iostreams 1.11.0 → 2.1.0

data/lib/io_streams/pgp.rb

@@ -1,4 +1,5 @@
 require "open3"
+require "shellwords"
 module IOStreams
   # Read/Write PGP/GPG file or stream.
   #
@@ -25,6 +26,18 @@ module IOStreams
 
     @executable = "gpg"
 
+    # Returns [Array<String>] the argv used to invoke gpg, with the supplied
+    # arguments appended.
+    #
+    # All gpg invocations are run without a shell (the multi-argument form of
+    # `Open3`) so that values such as email addresses, key ids, passphrases and
+    # file names cannot be interpreted as shell commands. The configured
+    # `executable` is split with `Shellwords` so that it may still contain
+    # additional fixed arguments (for example "gpg --homedir /path").
+    def self.gpg_command(*args)
+      Shellwords.split(executable) + args.map(&:to_s)
+    end
+
     # Generate a new ultimate trusted local public and private key.
     #
     # Returns [String] the key id for the generated key.
@@ -44,6 +57,20 @@ module IOStreams
     #   Highly Recommended.
     #   To generate a good passphrase:
     #     `SecureRandom.urlsafe_base64(128)`
+    #   Pass `nil` to generate an unprotected (passphrase-less) key.
+    #
+    # key_curve / subkey_curve [String]
+    #   Optional Elliptic Curve to use for the (sub)key, e.g. "ed25519".
+    #   When supplied the corresponding key/subkey length is ignored.
+    #   Requires GnuPG 2.1 or later.
+    #
+    # key_usage / subkey_usage [String]
+    #   Optional comma separated list of (sub)key capabilities, e.g. "sign".
+    #   Requires GnuPG 2.1 or later.
+    #
+    # creation_date [String]
+    #   Optional creation date for the key, e.g. "20240101T000000".
+    #   Requires GnuPG 2.1 or later.
     #
     # See `man gpg` for the remaining options
     def self.generate_key(name:,
@@ -54,23 +81,70 @@ module IOStreams
                           key_length: 4096,
                           subkey_type: "RSA",
                           subkey_length: key_length,
+                          key_curve: nil,
+                          key_usage: nil,
+                          subkey_curve: nil,
+                          subkey_usage: nil,
+                          creation_date: nil,
                           expire_date: nil)
       version_check
-      params = ""
+
+      # Reject newlines so that a value cannot inject additional directives into
+      # the gpg batch key-generation parameter file.
+      reject_newlines!(name: name, email: email, comment: comment, passphrase: passphrase,
+                       key_type: key_type, subkey_type: subkey_type, expire_date: expire_date,
+                       key_curve: key_curve, key_usage: key_usage,
+                       subkey_curve: subkey_curve, subkey_usage: subkey_usage,
+                       creation_date: creation_date)
+
+      # `%no-protection`, and the Elliptic Curve / usage / creation-date directives
+      # were all introduced in GnuPG 2.1. Keep older versions working by only
+      # emitting them when a 2.1+ binary is detected. `--batch --gen-key` accepts
+      # all of these on 2.1+, so there is no need for the newer `--full-gen-key`.
+      modern = pgp_version.to_f >= 2.1
+
+      unless modern
+        new_options = {
+          key_curve:     key_curve,
+          key_usage:     key_usage,
+          subkey_curve:  subkey_curve,
+          subkey_usage:  subkey_usage,
+          creation_date: creation_date
+        }.compact
+        unless new_options.empty?
+          raise(ArgumentError,
+                "IOStreams::Pgp.generate_key: #{new_options.keys.join(', ')} require GnuPG 2.1 or later " \
+                "(detected #{pgp_version})")
+        end
+      end
+
+      params = +""
+      # `%no-protection` is a control statement and must precede the key parameters.
+      # GnuPG 2.1+ requires this explicit opt-out to create an unprotected key;
+      # older versions create one simply by omitting the Passphrase directive.
+      params << "%no-protection\n" if !passphrase && modern
       params << "Key-Type: #{key_type}\n" if key_type
-      params << "Key-Length: #{key_length}\n" if key_length
+      # Key-Length and Key-Curve are mutually exclusive: curves imply their own length.
+      params << "Key-Length: #{key_length}\n" if key_length && !key_curve
+      params << "Key-Curve: #{key_curve}\n" if key_curve
+      params << "Key-Usage: #{key_usage}\n" if key_usage
       params << "Subkey-Type: #{subkey_type}\n" if subkey_type
-      params << "Subkey-Length: #{subkey_length}\n" if subkey_length
+      params << "Subkey-Length: #{subkey_length}\n" if subkey_length && !subkey_curve
+      params << "Subkey-Curve: #{subkey_curve}\n" if subkey_curve
+      params << "Subkey-Usage: #{subkey_usage}\n" if subkey_usage
       params << "Name-Real: #{name}\n" if name
       params << "Name-Comment: #{comment}\n" if comment
       params << "Name-Email: #{email}\n" if email
       params << "Expire-Date: #{expire_date}\n" if expire_date
+      params << "Creation-Date: #{creation_date}\n" if creation_date
       params << "Passphrase: #{passphrase}\n" if passphrase
       params << "%commit"
-      command = "#{executable} --batch --gen-key --no-tty"
 
