oidc-test-trusted_publisher 0.8.12 → 0.8.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6d5e8eee0c9142ddd08bdcf26bf4de221eee9dc2ab9f95f0e48f9ba7e2a5987
-  data.tar.gz: bcb135a9e17fc25fc1f38ff8573a4fc1cda457290ecdab6671458fef8fed5d27
+  metadata.gz: e7b86a5a4b62f2e5624af0376ad83838927a87e9d01b72688a6806135dfd8d90
+  data.tar.gz: a945108b1771070c297c54e9db024bf407b00cb4bcb7a94f5f1e95e7e8081344
 SHA512:
-  metadata.gz: 8053e1f807129eaafdc9b936160d4aed2db9a6459f830334e0dbcad90735ee168b6a9d4708a11dc3493bea73881fa0d5d7824933af9b60ce99ccff83a6af0fd1
-  data.tar.gz: eaccd42042d2118cda9ab96f2e86ac377de30c5f531d27b209d1ce738dc5d30a2fc26c1127ecffaed68ff34f699584aac4f95007ea2cad125b6b749a686764ec
+  metadata.gz: 15991449d707eb6fed9e261b7ab8410d39dad5c300d87ff6e1c63c10194f21e5e4329d625b5a271cbade394f7353e310da70216fe89f670b85a13ba5002442d1
+  data.tar.gz: fd4deb1271855cbea300ba4b1957520cf9bf4323ae832d9c15eabd9b1d87f5f4c1d382150f1f5bb40f2dc9293e91f53e9ef2f4aa456d82745acf62b0bf4cac76

data/Gemfile

@@ -5,12 +5,7 @@ source "https://rubygems.org"
 # Specify your gem's dependencies in oidc-test.gemspec
 gemspec
 
+gem "racc"
 gem "rake", "~> 13.0"
-
 gem "rspec", "~> 3.0"
-
 gem "rubocop", "~> 1.21"
-
-gem "racc"
-
-gem "sigstore", "~> 0.1.1"

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    oidc-test (0.8.12)
+    oidc-test (0.8.13)
 
 GEM
   remote: https://rubygems.org/
@@ -9,21 +9,9 @@ GEM
     ast (2.4.2)
     diff-lcs (1.5.0)
     json (2.6.3)
-    net-http (0.5.0)
-      uri
     parallel (1.22.1)
     parser (3.2.2.0)
       ast (~> 2.4.1)
-    protobug (0.1.0)
-    protobug_googleapis_field_behavior_protos (0.1.0)
-      protobug (= 0.1.0)
-      protobug_well_known_protos (= 0.1.0)
-    protobug_sigstore_protos (0.1.0)
-      protobug (= 0.1.0)
-      protobug_googleapis_field_behavior_protos (= 0.1.0)
-      protobug_well_known_protos (= 0.1.0)
-    protobug_well_known_protos (0.1.0)
-      protobug (= 0.1.0)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.0.6)
@@ -55,12 +43,7 @@ GEM
     rubocop-ast (1.28.0)
       parser (>= 3.2.1.0)
     ruby-progressbar (1.13.0)
-    sigstore (0.1.1)
-      net-http
-      protobug_sigstore_protos (~> 0.1.0)
-      uri
     unicode-display_width (2.4.2)
-    uri (1.0.2)
 
 PLATFORMS
   ruby
@@ -71,7 +54,6 @@ DEPENDENCIES
   rake (~> 13.0)
   rspec (~> 3.0)
   rubocop (~> 1.21)
-  sigstore (~> 0.1.1)
 
