mini_ca 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 017ba2353e7b1f0cfc7770644189710f4b665dff
-  data.tar.gz: fb8b2ec2b5a20d6f6b64e48be6894bd3308bec73
+SHA256:
+  metadata.gz: c0a7b335aa18a3821666a730ff8ec7e96566ca3983cfd97472b6e60a97616439
+  data.tar.gz: 2db259057e86a83cd2130e8755b29a5e9f8b4c371385d9f330d05f0072a04152
 SHA512:
-  metadata.gz: 349e601091f44f72f7674bde29fd5a362bd53bf1e7768be38203f10125b9851860a65d7d61bb781ccd91c659da044f83e7e336d01c580265f08f1170da9cd321
-  data.tar.gz: a498bcf442c489c9a05ab1830035e14fea8a8efc0eaea19c9f8b6cbab2b0f3b6f22b334ea66ae0a682a503b80e123992bc6a8c9418f89a8e1903ce7ba492d455
+  metadata.gz: 31eff1fc63d9b3a9c715ec7e7905e6b47ec46e6ecae04f51984b83e2f238c2dd6cefee8e76dec354cca03be7bf1a75b5ae4983f098f4ccbef8b33a72900aee33
+  data.tar.gz: 7b64427cca931bb7c303de32a3e74e92b343c4c58bfa7d0b61115d092d88a0e3efa6d784ce24e0c26d63f3a29f08d1d7252433c67d42050e9bce8a1cb8df78ea

data/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+*   @aguilinger
+*   @neurosnap

data/.github/workflows/test.yml

@@ -0,0 +1,47 @@
+name: Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+      - master
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        RUBY_VERSION: ["2.6", "3.3"]
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Install Ruby ${{ matrix.RUBY_VERSION }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.RUBY_VERSION }}
+          bundler-cache: true
+
+      - name: Run Tests
+        run: bundle exec rake
+
+  results:
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    name: Final Results
+    needs: [test]
+    steps:
+      - run: exit 1
+        # see https://stackoverflow.com/a/67532120/4907315
+        if: >-
+          ${{
+               contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+          }}

data/README.md

@@ -1,7 +1,6 @@
 # ![](https://raw.github.com/aptible/straptible/master/lib/straptible/rails/templates/public.api/icon-60px.png) MiniCa
 
 [![Gem Version](https://badge.fury.io/rb/mini_ca.png)](https://rubygems.org/gems/mini_ca)
-[![Build Status](https://travis-ci.org/aptible/mini_ca.png?branch=master)](https://travis-ci.org/aptible/mini_ca)
 [![Dependency Status](https://gemnasium.com/aptible/mini_ca.png)](https://gemnasium.com/aptible/mini_ca)
 
 A Gem to generate custom X509 certificates in specs.
@@ -49,4 +48,4 @@ See the specs for more examples.
 
 MIT License, see [LICENSE](LICENSE.md) for details.
 
-Copyright (c) 2017 [Aptible](https://www.aptible.com), Thomas Orozco, and contributors.
+Copyright (c) 2019 [Aptible](https://www.aptible.com), Thomas Orozco, and contributors.

data/SECURITY.md

@@ -0,0 +1,23 @@
+# Aptible Open Source Security Policies and Procedures
+
+This document outlines security procedures and general policies for the Aptible open source projects as found on https://github.com/aptible.
+
+  * [Reporting a Vulnerability](#reporting-a-vulnerability)
+  * [Responsible Disclosure Policy](#responsible-disclosure-policy)
+
+## Reporting a Vulnerability 
+
+The Aptible team and community take all security vulnerabilities
+seriously. Thank you for improving the security of our open source software. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.
+
+Report security vulnerabilities by emailing the Aptible security team at:
+    
+    security@aptible.com
+
+Security researchers can also privately report security vulnerabilities to repository maintainers using the GitHub "Report a Vulnerability" feature. [See how-to here](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability).
+
+The Aptible team will acknowledge your email within 24 business hours and send a detailed response within 48 business hours indicating the next steps in handling your report. The Aptible security team will keep you informed of the progress and may ask for additional information or guidance.
+
+## Responsible Disclosure Policy
+
+Please see Aptible's Responsible Disclosure Policy here: https://www.aptible.com/legal/responsible-disclosure/

data/lib/mini_ca/certificate.rb

@@ -40,6 +40,7 @@ module MiniCa
         ['O', organization]
       ].each do |prop, value|
         next if value.nil?
+
         x509.subject = x509.subject.add_entry(prop, value)
       end
 