-      out, err, status = Open3.capture3(command, binmode: true, stdin_data: params)
-      logger&.debug { "IOStreams::Pgp.generate_key: #{command}\n#{params}\n#{err}#{out}" }
+      command = gpg_command("--batch", "--gen-key", "--no-tty")
+
+      out, err, status = Open3.capture3(*command, binmode: true, stdin_data: params)
+      # Do not log `params`, it contains the passphrase.
+      IOStreams.logger&.debug { "IOStreams::Pgp.generate_key: #{command.shelljoin}\n#{err}#{out}" }
 
       raise(Pgp::Failure, "GPG Failed to generate key: #{err}#{out}") unless status.success?
 
@@ -86,13 +160,14 @@ module IOStreams
       end
     end
 
-    # Delete all private and public keys for a particular email.
+    # Delete all private and public keys for a particular email or key id.
     #
     # Returns false if no key was found.
     # Raises an exception if it fails to delete the key.
+    # Raises ArgumentError when neither :email nor :key_id is supplied.
     #
-    # email: [String] Optional email address for the key.
-    # key_id: [String] Optional id for the key.
+    # email: [String] Email address for the key.
+    # key_id: [String] Id for the key.
     #
     # public: [true|false]
     #   Whether to delete the public key
@@ -102,6 +177,8 @@ module IOStreams
     #   Whether to delete the private key
     #   Default: false
     def self.delete_keys(email: nil, key_id: nil, public: true, private: false)
+      raise(ArgumentError, "Either :email, or :key_id must be supplied") if email.nil? && key_id.nil?
+
       version_check
       # Version 2.1+ uses delete_public_or_private_keys
       # Version < 2.1 uses delete_public_or_private_keys_v1
@@ -127,14 +204,18 @@ module IOStreams
     #     date:       [String]
     #     name:       [String]
     #     email:      [String]
+    #     private:    [true|false]
+    #     trust:      [String]
     # Returns [] if no keys were found.
     def self.list_keys(email: nil, key_id: nil, private: false)
       version_check
-      cmd     = private ? "--list-secret-keys" : "--list-keys"
-      command = "#{executable} #{cmd} #{email || key_id}"
+      args = [private ? "--list-secret-keys" : "--list-keys"]
+      # `--` stops gpg from treating the email or key id as an option.
+      args += ["--", (email || key_id).to_s] if email || key_id
+      command = gpg_command(*args)
 
-      out, err, status = Open3.capture3(command, binmode: true)
-      logger&.debug { "IOStreams::Pgp.list_keys: #{command}\n#{err}#{out}" }
+      out, err, status = Open3.capture3(*command, binmode: true)
+      IOStreams.logger&.debug { "IOStreams::Pgp.list_keys: #{command.shelljoin}\n#{err}#{out}" }
       if status.success? && out.length.positive?
         parse_list_output(out)
       else
@@ -156,12 +237,14 @@ module IOStreams
     #     date:       [String]
     #     name:       [String]
     #     email:      [String]
+    #     private:    [true|false]
+    #     trust:      [String]
     def self.key_info(key:)
       version_check
-      command = "#{executable} --batch --no-tty"
+      command = gpg_command("--batch", "--no-tty")
 
-      out, err, status = Open3.capture3(command, binmode: true, stdin_data: key)
-      logger&.debug { "IOStreams::Pgp.key_info: #{command}\n#{err}#{out}" }
+      out, err, status = Open3.capture3(*command, binmode: true, stdin_data: key)
+      IOStreams.logger&.debug { "IOStreams::Pgp.key_info: #{command.shelljoin}\n#{err}#{out}" }
 