 BUNDLED WITH
    2.5.10

data/Rakefile

@@ -1,66 +1,5 @@
 # frozen_string_literal: true
 
-require "bundler/gem_helper"
-
-module Bundler
-  class GemHelper
-    prepend(Module.new do
-      def install
-        super
-
-        task "release:attest" => "build" do
-          Bundler.ui.confirm "Attesting? #{attest?}"
-          attest if attest?
-        end
-
-        task "release:rubygem_push" => "release:attest"
-      end
-
-      def build_gem
-        @build_gem_path = super
-      end
-
-      def rubygem_push(path)
-        return super unless attest?
-
-        cmd = [{ "RUBYOPT" => "-r#{File.expand_path("tasks/rubygems_patch.rb", __dir__)} #{ENV["RUBYOPT"]}",
-                 "gem_attestation_path" => "#{path}.sigstore.json" }, *gem_command, "push", path]
-        cmd << "--key" << gem_key if gem_key
-        cmd << "--host" << allowed_push_host if allowed_push_host
-        sh_with_input(cmd)
-        Bundler.ui.confirm "Pushed #{name} #{version} to #{gem_push_host}"
-      end
-    end)
-
-    def attest?
-      return true if %w[y yes true on 1].include?(ENV["gem_attest"])
-      return false if %w[n no nil false off 0].include?(ENV["gem_attest"])
-
-      ENV["ACTIONS_ID_TOKEN_REQUEST_URL"] && ENV["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]
-    end
-
-    def attest
-      Bundler.ui.confirm "Signing #{@build_gem_path}..."
-      sh [Gem.ruby, "-S", "gem", "install", "sigstore"]
-      sh [Gem.ruby, "-rnet/http", "-rsigstore", "-rsigstore/signer", "-e", <<~RUBY, @build_gem_path]
-        file = ARGV.first
-        jwt = Net::HTTP.get_response(
-          URI(ENV.fetch("ACTIONS_ID_TOKEN_REQUEST_URL") + "&audience=sigstore"),
-          { "Authorization" => "bearer \#{ENV.fetch("ACTIONS_ID_TOKEN_REQUEST_TOKEN")}" },
-          &:value
-        ).body.then { JSON.parse(_1).fetch("value") }
-
-        contents = File.binread(file)
-        bundle = Sigstore::Signer.new(jwt:, trusted_root: Sigstore::TrustedRoot.production).sign(contents)
-
-        json = "\#{file}.sigstore.json"
-        File.binwrite(json, bundle.to_json)
-        puts "Signed \#{file}, wrote \#{json}"
-      RUBY
-    end
-  end
-end
-
 require "bundler/gem_tasks"
 
 Bundler::GemHelper.tag_prefix = ENV["TAG_PREFIX"] if ENV["TAG_PREFIX"]

data/lib/oidc/test/version.rb

@@ -2,6 +2,6 @@
 
 module Oidc
   module Test
-    VERSION = "0.8.12"
+    VERSION = "0.8.13"
   end
 end

data/tasks/rubygems_patch.rb

@@ -1,18 +1,46 @@
 # frozen_string_literal: true
 
+return unless defined?(Gem)
+
 require "rubygems/commands/push_command"
 
 Gem::Commands::PushCommand.prepend(Module.new do
   def send_push_request(name, args)
-    return super unless ENV["gem_attestation_path"]
+    return super if options[:attestations]&.any? || @host != "https://rubygems.org"
+
+    begin
+      send_push_request_with_attestation(name, args)
+    rescue StandardError => e
+      alert_warning "Failed to push with attestation, retrying without attestation.\n#{e.full_message}"
+      super
+    end
+  end
 
-    rubygems_api_request(*args, scope: get_push_scope) do |request|
-      request.set_form([
-                         ["gem", Gem.read_binary(name), { filename: name, content_type: "application/octet-stream" }],
-                         ["attestations", "[#{Gem.read_binary(ENV["gem_attestation_path"])}]",
-                          { content_type: "application/json" }]
-                       ], "multipart/form-data")
-      request.add_field "Authorization", api_key
+  def send_push_request_with_attestation(name, args)
+    attestation = attest!(name)
+    if options[:attestations]
+      options[:attestations] << attestation
+      send_push_request(name, args)
+    else
+      rubygems_api_request(*args, scope: get_push_scope) do |request|
+        request.set_form([
+                           ["gem", Gem.read_binary(name), { filename: name, content_type: "application/octet-stream" }],
+                           ["attestations", "[#{Gem.read_binary(attestation)}]", { content_type: "application/json" }]
+                         ], "multipart/form-data")
+        request.add_field "Authorization", api_key
+      end
     end
   end
+
+  def attest!(name)
+    require "open3"
+    bundle = "#{name}.sigstore.json"
+    out, st = Open3.capture2e(
+      Gem.ruby, "-S", "gem", "exec",
+      "sigstore-cli:0.2.1", "sign", name, "--bundle", bundle
+    )
+    raise Gem::Exception, "Failed to sign gem:\n\n#{out}" unless st.success?
+
+    bundle
+  end
 end)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: oidc-test-trusted_publisher
 version: !ruby/object:Gem::Version
-  version: 0.8.12
+  version: 0.8.13
 platform: ruby
 authors:
 - Samuel Giddins
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-11-14 00:00:00.000000000 Z
+date: 2024-11-19 00:00:00.000000000 Z
 dependencies: []
 description: 
 email: