linzer 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c09a63a7eae654921b40e0462b463b3e70867522fcedaf42f03373dd72ef55a5
-  data.tar.gz: b5fea79104954db4289fbf7e4df9f8e589827943cb62eb2836bd0b970611263a
+  metadata.gz: db6a27eef77de787dbb8e481a845c44b2df6c284d98adc01d872fc10bb9f6061
+  data.tar.gz: c500a2ee97f3b9b9ec7717fc9162c9f26d979301dfdcd8aad50298126e9943a3
 SHA512:
-  metadata.gz: 89572382dde42b597eeafecceca1572222cff5d20bba50345b0e3849f47d510cdbcfbc0988295e16b783aa9d28235a95e56b49302a53577e744dc8575253a419
-  data.tar.gz: bc8c2850994c211b4549dcd07d64ddb14fd54d948a05153d8011042eb4cd2b4adca4d8f80ab983a8c8c71deefc2473994fa479ec8b7ec00063dfa86ead7be7a4
+  metadata.gz: 828eabfdd8bb62382eb97b05b9ad7e75a8c8a71bdf082594d73abbf964735bf60fe8e31dcbfcd16e157bf14f369747e71631f54d7b896c7be3a8dfb336a1977f
+  data.tar.gz: 65d6be87fe00af2685a7bed82990d3ffa3fd92f4bd5375d00b34cb7d4756e9dca4beee0871c410b62918236cf4fdfd23f0304f5f51294cd855f9774fe104b1d0

data/.standard.yml

@@ -7,3 +7,4 @@ ignore:
     - Layout/ExtraSpacing
     - Layout/HashAlignment
     - Layout/ArgumentAlignment
+    - Style/EmptyCaseCondition

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 ## [Unreleased]
 
+## [0.6.2] - 2024-12-10
+
+- Remove dependency on ed25519 gem. Pull request
+  [#5](https://github.com/nomadium/linzer/pull/5) by
+  [oneiros](https://github.com/oneiros).
+
+- Run unit tests against Ruby 3.4.
+
+## [0.6.1] - 2024-12-02
+
+- Add more validation checks on HTTP field component identifiers and parameters.
+
+- Relax rack version requirements. Pull request
+  [#4](https://github.com/nomadium/linzer/pull/4) by
+  [oneiros](https://github.com/oneiros).
+
+- Update uri dependency to the latest version. Pull request
+  [#3](https://github.com/nomadium/linzer/pull/3) by
+  [oneiros](https://github.com/oneiros).
+
 ## [0.6.0] - 2024-04-06
 
 - Support parameters on HTTP field component identifiers.