       # Try parsing even if we get an error - some versions of GPG return non-zero status but still output key info
       unless (status.success? || err.include?("key ID") || out.include?("pub")) && out.length.positive?
@@ -176,28 +259,43 @@ module IOStreams
       parse_list_output(out)
     end
 
-    # Returns [String] containing all the public keys for the supplied email address.
+    # Returns [String] containing all the public keys for the supplied email address or key id.
+    #
+    # Raises ArgumentError when neither :email nor :key_id is supplied.
+    # Raises Pgp::Failure when `email: nil` is supplied without a :key_id, as before :key_id was added.
+    # In v3.0 this will raise ArgumentError instead.
     #
     # email: [String] Email address for requested key.
     #
+    # key_id: [String] Id for the requested key.
+    #
     # ascii: [true|false]
     #   Whether to export as ASCII text instead of binary format
     #   Default: true
-    def self.export(email:, ascii: true, private: false, passphrase: nil)
+    def self.export(email: (email_omitted = true) && nil, key_id: nil, ascii: true, private: false, passphrase: nil)
+      if email.nil? && key_id.nil?
+        raise(ArgumentError, "Either :email, or :key_id must be supplied") if email_omitted
+
+        raise(Pgp::Failure, "GPG Failed reading key: no email address or key id was supplied")
+      end
+
       version_check
 
-      command = "#{executable} "
-      command << "--pinentry-mode loopback " if pgp_version.to_f >= 2.1
-      command << "--no-symkey-cache " if pgp_version.to_f >= 2.4
-      command << "--armor " if ascii
-      command << "--no-tty  --batch --passphrase"
-      command << (passphrase ? " #{passphrase} " : "-fd 0 ")
-      command << (private ? "--export-secret-keys #{email}" : "--export #{email}")
+      args = []
+      args += ["--pinentry-mode", "loopback"] if pgp_version.to_f >= 2.1
+      args << "--no-symkey-cache" if pgp_version.to_f >= 2.4
+      args << "--armor" if ascii
+      args += ["--no-tty", "--batch"]
+      # Supply the passphrase on stdin so that it is not visible in the process list.
+      args += ["--passphrase-fd", "0"]
+      args << (private ? "--export-secret-keys" : "--export")
+      args += ["--", (email || key_id).to_s]
+      command = gpg_command(*args)
 
-      out, err, status = Open3.capture3(command, binmode: true)
-      logger&.debug { "IOStreams::Pgp.export: #{command}\n#{err}" }
+      out, err, status = Open3.capture3(*command, binmode: true, stdin_data: passphrase.to_s)
+      IOStreams.logger&.debug { "IOStreams::Pgp.export: #{command.shelljoin}\n#{err}" }
 
-      raise(Pgp::Failure, "GPG Failed reading key: #{email}: #{err}") unless status.success? && out.length.positive?
+      raise(Pgp::Failure, "GPG Failed reading key: #{email || key_id}: #{err}") unless status.success? && out.length.positive?
 
       out
     end
@@ -219,10 +317,10 @@ module IOStreams
     # * Invalidated keys must be removed manually.
     def self.import(key:)
       version_check
-      command = "#{executable} --batch --import"
+      command = gpg_command("--batch", "--import")
 
-      out, err, status = Open3.capture3(command, binmode: true, stdin_data: key)
-      logger&.debug { "IOStreams::Pgp.import: #{command}\n#{err}#{out}" }
+      out, err, status = Open3.capture3(*command, binmode: true, stdin_data: key)
+      IOStreams.logger&.debug { "IOStreams::Pgp.import: #{command.shelljoin}\n#{err}#{out}" }
 
       # Handle both old and new versions of GPG
       # For older versions, the output is in err, for newer ones it might be in out
@@ -316,23 +414,74 @@ module IOStreams
       raise(Pgp::Failure, "GPG Failed importing key: #{err}#{out}")
     end
 
