hexapdf 1.10.0 → 1.11.0

data/test/hexapdf/digital_signature/common.rb

@@ -5,6 +5,9 @@ module HexaPDF
 
     class Certificates
 
+      # Port for the combined OCSP responder / CRL distribution point test server.
+      OCSP_CRL_PORT = 34568
+
       def ca_key
         @ca_key ||= OpenSSL::PKey::RSA.new(2048)
       end
@@ -43,6 +46,106 @@ module HexaPDF
           end
       end
 
+      def signer_certificate_with_ocsp
+        @signer_certificate_with_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with OCSP', serial: 6,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp")
+            cert
+          end
+      end
+
+      def signer_certificate_with_crl
+        @signer_certificate_with_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with CRL', serial: 7,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl")
+            cert
+          end
+      end
+
+      def signer_certificate_with_unsuccessful_ocsp
+        @signer_certificate_with_unsuccessful_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with unsucessful OCSP', serial: 11,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-unsuccessful")
+            cert
+          end
+      end
+
+      def signer_certificate_with_revoked_ocsp
+        @signer_certificate_with_revoked_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with revoked OCSP', serial: 12,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-revoked")
+            cert
+          end
+      end
+
+      def signer_certificate_with_http_error_ocsp
+        @signer_certificate_with_http_error_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with HTTP error OCSP', serial: 13,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/ocsp-http-error")
+            cert
+          end
+      end
+
+      def signer_certificate_with_bad_ocsp
+        @signer_certificate_with_bad_ocsp ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with bad OCSP', serial: 8,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           ocsp_url: "http://127.0.0.1:#{OCSP_CRL_PORT + 1}/ocsp")
+            cert
+          end
+      end
+
+      def signer_certificate_with_revoked_crl
+        @signer_certificate_with_revoked_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with revoked CRL', serial: 14,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl-revoked")
+            cert
+          end
+      end
+
+      def signer_certificate_with_http_error_crl
+        @signer_certificate_with_http_error_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with HTTP error CRL', serial: 15,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl-http-error")
+            cert
+          end
+      end
+
+      def signer_certificate_with_bad_crl
+        @signer_certificate_with_bad_crl ||=
+          begin
+            cert = create_cert(name: '/CN=RSA signer with bad CRL', serial: 9,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT + 1}/crl")
+            cert
+          end
+      end
+
+
       def dsa_signer_key
         @dsa_signer_key ||= OpenSSL::PKey::DSA.new(2048)
       end
@@ -77,11 +180,36 @@ module HexaPDF
             cert = create_cert(name: '/CN=timestamp', serial: 5,
                                public_key: signer_key, issuer: ca_certificate)
             add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
-                           extended_key_usage: 'timeStamping')
+                           extended_key_usage: 'timeStamping',
+                           crl_url: "http://127.0.0.1:#{OCSP_CRL_PORT}/crl")
+            cert
+          end
+      end
+
+      def ocsp_signing_certificate
+        @ocsp_signing_certificate ||=
+          begin
+            cert = create_cert(name: '/CN=OCSP', serial: 10,
+                               public_key: signer_key, issuer: ca_certificate)
+            add_extensions(cert, ca_certificate, ca_key, key_usage: 'digitalSignature',
+                           extended_key_usage: 'OCSPSigning')
             cert
           end
       end
 
+      def crl
+        @crl ||=
+          begin
+            crl = OpenSSL::X509::CRL.new
+            crl.version = 1
+            crl.issuer = ca_certificate.subject
+            crl.last_update = Time.now - 60
+            crl.next_update = Time.now + 86400
+            crl.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+            crl
+          end
+      end
+
       def create_cert(name:, serial:, public_key:, issuer: nil)
         name = OpenSSL::X509::Name.parse(name)
         cert = OpenSSL::X509::Certificate.new
@@ -96,7 +224,7 @@ module HexaPDF
       end
 