data/README.md

@@ -97,13 +97,10 @@ response = http.post("/some_uri", "data", headers.merge(signature.to_h))
 ### To verify a valid signature:
 
 ```ruby
-test_ed25519_key_pub = Base64.strict_encode64(key.material.verify_key.to_bytes)
-# => "EUra7KsJ8B/lSZJVhDaopMycmZ6T7KtJqKVNJTHKIw0="
+test_ed25519_key_pub = key.material.public_to_pem
+# => "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAK1ZrC4JqC356pRsUiLVJdFZ3dAjo909VfWs1li33MCQ=\n-----END PUBLIC KEY-----\n"
 
-raw_pubkey = Base64.strict_decode64(test_ed25519_key_pub)
-# => "\xB1rM\xFFR\x1F\xDDw\x00\x89\..."
-
-pubkey = Linzer.new_ed25519_public_key(raw_pubkey, "some-key-ed25519")
+pubkey = Linzer.new_ed25519_public_key(test_ed25519_key_pub, "some-key-ed25519")
 # => #<Linzer::Ed25519::Key:0x00000fe19b9384b0
 
 # if you have to, there is a helper method to build a request object on the server side

data/lib/linzer/common.rb

@@ -18,10 +18,29 @@ module Linzer
       if components.include?("@signature-params")
         raise Error.new "Invalid component in signature input"
       end
+
       msg = "Cannot verify signature. Missing component in message: %s"
-      components.each { |c| raise Error.new msg % "\"#{c}\"" unless message.field?(c)  }
+      components.each do |c|
+        raise Error.new msg % "\"#{c}\"" unless message.field?(c)
+      end
+
+      validate_uniqueness components
+    end
+
+    def validate_uniqueness(components)
       msg = "Invalid signature. Duplicated component in signature input."
-      raise Error.new msg if components.size != components.uniq.size
+
+      uniq_components =
+        components
+          .partition { |c| c.start_with?("@") }
+          .flat_map
+          .with_index do |group, idx|
+            group
+              .map  { |comp| Starry.parse_item(idx.zero? ? comp[1..] : comp) }
+              .uniq { |comp| [comp.value, comp.parameters] }
+          end
+
+      raise Error.new msg if components.count != uniq_components.count
     end
   end
 end

data/lib/linzer/ed25519.rb

@@ -1,19 +1,14 @@
 # frozen_string_literal: true
 
-require "ed25519"
-
 module Linzer
   module Ed25519
     class Key < Linzer::Key
       def sign(data)
-        material.sign(data)
+        material.sign(nil, data)
       end
 
       def verify(signature, data)
-        verify_key = material.is_a?(::Ed25519::SigningKey) ? material.verify_key : material
-        verify_key.verify(signature, data)
-      rescue ::Ed25519::VerifyError
-        false
+        material.verify(nil, signature, data)
       end
     end
   end

data/lib/linzer/key/helper.rb

@@ -33,18 +33,17 @@ module Linzer
       end
 
       def generate_ed25519_key(key_id = nil)
-        material = ::Ed25519::SigningKey.generate
+        material = OpenSSL::PKey.generate_key("ed25519")
         Linzer::Ed25519::Key.new(material, id: key_id)
       end
 
       def new_ed25519_key(material, key_id = nil)
-        key = ::Ed25519::SigningKey.new(material)
+        key = OpenSSL::PKey.read(material)
         Linzer::Ed25519::Key.new(key, id: key_id)
       end
 
       def new_ed25519_public_key(material, key_id = nil)
-        key = ::Ed25519::VerifyKey.new(material)
-        Linzer::Ed25519::Key.new(key, id: key_id)
+        new_ed25519_key(material, key_id)
       end
 
       # https://www.rfc-editor.org/rfc/rfc4492.html#appendix-A

data/lib/linzer/message.rb

@@ -47,7 +47,6 @@ module Linzer
       return nil if name.nil?
 
       if field_name.start_with?("@")
-        return nil if name.parameters["tr"]
         retrieve(name, :derived)
       else
         retrieve(name, :field)
@@ -79,13 +78,48 @@ module Linzer
       nil
     end
 
+    def validate_parameters(name, method)
+      has_unknown = name.parameters.any? { |p, _| !KNOWN_PARAMETERS.include?(p) }
+      return nil if has_unknown
+
+      has_name = name.parameters["name"]
+      has_req  = name.parameters["req"]
+      has_sf   = name.parameters["sf"] || name.parameters.key?("key")
+      has_bs   = name.parameters["bs"]
+      value    = name.value
+
+      # Section 2.2.8 of RFC 9421
+      return nil if has_name && value != :"query-param"
+
+      # No derived values come from trailers section
+      return nil if method == :derived && name.parameters["tr"]
+
+      # From: 2.1. HTTP Fields:
+      # The bs parameter, which requires the raw bytes of the field values
+      # from the message, is not compatible with the use of the sf or key
+      # parameters, which require the parsed data structures of the field
+      # values after combination
+      return nil if has_sf && has_bs
+
+      # req param only makes sense on responses with an associated request
+      return nil if has_req && (!response? || !attached_request?)
+
+      name
+    end
+
+    KNOWN_PARAMETERS = %w[sf key bs req tr name]
+    private_constant :KNOWN_PARAMETERS
+
     def retrieve(name, method)