-    # Returns [String] email for the supplied after importing and trusting the key
+    # Imports the supplied key and then marks it as trusted at the supplied trust level.
+    #
+    # Returns [String] email for the supplied key, or its key id when no email is present.
+    #
+    # key: [String]
+    #   The public (or private) key to import and trust.
+    #
+    # trust_level: [Integer]
+    #   The owner-trust level to assign to the imported key, the same levels used by `set_trust`:
+    #     1 : Undefined  (no opinion)
+    #     2 : Never      (do not trust)
+    #     3 : Marginal
+    #     4 : Full
+    #     5 : Ultimate
+    #   Default: 5 : Ultimate
+    #
+    # SECURITY WARNING:
+    #   Only import and trust keys received from a verified, trusted source.
+    #   The default trust level is `5` (Ultimate), which tells GPG to treat the imported key
+    #   as if it were one of your own keys. An ultimately trusted key is implicitly valid and
+    #   can in turn confer validity on other keys it has signed. Importing an attacker supplied
+    #   key at this level allows that attacker to impersonate other recipients.
+    #   When the key cannot be fully verified, supply a lower `trust_level`.
     #
     # Notes:
     # - If the same email address has multiple keys then only the first is currently trusted.
-    def self.import_and_trust(key:)
+    def self.import_and_trust(key:, trust_level: 5)
+      info = import_and_trust_key_info(key: key, trust_level: trust_level)
+      info[:email] || info[:key_id]
+    end
+
+    # Imports and trusts the supplied key, see #import_and_trust.
+    #
+    # Returns [String] the recipient to encrypt to: the key's fingerprint when gpg supplies it,
+    # otherwise the email address or key id returned by #import_and_trust.
+    #
+    # Encrypting to the fingerprint ensures that the imported key is used, since gpg looks up an
+    # email address in the keyring, where another key may have the same email address.
+    #
+    # Used internally by the PGP writer.
+    def self.import_and_trust_recipient(key:, trust_level: 5)
+      info   = import_and_trust_key_info(key: key, trust_level: trust_level)
+      key_id = info[:key_id].to_s
+      # gpg v2.1 and later supply the full fingerprint: 40 hex digits for v4 keys, 64 for v5 and v6 keys.
+      # Earlier versions only supply a short key id, which is not unique.
+      return key_id if key_id.match?(/\A(\h{40}|\h{64})\z/)
+
+      info[:email] || info[:key_id]
+    end
+
+    # Returns [Hash] the key info for the supplied key, after importing and trusting it.
+    def self.import_and_trust_key_info(key:, trust_level:)
       raise(ArgumentError, "Key cannot be empty") if key.nil? || (key == "")
 
-      key_info = key_info(key: key).last
+      infos = key_info(key: key)
+      info  = infos.last&.dup || {}
+      # When a key has several user ids, only the entry for its first user id includes the key id.
+      info[:key_id] ||= infos.reverse_each.find { |entry| entry[:key_id] }&.fetch(:key_id)
 
-      email = key_info.fetch(:email, nil)
-      key_id = key_info.fetch(:key_id, nil)
+      email  = info[:email]
+      key_id = info[:key_id]
       raise(ArgumentError, "Recipient email or key id cannot be extracted from supplied key") unless email || key_id
 
       import(key: key)
-      set_trust(email: email, key_id: key_id)
-      email || key_id
+      set_trust(email: email, key_id: key_id, level: trust_level)
+      info
     end
+    private_class_method :import_and_trust_key_info
 
     # Set the trust level for an existing key.
     #
@@ -340,50 +489,75 @@ module IOStreams
     # Returns nil if the email was not found
     #
     # After importing keys, they are not trusted and the relevant trust level must be set.
+    #
+    # key_id: [String]
+    #   The fingerprint of the key, as hexadecimal digits only.
+    #   Raises ArgumentError when it contains any other characters.
+    #
+    # level: [Integer]
+    #   The owner-trust level to assign to the key:
+    #     1 : Undefined  (no opinion)
+    #     2 : Never      (do not trust)
+    #     3 : Marginal
+    #     4 : Full
+    #     5 : Ultimate
     #   Default: 5 : Ultimate
+    #
+    # SECURITY WARNING:
+    #   Only trust keys received from a verified, trusted source.
+    #   The default trust level is `5` (Ultimate), which tells GPG to treat the key
+    #   as if it were one of your own keys. An ultimately trusted key is implicitly valid and
+    #   can in turn confer validity on other keys it has signed. Trusting an attacker supplied
+    #   key at this level allows that attacker to impersonate other recipients.
+    #   When the key cannot be fully verified, supply a lower `level`.
     def self.set_trust(email: nil, key_id: nil, level: 5)
+      # The key_id is written into gpg's ownertrust input, where any other character, such as a newline,
+      # could add trust lines for other keys.
+      if key_id && !key_id.to_s.match?(/\A\h+\z/)
+        raise(ArgumentError, "Invalid :key_id, it must only contain hexadecimal digits: #{key_id.inspect}")
+      end
+
       version_check
       fingerprint = key_id || fingerprint(email: email)
       return unless fingerprint
 
