oauth 1.1.6 → 1.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 519d2a63b05220f02dadb8fcb8ba9cb20ce54f03c617b2a74e46781b9c0b843c
-  data.tar.gz: 8a89f0260d3b91eff46f969208d4baafd3122f86fea184c8380c72d0f8aed5bd
+  metadata.gz: '049b3cc622c727ab699b2fe1d325fb64e2eac1da325de4de3104b609b1f2af26'
+  data.tar.gz: a0629ae8e147e97726b533d333946c1a22f05a43518e34e3147cdb3d89bb8e73
 SHA512:
-  metadata.gz: 37c222e2be4fe2e4bac7615d794abf35a0f9750ab447b40654fab78b47f539c8a0bb4df17b520e90a8f998b3ea9dcda1ad6f0da97a123335f38d28fb94b17a7d
-  data.tar.gz: 98725428c6aab7b988766e9f4c65e6b6bb78ce0079c07ab5c65e8c1f65ebdeb11488cccfe94f31f78d6b77a164b60b20ea94dfc8b755b67261af4de04ed09772
+  metadata.gz: f3c2401902c07850afc55c5e7c086d1fcc7a5edf3a15cb35dd54608d34388ab6ca59676be336cfa1f54e16daa30c8871a7286ba8ec725f949f40b692c4c3ddc4
+  data.tar.gz: 2346c3719c798384de750aa1927c917a5a0c5eb22330515d73d8a16788015b49d7aaa6106c80bf8857c70a19df7a6e09ba967b5165031f3151056eeb171495e5

data/CHANGELOG.md

@@ -30,6 +30,47 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.1.7] - 2026-06-15
+
+- TAG: [v1.1.7][1.1.7t]
+- COVERAGE: 88.32% -- 839/950 lines in 33 files
+- BRANCH COVERAGE: 58.67% -- 159/271 branches in 33 files
+- 40.38% documented
+
+### Changed
+
+- Retemplated repository metadata, workflows, modular gemfiles, documentation
+  scaffolding, `version_gem` >= 1.1.12, and templating-isolated local workspace
+  Gemfile wiring with the current `kettle-jem` template.
+- Raised the `auth-sanitizer` runtime dependency floor to `>= 0.2.1`, so OAuth
+  consumers get hash and nested-attribute inspect redaction fixes plus
+  downstream RBS duplicate-declaration fixes.
+
+- Raised the `oauth-tty` runtime dependency floor to `>= 1.0.9`.
+
+- Raised the `oauth-tty` runtime dependency floor to `>= 1.0.10`, removing
+  the transitive external `cgi` runtime dependency for Ruby 2.4 consumers.
+
+### Fixed
+
+- Restored `docs/CNAME` so the generated documentation site keeps its custom domain.
+
+- Pinned older Ruby appraisals to Rack 2.2 so `rack-test` remains compatible
+  with the Ruby 2.4, Ruby 2.5, and JRuby 9.2 CI jobs.
+- Derived an RSA public key from PEM private-key strings before signature
+  verification, matching JRuby OpenSSL behavior while preserving RSA-SHA1
+  verification semantics.
+
+- Removed the external `cgi` runtime dependency because the only `cgi` gem
+  releases installable on Ruby 2.4 call `String#delete_prefix`, which is
+  unavailable on Ruby 2.4.
+- Removed the external `erb` dependency from the Ruby 2.4 appraisal because
+  Ruby 2.4 already provides ERB and the released `erb` gem depends on external
+  `cgi`.
+- Added a private-key-backed RSA-SHA1 verification fallback for JRuby OpenSSL
+  versions that raise `OpenSSL::PKey::PKeyError` during public-key
+  verification.
+
 ## [1.1.6] - 2026-06-07
 
 - TAG: [v1.1.6][1.1.6t]
@@ -786,7 +827,9 @@ All together now release
 - Moved all non-Rails functionality from the Rails plugin:
   http://code.google.com/p/oauth-plugin/
 
-[Unreleased]: https://github.com/ruby-oauth/oauth/compare/v1.1.6...HEAD
+[Unreleased]: https://github.com/ruby-oauth/oauth/compare/v1.1.7...HEAD
+[1.1.7]: https://github.com/ruby-oauth/oauth/compare/v1.1.6...v1.1.7
+[1.1.7t]: https://github.com/ruby-oauth/oauth/releases/tag/v1.1.7
 [1.1.6]: https://github.com/ruby-oauth/oauth/compare/v1.1.5...v1.1.6
 [1.1.6t]: https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
 [1.1.5]: https://github.com/ruby-oauth/oauth/compare/v1.1.4...v1.1.5

data/CONTRIBUTING.md

@@ -109,14 +109,14 @@ Git diff driver setup
 - Git hosting forges generally ignore external diff drivers, so pull request views may still show raw textual diffs even when local `git diff` uses semantic drivers.
 
 ```console
-K_JEM_TEMPLATING=true bundle exec kettle-jem install
+K_JEM_TEMPLATING=true kettle-jem install
 ```
 