+      if !name.parameters.empty?
+        valid_params = validate_parameters(name, method)
+        return nil if !valid_params
+      end
+
       has_req = name.parameters["req"]
       has_sf  = name.parameters["sf"] || name.parameters.key?("key")
       has_bs  = name.parameters["bs"]
 
-      return nil if has_req && (!response? || !attached_request?)
-
       if has_req
         name.parameters.delete("req")
         return req(name, method)
@@ -93,10 +127,13 @@ module Linzer
 
       value = send(method, name)
 
-      key = name.parameters["key"]
-      value = sf(value, key) if has_sf
-      value = bs(value)      if has_bs
-      value
+      case
+      when has_sf
+        key = name.parameters["key"]
+        sf(value, key)
+      when has_bs then bs(value)
+      else value
+      end
     end
 
     def derived(name)
@@ -128,7 +165,8 @@ module Linzer
     def derive(operation, method)
       return nil unless operation.respond_to?(method)
       value = operation.public_send(method)
-      return "?" + value if method == :query_string
+      return "?" + value    if method == :query_string
+      return value.downcase if %i[authority scheme].include?(method)
       value
     end
 
@@ -144,10 +182,12 @@ module Linzer
     def sf(value, key = nil)
       dict = Starry.parse_dictionary(value)
 
-      obj = dict[key] if key
-      return Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj) if key
-
-      Starry.serialize(dict)
+      if key
+        obj = dict[key]
+        Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj)
+      else
+        Starry.serialize(dict)
+      end
     end
 
     def bs(value)

data/lib/linzer/request.rb

@@ -11,7 +11,8 @@ module Linzer
       request_method = Rack.const_get(verb.upcase)
       args = {
         "REQUEST_METHOD" => request_method,
-        "PATH_INFO"      => uri.to_str
+        "PATH_INFO"      => uri.to_str,
+        "rack.input"     => StringIO.new
       }
 
       Rack::Request.new(build_rack_env(headers).merge(args))

data/lib/linzer/version.rb

@@ -1,9 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.6.0"
-
-  def self.ruby_dev?
-    RUBY_ENGINE == "ruby" && RUBY_PATCHLEVEL == -1 && /\Aruby 3.[0-9].0dev/ =~ RUBY_DESCRIPTION
-  end
+  VERSION = "0.6.2"
 end

data/lib/linzer.rb

@@ -4,6 +4,7 @@ require "starry"
 require "openssl"
 require "rack"
 require "uri"
+require "stringio"
 
 require_relative "linzer/version"
 require_relative "linzer/common"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Miguel Landaeta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-04-06 00:00:00.000000000 Z
+date: 2024-12-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl
@@ -31,73 +31,79 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 3.0.0
 - !ruby/object:Gem::Dependency
-  name: ed25519
+  name: starry
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '0.2'
 - !ruby/object:Gem::Dependency
-  name: starry
+  name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.2'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
-  name: rack
+  name: uri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '1.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.2
 - !ruby/object:Gem::Dependency
-  name: uri
+  name: stringio
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.12'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 3.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.12'
+        version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 3.1.2
 description:
 email:
 - miguel@miguel.cc
@@ -127,7 +133,6 @@ files:
 - lib/linzer/signer.rb
 - lib/linzer/verifier.rb
 - lib/linzer/version.rb
-- linzer.gemspec
 homepage: https://github.com/nomadium/linzer
 licenses:
 - MIT

data/linzer.gemspec

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/linzer/version"
-
-Gem::Specification.new do |spec|
-  spec.name = "linzer"
-  spec.version = Linzer::VERSION
-  spec.authors = ["Miguel Landaeta"]
-  spec.email = %w[miguel@miguel.cc]
-
-  spec.summary = "An implementation of HTTP Messages Signatures (RFC9421)"
-  spec.homepage = "https://github.com/nomadium/linzer"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 2.6.0"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = spec.homepage
-  spec.metadata["changelog_uri"] = spec.homepage + "/blob/master/CHANGELOG.md"
-
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(__dir__) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
-    end
-  end
-  spec.bindir = "exe"
-  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-
-  spec.add_runtime_dependency "openssl", "~> 3.0", ">= 3.0.0"
-  spec.add_runtime_dependency "ed25519", "~> 1.3", ">= 1.3.0"
-  spec.add_runtime_dependency "starry", "~> 0.1" unless Linzer.ruby_dev?
-  spec.add_runtime_dependency "rack", "~> 3.0"
-  spec.add_runtime_dependency "uri", "~> 0.12", ">= 0.12.0"
-end