-      command          = "#{executable} --import-ownertrust"
+      command          = gpg_command("--import-ownertrust")
       trust            = "#{fingerprint}:#{level + 1}:\n"
-      out, err, status = Open3.capture3(command, stdin_data: trust)
-      logger&.debug { "IOStreams::Pgp.set_trust: #{command}\n#{err}#{out}" }
+      out, err, status = Open3.capture3(*command, stdin_data: trust)
+      IOStreams.logger&.debug { "IOStreams::Pgp.set_trust: #{command.shelljoin}\n#{err}#{out}" }
 
       raise(Pgp::Failure, "GPG Failed trusting key: #{err} #{out}") unless status.success?
 
       err
     end
 
-    # DEPRECATED - Use key_ids instead of fingerprints
+    # Internal: resolve an email address to a key fingerprint.
+    # Public callers should identify keys by `key_id` (see #list_keys / #key_info).
     def self.fingerprint(email:)
       version_check
-      Open3.popen2e("#{executable} --list-keys --fingerprint --with-colons #{email}") do |_stdin, out, waith_thr|
+      command = gpg_command("--list-keys", "--fingerprint", "--with-colons", "--", email.to_s)
+      Open3.popen2e(*command) do |_stdin, out, waith_thr|
         output = out.read.chomp
-        if !waith_thr.value.success? && !(output !~ /(public key not found|No public key)/i)
+        if !waith_thr.value.success? && output !~ /(public key not found|No public key)/i
           raise(Pgp::Failure, "GPG Failed calling #{executable} to list keys for #{email}: #{output}")
         end
 
         output.each_line do |line|
-          if (match = line.match(/\Afpr.*::([^\:]*):\Z/))
+          if (match = line.match(/\Afpr.*::([^:]*):\Z/))
             return match[1]
           end
         end
         nil
       end
     end
-
-    def self.logger=(logger)
-      @logger = logger
-    end
+    private_class_method :fingerprint
 
     # Returns [String] the version of pgp currently installed
     def self.pgp_version
       @pgp_version ||= begin
-        command          = "#{executable} --version"
-        out, err, status = Open3.capture3(command)
-        logger&.debug { "IOStreams::Pgp.version: #{command}\n#{err}#{out}" }
+        command          = gpg_command("--version")
+        out, err, status = Open3.capture3(*command)
+        IOStreams.logger&.debug { "IOStreams::Pgp.version: #{command.shelljoin}\n#{err}#{out}" }
         if status.success?
           # Sample output
           #   #{executable} (GnuPG) 2.0.30
@@ -413,12 +587,6 @@ module IOStreams
       end
     end
 
-    @logger = nil
-
-    def self.logger
-      @logger
-    end
-
     def self.version_check
       # Previously, this method raised an error for versions >= 2.4
       # Now we support versions up to and including 2.4.7
@@ -497,16 +665,24 @@ module IOStreams
           hash[:trust] = match[2].to_s.strip if match[1]
           results << hash
           hash = {}
-        elsif (match = line.match(/\s+([A-Z0-9]{16,40})/))
+        elsif (match = line.match(/\s+([A-Z0-9]{16,64})/))
           # v2.2/v2.4 key id on separate line:
           # 18A0FC1C09C0D8AE34CE659257DC4AE323C7368C
           # Or shorter format: 7932AB23D7238F6B
+          # Or a 64 digit fingerprint for v5 and v6 keys.
           hash[:key_id] ||= match[1]
         end
       end
       results
     end
 
+    def self.reject_newlines!(**fields)
+      fields.each_pair do |field, value|
+        next if value.nil?
+        raise(ArgumentError, "IOStreams::Pgp.generate_key: :#{field} cannot contain newlines") if value.to_s =~ /[\r\n]/
+      end
+    end
+
     def self.delete_public_or_private_keys(email: nil, key_id: nil, private: false)
       keys = private ? "secret-keys" : "keys"
 
@@ -517,9 +693,9 @@ module IOStreams
         key_id = key_info[:key_id]
         next unless key_id
 
-        command          = "#{executable} --batch --no-tty --yes --delete-#{keys} #{key_id}"
-        out, err, status = Open3.capture3(command, binmode: true)
-        logger&.debug { "IOStreams::Pgp.delete_keys: #{command}\n#{err}#{out}" }
+        command          = gpg_command("--batch", "--no-tty", "--yes", "--delete-#{keys}", "--", key_id)
+        out, err, status = Open3.capture3(*command, binmode: true)
+        IOStreams.logger&.debug { "IOStreams::Pgp.delete_keys: #{command.shelljoin}\n#{err}#{out}" }
 
         unless status.success?
           raise(Pgp::Failure, "GPG Failed calling #{executable} to delete #{keys} for #{email || key_id}: #{err}: #{out}")
@@ -532,18 +708,27 @@ module IOStreams
     def self.delete_public_or_private_keys_v1(email: nil, key_id: nil, private: false)
       keys = private ? "secret-keys" : "keys"
 