 Troubleshooting Git diffs
 - Use `git diff --no-ext-diff` to compare against Git's built-in diff output.
 - Use `git diff --no-textconv` when a textconv projection obscures the raw file bytes you need to inspect.
 - If Git reports a missing `smorg-*` executable, rerun `bundle install` and the setup command above, then check `git config --local --get-regexp '^diff\.smorg-'`.
-- To remove managed local entries, run `K_JEM_TEMPLATING=true bundle exec kettle-jem install --undo`; remove global command registrations with `git config --global --unset-all diff.smorg-ruby.command`.
+- To remove managed local entries, run `K_JEM_TEMPLATING=true kettle-jem install --undo`; remove global command registrations with `git config --global --unset-all diff.smorg-ruby.command`.
 
 For a quick starting point, this repository’s `mise.toml` defines the shared defaults, and `.env.local` can override them locally. Copy `.env.local.example` to `.env.local`, use `KEY=value` lines, and either activate `mise` in your shell or run commands through `mise exec -C /path/to/project -- ...`.
 

data/README.md

@@ -1,6 +1,6 @@
 <a href="https://github.com/ruby-oauth"><img alt="ruby-oauth Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/ruby-oauth/avatar-128px.svg" width="14%" align="right"/></a>
 
-# 🔑 OAuth
+# 🔮 OAuth
 
 [![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license] [![Downloads Rank][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
 
@@ -684,7 +684,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.941-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.950-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/ruby-oauth/oauth/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
@@ -692,7 +692,7 @@ Thanks for RTFM. ☺️
 [📄license-ref]: MIT.md
 [📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
 [📄license-compat]: https://www.apache.org/legal/resolved.html#category-a
-[📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-✓-259D6C.svg?style=flat&logo=Apache
+[📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&logo=Apache
 
 [📄ilo-declaration]: https://www.ilo.org/declaration/lang--en/index.htm
 [📄ilo-declaration-img]: https://img.shields.io/badge/ILO_Fundamental_Principles-✓-259D6C.svg?style=flat
@@ -710,9 +710,9 @@ Thanks for RTFM. ☺️
 | Field | Value |
 |---|---|
 | Package | oauth |
-| Description | 🔑 A Ruby wrapper for the original OAuth 1.0 / 1.0a spec. |
+| Description | 🔮 A Ruby wrapper for the original OAuth 1.0 / 1.0a spec. |
 | Homepage | https://github.com/ruby-oauth/oauth |
-| Source | https://github.com/ruby-oauth/oauth/tree/v1.1.5 |
+| Source | https://github.com/ruby-oauth/oauth/tree/v1.1.6 |
 | License | `MIT` |
 | Funding | https://github.com/sponsors/pboling, https://issuehunt.io/u/pboling, https://ko-fi.com/pboling, https://liberapay.com/pboling/donate, https://opencollective.com/ruby-oauth, https://patreon.com/galtzo, https://polar.sh/pboling, https://thanks.dev/u/gh/pboling, https://tidelift.com/funding/github/rubygems/oauth, https://www.buymeacoffee.com/pboling |
 <!-- kettle-jem:metadata:end -->

data/lib/oauth/signature/rsa/sha1.rb

@@ -11,6 +11,11 @@ module OAuth
         def ==(other)
           decoded = Base64.decode64(other.is_a?(Array) ? other.first : other)
           public_key.verify(OpenSSL::Digest.new("SHA1"), decoded, signature_base_string)
+        rescue OpenSSL::PKey::PKeyError
+          private_key = private_key_from_consumer_secret
+          raise unless private_key
+
+          private_key.sign(OpenSSL::Digest.new("SHA1"), signature_base_string) == decoded
         end
 
         def public_key
@@ -19,6 +24,8 @@ module OAuth
             decode_public_key
           when OpenSSL::X509::Certificate
             consumer_secret.public_key
+          when OpenSSL::PKey::RSA
+            consumer_secret.public_key
           else
             consumer_secret
           end
@@ -29,7 +36,7 @@ module OAuth
           data = request.body || ""
           begin
             digest_bytes = OpenSSL::Digest.digest("SHA1", data)
-          rescue StandardError
+          rescue
             digest_bytes = ::Digest::SHA1.digest(data)
           end
           Base64.encode64(digest_bytes).chomp.delete("\n")
@@ -42,7 +49,18 @@ module OAuth
           when /-----BEGIN CERTIFICATE-----/
             OpenSSL::X509::Certificate.new(consumer_secret).public_key
           else
+            OpenSSL::PKey::RSA.new(consumer_secret).public_key
+          end
+        end
+
+        def private_key_from_consumer_secret
+          case consumer_secret
+          when String
+            return nil if consumer_secret =~ /-----BEGIN CERTIFICATE-----/
+
             OpenSSL::PKey::RSA.new(consumer_secret)
+          when OpenSSL::PKey::RSA
+            consumer_secret
           end
         end
 