       def add_extensions(subject_cert, issuer_cert, signing_key, is_ca: false, key_usage: nil,
-                         extended_key_usage: nil)
+                         extended_key_usage: nil, ocsp_url: nil, crl_url: nil)
         extension_factory = OpenSSL::X509::ExtensionFactory.new
         extension_factory.subject_certificate = subject_cert
         extension_factory.issuer_certificate = issuer_cert
@@ -113,6 +241,16 @@ module HexaPDF
           subject_cert.add_extension(extension_factory.create_extension('extendedKeyUsage',
                                                                         extended_key_usage, true))
         end
+        if ocsp_url
+          subject_cert.add_extension(
+            extension_factory.create_extension('authorityInfoAccess', "OCSP;URI:#{ocsp_url}")
+          )
+        end
+        if crl_url
+          subject_cert.add_extension(
+            extension_factory.create_extension('crlDistributionPoints', "URI:#{crl_url}")
+          )
+        end
         subject_cert.sign(signing_key, OpenSSL::Digest.new('SHA1'))
       end
       private :add_extensions
@@ -148,6 +286,75 @@ module HexaPDF
         Thread.new { @tsa_server.start }
       end
 
+      def start_ocsp_crl_server
+        return if defined?(@ocsp_crl_server)
+        require 'webrick'
+        @ocsp_crl_server = WEBrick::HTTPServer.new(Port: OCSP_CRL_PORT, BindAddress: '127.0.0.1',
+                                                   Logger: WEBrick::Log.new(StringIO.new), AccessLog: [])
+        @ocsp_crl_server.mount_proc('/ocsp') do |request, response|
+          ocsp_req = OpenSSL::OCSP::Request.new(request.body)
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          ocsp_req.certid.each do |certid|
+            basic_resp.add_status(certid, OpenSSL::OCSP::V_CERTSTATUS_GOOD,
+                                  OpenSSL::OCSP::REVOKED_STATUS_UNSPECIFIED,
+                                  nil, Time.now - 60, Time.now + 86400, nil)
+          end
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/ocsp-unsuccessful') do |request, response|
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_INTERNALERROR, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/ocsp-revoked') do |request, response|
+          ocsp_req = OpenSSL::OCSP::Request.new(request.body)
+          basic_resp = OpenSSL::OCSP::BasicResponse.new
+          ocsp_req.certid.each do |certid|
+            basic_resp.add_status(certid, OpenSSL::OCSP::V_CERTSTATUS_REVOKED,
+                                  OpenSSL::OCSP::REVOKED_STATUS_UNSPECIFIED,
+                                  Time.now - 100, Time.now - 60, Time.now + 86400, nil)
+          end
+          basic_resp.sign(CERTIFICATES.ocsp_signing_certificate, CERTIFICATES.signer_key,
+                          [CERTIFICATES.ca_certificate])
+          response.body = OpenSSL::OCSP::Response.create(
+            OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, basic_resp
+          ).to_der
+          response['Content-Type'] = 'application/ocsp-response'
+        end
+
+        @ocsp_crl_server.mount_proc('/crl') do |_request, response|
+          response.body = CERTIFICATES.crl.to_der
+          response['Content-Type'] = 'application/pkix-crl'
+        end
+
+        @ocsp_crl_server.mount_proc('/crl-revoked') do |_request, response|
+          crl = OpenSSL::X509::CRL.new
+          crl.version = 1
+          crl.issuer = ca_certificate.subject
+          crl.last_update = Time.now - 60
+          crl.next_update = Time.now + 86400
+          revoked = OpenSSL::X509::Revoked.new
+          revoked.serial = signer_certificate_with_revoked_crl.serial
+          revoked.time = Time.now - 100
+          crl.add_revoked(revoked)
+          crl.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+          response.body = crl.to_der
+          response['Content-Type'] = 'application/pkix-crl'
+        end
+        Thread.new { @ocsp_crl_server.start }
+      end
+
     end
 