@@ -53,9 +54,7 @@ module MiniCa
           raise Error, 'Certificate cannot become valid before issuer'
         end
 
-        if issuer.x509.not_after < not_after
-          raise Error, 'Certificate cannot expire after issuer'
-        end
+        raise Error, 'Certificate cannot expire after issuer' if issuer.x509.not_after < not_after
       else
         not_before ||= Time.now - 3600 * 24
         not_after ||= Time.now + 3600 + 24
@@ -89,12 +88,14 @@ module MiniCa
 
     def issue(cn, **opts)
       raise 'CA must be set to use #issue' unless ca
+
       @counter += 1
       Certificate.new(cn, issuer: self, serial: @counter, **opts)
     end
 
     def store
       raise 'CA must be set to use #store' unless ca
+
       OpenSSL::X509::Store.new.tap { |store| store.add_cert(x509) }
     end
 
@@ -132,11 +133,16 @@ module MiniCa
       when OpenSSL::PKey::RSA
         private_key.public_key
       when OpenSSL::PKey::EC
+        # In the olden days, we created a new public key:
         # See: https://github.com/ruby/openssl/issues/29#issuecomment-230664793
         # See: https://alexpeattie.com/blog/signing-a-csr-with-ecdsa-in-ruby
-        pub = OpenSSL::PKey::EC.new(private_key.group)
-        pub.public_key = private_key.public_key
-        pub
+        # pub = OpenSSL::PKey::EC.new(private_key.group)
+        # pub.public_key = private_key.public_key
+        # pub
+
+        #  But now, public keys are immutable in OpenSSL 3 and ruby > 3.1.2, so we have to
+        # accept that EC public keys kinda don't really exist, and just use the private key
+        private_key
       else
         raise Error, "Unsupported private_key: #{private_key.class}"
       end

data/lib/mini_ca/version.rb

@@ -1,3 +1,3 @@
 module MiniCa
-  VERSION = '1.2.0'.freeze
+  VERSION = '1.2.1'.freeze
 end

data/mini_ca.gemspec

@@ -1,4 +1,5 @@
 # encoding: utf-8
+
 lib = File.expand_path('../lib', __FILE__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
@@ -19,8 +20,9 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^spec/})
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'aptible-tasks'
+  spec.add_development_dependency 'base64'
+  spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake'
   spec.add_development_dependency 'rspec'
 end

data/spec/mini_ca/certificate_spec.rb

@@ -62,15 +62,7 @@ describe MiniCa::Certificate do
     end
 
     it 'initializes with a custom private_key (ECDSA)' do
-      k = OpenSSL::PKey::EC.new('prime256v1').tap(&:generate_key)
-
-      # Ruby < 2.4 lacks a #private? method on EC keys, which is used when
-      # signing. We're not going to monkey-patch this for users, but we want to
-      # monkey patch it for our own specs.
-      maj, min, = RUBY_VERSION.split('.').map { |e| Integer(e) }
-      unless maj >= 2 && min >= 4 || maj > 2
-        allow(k).to receive(:private?) { k.private_key? }
-      end
+      k = OpenSSL::PKey::EC.generate('prime256v1')
 
       crt = described_class.new('x', private_key: k)
       expect(crt.private_key_pem).to eq(k.to_pem)

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: mini_ca
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Thomas Orozco
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2017-12-05 00:00:00.000000000 Z
+date: 2025-03-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: bundler
+  name: aptible-tasks
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -25,7 +25,21 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: aptible-tasks
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -73,13 +87,15 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/CODEOWNERS"
+- ".github/workflows/test.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
 - Gemfile
 - LICENSE.md
 - README.md
 - Rakefile
+- SECURITY.md
 - lib/mini_ca.rb
 - lib/mini_ca/certificate.rb
 - lib/mini_ca/error.rb
@@ -91,7 +107,7 @@ homepage: https://github.com/aptible/mini_ca
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -106,9 +122,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.13
-signing_key: 
+rubygems_version: 3.5.3
+signing_key:
 specification_version: 4
 summary: A minimal Certification Authority, for use in specs
 test_files:

data/.travis.yml

@@ -1,12 +0,0 @@
-sudo: false
-
-cache: bundler
-
-before_install:
-  gem update bundler
-
-rvm:
-  - 2.0.0
-  - 2.1.0
-  - 2.2.0
-  - 2.3.0