rb
 - lib/labkit/logging/grpc.rb