-      command = "for i in `#{executable} --list-#{keys} --with-colons --fingerprint #{email || key_id} | grep \"^fpr\" | cut -d: -f10`; do\n"
-      command << "#{executable} --batch --no-tty --yes --delete-#{keys} \"$i\" ;\n"
-      command << "done"
+      # List the fingerprints, then delete each one. Previously this shelled out
+      # to a `for` loop, which allowed shell injection via :email / :key_id.
+      list_command        = gpg_command("--list-#{keys}", "--with-colons", "--fingerprint", "--", (email || key_id).to_s)
+      list_out, list_err, = Open3.capture3(*list_command, binmode: true)
+      IOStreams.logger&.debug { "IOStreams::Pgp.delete_keys: #{list_command.shelljoin}\n#{list_err}: #{list_out}" }
+
+      return false if list_err =~ /(not found|no public key)/i
+
+      fingerprints = list_out.each_line.select { |line| line.start_with?("fpr") }.map { |line| line.split(":")[9] }.compact
+      return false if fingerprints.empty?
 
-      out, err, status = Open3.capture3(command, binmode: true)
-      logger&.debug { "IOStreams::Pgp.delete_keys: #{command}\n#{err}: #{out}" }
+      fingerprints.each do |fingerprint|
+        command          = gpg_command("--batch", "--no-tty", "--yes", "--delete-#{keys}", "--", fingerprint)
+        out, err, status = Open3.capture3(*command, binmode: true)
+        IOStreams.logger&.debug { "IOStreams::Pgp.delete_keys: #{command.shelljoin}\n#{err}: #{out}" }
 
-      return false if err =~ /(not found|no public key)/i
-      unless status.success?
-        raise(Pgp::Failure, "GPG Failed calling #{executable} to delete #{keys} for #{email || key_id}: #{err}: #{out}")
+        unless status.success?
+          raise(Pgp::Failure, "GPG Failed calling #{executable} to delete #{keys} for #{email || key_id}: #{err}: #{out}")
+        end
+        raise(Pgp::Failure, "GPG Failed to delete #{keys} for #{email || key_id} #{err.strip}: #{out}") if out.include?("error")
       end
-      raise(Pgp::Failure, "GPG Failed to delete #{keys} for #{email || key_id} #{err.strip}: #{out}") if out.include?("error")
 
       true
     end

data/lib/io_streams/reader.rb

@@ -1,22 +1,31 @@
 module IOStreams
   class Reader
+    # Returns [Array<Symbol>] the names of the options this reader accepts,
+    # or [nil] when the reader does not declare them.
+    #
+    # When declared, `IOStreams::Builder` rejects any other option before the reader is opened,
+    # naming the direction an option belongs to when it is only valid for the other direction.
+    def self.option_names
+      nil
+    end
+
     # When a Reader does not support streams, we copy the stream to a local temp file
     # and then pass that filename in for this reader.
     def self.stream(input_stream, **args, &block)
-      Utils.temp_file_name("iostreams_reader") do |file_name|
+      Utils.private_temp_file("iostreams_reader") do |file_name|
         ::File.open(file_name, "wb") { |target| ::IO.copy_stream(input_stream, target) }
         file(file_name, **args, &block)
       end
     end
 
     # When a Writer supports streams, also allow it to simply support a file
-    def self.file(file_name, original_file_name: file_name, **args, &block)
-      ::File.open(file_name, "rb") { |file| stream(file, original_file_name: original_file_name, **args, &block) }
+    def self.file(file_name, **args, &block)
+      ::File.open(file_name, "rb") { |file| stream(file, **args, &block) }
     end
 
     # For processing by either a file name or an open IO stream.
-    def self.open(file_name_or_io, **args, &block)
-      file_name_or_io.is_a?(String) ? file(file_name_or_io, **args, &block) : stream(file_name_or_io, **args, &block)
+    def self.open(file_name_or_io, **args, &)
+      file_name_or_io.is_a?(String) ? file(file_name_or_io, **args, &) : stream(file_name_or_io, **args, &)
     end
 
     attr_reader :input_stream