@@ -54,7 +72,7 @@ module OAuth
               options[:private_key]
             else
               consumer_secret
-            end,
+            end
           )
 
           private_key.sign(OpenSSL::Digest.new("SHA1"), signature_base_string)

data/lib/oauth/version.rb

@@ -2,7 +2,7 @@
 
 module OAuth
   module Version
-    VERSION = "1.1.6"
+    VERSION = "1.1.7"
   end
   VERSION = Version::VERSION # Traditional Constant Location
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oauth
 version: !ruby/object:Gem::Version
-  version: 1.1.6
+  version: 1.1.7
 platform: ruby
 authors:
 - Pelle Braendgaard
@@ -79,20 +79,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.1'
-- !ruby/object:Gem::Dependency
-  name: cgi
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: oauth-tty
   requirement: !ruby/object:Gem::Requirement
@@ -102,7 +88,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.8
+        version: 1.0.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -112,7 +98,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.8
+        version: 1.0.10
 - !ruby/object:Gem::Dependency
   name: snaky_hash
   requirement: !ruby/object:Gem::Requirement
@@ -142,7 +128,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.11
+        version: 1.1.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -152,27 +138,27 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.11
+        version: 1.1.12
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.1
+        version: 2.2.9
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.1
+        version: 2.2.9
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -230,7 +216,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: 3.1.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -240,7 +226,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: 3.1.2
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -250,7 +236,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: 2.0.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -260,7 +246,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.3
+        version: 2.0.5
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
@@ -270,7 +256,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: 3.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -280,7 +266,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.1
+        version: 3.1.3
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -324,7 +310,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.1
+        version: 2.0.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -334,7 +320,27 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.1
+        version: 2.0.2
+- !ruby/object:Gem::Dependency
+  name: backports
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.25.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.25'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.25.1
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
@@ -405,26 +411,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.1.13
-- !ruby/object:Gem::Dependency
-  name: backports
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.25'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.25.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.25'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 3.25.1
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -453,10 +439,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3'
-description: "\U0001F511 A Ruby wrapper for the original OAuth 1.0 / 1.0a spec."
+description: "\U0001F52E A Ruby wrapper for the original OAuth 1.0 / 1.0a spec."
 email:
 - floss@galtzo.com
-- oauth-ruby@googlegroups.com
 executables: []
 extensions: []
 extra_rdoc_files:
@@ -530,11 +515,11 @@ homepage: https://github.com/ruby-oauth/oauth
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://oauth.galtzo.com
-  source_code_uri: https://github.com/ruby-oauth/oauth/tree/v1.1.6
-  changelog_uri: https://github.com/ruby-oauth/oauth/blob/v1.1.6/CHANGELOG.md
+  homepage_uri: https://structuredmerge.org
+  source_code_uri: https://github.com/ruby-oauth/oauth/tree/v1.1.7
+  changelog_uri: https://github.com/ruby-oauth/oauth/blob/v1.1.7/CHANGELOG.md
   bug_tracker_uri: https://github.com/ruby-oauth/oauth/issues
-  documentation_uri: https://www.rubydoc.info/gems/oauth/1.1.6
+  documentation_uri: https://www.rubydoc.info/gems/oauth/1.1.7
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/ruby-oauth/oauth/wiki
   news_uri: https://www.railsbling.com/tags/oauth
@@ -542,7 +527,7 @@ metadata:
   rubygems_mfa_required: 'true'
 rdoc_options:
 - "--title"
-- "oauth - \U0001F511 OAuth 1.0 / 1.0a Core Ruby implementation"
+- "oauth - \U0001F52E OAuth 1.0 / 1.0a Core Ruby implementation"
 - "--main"
 - README.md
 - "--exclude"
@@ -565,5 +550,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 4.0.10
 specification_version: 4
-summary: "\U0001F511 OAuth 1.0 / 1.0a Core Ruby implementation"
+summary: "\U0001F52E OAuth 1.0 / 1.0a Core Ruby implementation"
 test_files: []