   end

data/test/hexapdf/digital_signature/test_signatures.rb

@@ -161,4 +161,135 @@ describe HexaPDF::DigitalSignature::Signatures do
       assert(signed_doc.signatures.first.verify)
     end
   end
+
+  describe "add_ltv_information" do
+    before do
+      CERTIFICATES.start_ocsp_crl_server
+      @doc = HexaPDF::Document.new(io: StringIO.new(MINIMAL_PDF))
+      @io = StringIO.new(''.b)
+    end
+
+    # Signs @doc and returns a new HexaPDF::Document instance for the signed document.
+    def sign_with(certificate, key: CERTIFICATES.signer_key, certificate_chain: [CERTIFICATES.ca_certificate])
+      io = StringIO.new(''.b)
+      @doc.sign(io, certificate: certificate, key: key, certificate_chain: certificate_chain)
+      HexaPDF::Document.new(io: io)
+    end
+
+    it "adds all certificates to the DSS" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal([CERTIFICATES.signer_certificate_with_ocsp, CERTIFICATES.ca_certificate],
+                   dss.certificates)
+    end
+
+    it "fails if one of the certificates has no OCSP or CRL URL" do
+      doc = sign_with(CERTIFICATES.signer_certificate)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "adds a VRI entry for all non-root certificates" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal(1, dss[:VRI].value.length)
+      assert(dss.vri_for(doc.signatures.first))
+    end
+
+    it "embeds OCSP validation data for a certificate that has an AIA OCSP URL" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(dss[:OCSPs].value, vri[:OCSP].value)
+      assert_equal(dss[:Certs].value, vri[:Cert].value)
+      assert_nil(dss[:CRLs])
+      assert_nil(vri[:CRL])
+    end
+
+    it "handles a connection failure to the OCSP server" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_bad_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles unsuccessful OCSP validation" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_unsuccessful_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles successful OCSP validation but with a non-good certificate status" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_revoked_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/OCSP response.*not valid/, e.message)
+    end
+
+    it "handles non-OK HTTP response codes when fetching the OCSP response" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_http_error_ocsp)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "doesn't use the OCSP information if the issuer certificate is not embedded" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp, certificate_chain: [])
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "embeds CRL validation data when no OCSP URL is present in the certificate" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_crl)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(dss[:CRLs].value, vri[:CRL].value)
+      assert_equal(dss[:Certs].value, vri[:Cert].value)
+      assert_nil(dss[:OCSPs])
+      assert_nil(vri[:OCSP])
+    end
+
+    it "handles a connection failure to the CRL server" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_bad_crl)
+      # CRL URL available but bad endpoint
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "handles a certificate that is revoked via CRL" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_revoked_crl)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/CRL.*certificate is revoked/, e.message)
+    end
+
+    it "handles non-OK HTTP response codes when fetching the CRL response" do
+      doc = sign_with(CERTIFICATES.signer_certificate_with_http_error_crl)
+      e = assert_raises(HexaPDF::Error) { doc.signatures.add_ltv_information }
+      assert_match(/No OCSP and CRL/, e.message)
+    end
+
+    it "embeds validation data for an embedded timestamp signature" do
+      CERTIFICATES.start_tsa_server
+      ts_handler = @doc.signatures.signing_handler(name: :timestamp, signature_size: 20_000,
+                                                   tsa_url: "http://127.0.0.1:34567")
+      io = StringIO.new(''.b)
+      @doc.sign(io, certificate: CERTIFICATES.signer_certificate_with_ocsp,
+                key: CERTIFICATES.signer_key, certificate_chain: [CERTIFICATES.ca_certificate],
+                timestamp_handler: ts_handler)
+      doc = HexaPDF::Document.new(io: io)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      vri = dss.vri_for(doc.signatures.first)
+      assert_equal(3, vri[:Cert].value.size)
+    end
+
+    it "creates VRI entries for all signatures" do
+      @doc = sign_with(CERTIFICATES.signer_certificate_with_ocsp)
+      doc = sign_with(CERTIFICATES.signer_certificate_with_crl)
+      doc.signatures.add_ltv_information
+      dss = doc.catalog.dss
+      assert_equal(2, dss[:VRI].value.size)
+    end
+  end
 end

data/test/hexapdf/layout/test_style.rb

@@ -616,7 +616,7 @@ describe HexaPDF::Layout::Style::LinkLayer do
       annot = call_link(dest: true)
       assert_equal(:Link, annot[:Subtype])
       assert_equal([10, 10, 25, 20], annot[:Rect].value)
-      assert_equal([10, 10, 25, 10, 25, 20, 10, 20], annot[:QuadPoints].value)
+      assert_equal([10, 20, 25, 20, 10, 10, 25, 10], annot[:QuadPoints].value)
     end
 
     it "removes the border by default" do
@@ -852,8 +852,10 @@ describe HexaPDF::Layout::Style do
   end
 
   it "has several dynamically generated properties with default values that take blocks" do
+    refute(@style.text_segmentation_algorithm?)
     assert_equal(HexaPDF::Layout::TextLayouter::SimpleTextSegmentation,
                  @style.text_segmentation_algorithm)
+    refute(@style.text_line_wrapping_algorithm?)
     assert_equal(HexaPDF::Layout::TextLayouter::SimpleLineWrapping,
                  @style.text_line_wrapping_algorithm)
 

data/test/hexapdf/task/test_import_pages.rb

@@ -99,9 +99,10 @@ describe HexaPDF::Task::ImportPages do
       canvas = @doc.pages[0].canvas
       form = canvas.form
       form[:OC] = @ocg1
+      form.canvas.optional_content(@ocmd)
       canvas.xobject(form, at: [0, 0])
       @target.task(:import_pages, source: @doc)
-      assert_equal(['OCG'], @target.optional_content.ocgs.map(&:name))
+      assert_equal(['OCG', 'OCMD'], @target.optional_content.ocgs.map(&:name))
     end
 
     it "preserves OCGs/OCMDs associated with annotations" do
@@ -123,4 +124,44 @@ describe HexaPDF::Task::ImportPages do
       assert_equal(['OCG'], rb_groups[0].map(&:name))
     end
   end
+
+  describe "resize_to argument" do
+    before do
+      @doc.annotations.create_line(@pages[0], start_point: [10, 10], end_point: [100, 100]).
+        regenerate_appearance
+    end
+
+    it "works when given a symbolic page size" do
+      @target.task(:import_pages, source: @doc, resize_to: :A4)
+      assert_equal(2, @doc.each.select {|obj| obj.type == :Page }.size)
+      assert_operators(@target.pages[0].contents, [[:paint_xobject, [:XO1]]])
+      assert_operators(@target.pages[1].contents, [[:paint_xobject, [:XO1]]])
+    end
+
+    it "works when given a media box directly" do
+      @target.task(:import_pages, source: @doc, pages: 0, resize_to: [5, 5, 100, 100])
+      assert_equal(1, @target.each.select {|obj| obj.type == :Page }.size)
+      assert_operators(@target.pages[0].contents,
+                       [[:concatenate_matrix, [1, 0, 0, 1, 5, 5]],
+                        [:save_graphics_state],
+                        [:concatenate_matrix, [0.15959, 0, 0, 0.112841, 0.0, 0.0]],
+                        [:paint_xobject, [:XO1]],
+                        [:restore_graphics_state]])
+    end
+
+    it "flattens the annotations" do
+      @target.task(:import_pages, source: @doc, pages: 0, resize_to: [5, 5, 100, 100])
+      assert_operators(@target.pages[0].resources.xobject(:XO1).contents,
+                       [[:save_graphics_state],
+                        [:restore_graphics_state],
+                        [:save_graphics_state],
+                        [:restore_graphics_state],
+                        [:save_graphics_state],
+                        [:save_graphics_state],
+                        [:concatenate_matrix, [1.0, 0, 0, 1.0, 0.0, 0.0]],
+                        [:paint_xobject, [:XO1]],
+                        [:restore_graphics_state],
+                        [:restore_graphics_state]])
+    end
+  end
 end

data/test/hexapdf/type/acro_form/test_appearance_generator.rb

@@ -928,7 +928,7 @@ describe HexaPDF::Type::AcroForm::AppearanceGenerator do
 
         it "creates the /N appearance stream" do
           @field[:I] = [1, 2]
-          @field[:V] = ['b', 'c']
+          @field[:V] = ['b', 'c', 'd']
           @field.set_default_appearance_string(font_size: 12, font_color: "red")
           @generator.create_appearances
           assert_operators(@widget[:AP][:N].stream,

data/test/hexapdf/type/acro_form/test_choice_field.rb

@@ -103,6 +103,11 @@ describe HexaPDF::Type::AcroForm::ChoiceField do
         @field.option_items = [1, 2, 3, 4]
         @field.list_box_top_index = 2
         assert_equal(2, @field.list_box_top_index)
+
+        @field[:TI] = 100
+        assert_equal(0, @field.list_box_top_index)
+        @field[:TI] = "other"
+        assert_equal(0, @field.list_box_top_index)
       end
 
       it "fails if mulitple values are provided but the list box is not a multi-select" do

data/test/hexapdf/type/acro_form/test_field.rb

@@ -113,7 +113,9 @@ describe HexaPDF::Type::AcroForm::Field do
 
   it "can check whether a widget is embedded in the field" do
     refute(@field.embedded_widget?)
-    @field[:Subtype] = :Wdiget
+    @field[:Subtype] = :Link
+    refute(@field.embedded_widget?)
+    @field[:Subtype] = :Widget
     assert(@field.embedded_widget?)
   end
 

data/test/hexapdf/type/test_document_security_store.rb

@@ -1,6 +1,7 @@
 # -*- encoding: utf-8 -*-
 
 require 'test_helper'
+require_relative '../digital_signature/common'
 require 'hexapdf/document'
 require 'hexapdf/type/document_security_store'
 
@@ -87,4 +88,33 @@ describe HexaPDF::Type::DocumentSecurityStore do
       refute(vri.key?(:CRL))
     end
   end
+
+  describe "vri_for" do
+    before do
+      @signature = @doc.add({Type: :Sig, Contents: 'signature bytes'})
+    end
+
+    it "returns nil if no /VRI entry exists" do
+      assert_nil(@dss.vri_for(@signature))
+    end
+
+    it "returns the VRI entry for the signature if it exists" do
+      @dss[:VRI] = {}
+      assert_nil(@dss.vri_for(@signature))
+      @dss.add_vri(@signature)
+      assert_equal(@dss[:VRI].value.first[1], @dss.vri_for(@signature))
+    end
+  end
+
+  describe "certificates" do
+    it "returns an empty array if no /Certs entry exists" do
+      assert_equal([], @dss.certificates)
+    end
+
+    it "returns an array with certificate instances" do
+      cert = CERTIFICATES.signer_certificate
+      @dss[:Certs] = [@doc.add({}, stream: cert.to_der)]
+      assert_equal([cert], @dss.certificates)
+    end
+  end
 end

data/test/test_helper.rb

@@ -3,9 +3,13 @@
 begin
   require 'simplecov'
   SimpleCov.start do
-    minimum_coverage line: 100 unless ENV['NO_SIMPLECOV']
-    add_filter '/test/'
-    add_filter '/fast_arc4.rb'
+    enable_coverage(:method)
+    unless ENV['NO_SIMPLECOV']
+      coverage(:line) { minimum 100 }
+      coverage(:method) { minimum 100 }
+    end
+    skip '/test/'
+    skip '/fast_arc4.rb'
   end
 rescue LoadError
 end