passkit 0.8.2 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c3980bb0fab949c93cc8821dd050f784f97f6a20b3ad9b16ac2c0a73a930529f
-  data.tar.gz: d0a4be1ab9846f71e4bc7806bb54a110519785c4d2086e33106eb83d5f0e06af
+  metadata.gz: b483356d4bcfb7898d15381b4ac43899fbc8b147965e6579110c562a19bf0a21
+  data.tar.gz: d529619e1ebdd0ae04943b0fe07f1bc0c43df6f976218ed8c472ad50da1dcf99
 SHA512:
-  metadata.gz: 5b9cd2a244f8e5b7ffb9e14d18a6004080ea55e0b302f25862d2f23bd28ce7277ca062436100f6aeec638f0827bf78674ef63c22d7c82c852e3c32be139461ab
-  data.tar.gz: 5acf99ef60dc001f047e89771431bdb46fcf4417e70f76a9859df94520805a6b355109de4cc0eee67601ff5047f4825b6b753865120e25413864ce1480242933
+  metadata.gz: bee3e475d2beaed1f9305613893c9aee7cf9cbfee86e9ae95f46348f0d0e0a13f82b9428147f5132f5793d07c551b892104f3f9fac7478d50924183e03c344cb
+  data.tar.gz: 8e614ada638617a10ac3ff807f842e5ceef98d17048a283571809562872cd256ac2de7a05ae9f154eb6e8baf4874c50d03692f73d0719dc41d5d6aedd2932ca0

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.9.0]
+- [#50](https://github.com/coorasse/passkit/pull/50): **Breaking:** require rubyzip 3.4 or later, which fixes CVE-2026-85396, and Ruby 3.2 or later.
+- [#47](https://github.com/coorasse/passkit/pull/47): Remove the generator's working directory once the `.pkpass` is built, and delete generated archives after sending them, so `tmp/passkit` no longer grows with every download.
+- [#48](https://github.com/coorasse/passkit/pull/48): Answer `304 Not Modified` before generating and signing the pass when `If-Modified-Since` shows the device already has the current version.
+
+## [0.8.3]
+- Exclude development and test files from the packaged gem.
+
 ## [0.8.2]
 - Set up the Semaphore CI pipeline with a manual promotion to release the gem.
 - Self-signed certificates for the test suite, so it runs without an Apple Developer certificate.

data/README.md

@@ -173,6 +173,11 @@ Passkit::UrlGenerator.new(Passkit::UserTicket, User.find(1), :tickets)
 and then use `.android` or `.ios` to get the URL to serve the Wallet Pass.
 Again, check the example mailer included in the gem to see how to use it.
 
+If you generate passes yourself with `Passkit::Factory.create_pass` or `Passkit::Generator#generate_and_sign`
+instead of going through the bundled controllers, note that the returned `.pkpass` lives in `tmp/passkit`.
+The bundled controllers delete it once it has been sent; if you serve it yourself, do the same, otherwise the
+folder grows by one archive per download.
+
 ## Debug issues 
 
 * On Mac, you can open the *.pkpass files with "Pass Viewer". Open the `Console.app` to log possible error messages and filter by "Pass Viewer" process.

data/app/controllers/concerns/passkit/pass_delivery.rb

@@ -0,0 +1,15 @@
+module Passkit
+  # Passes are generated into tmp/passkit. Send the archive's contents and
+  # delete the file, so the folder does not grow by one archive per download.
+  module PassDelivery
+    extend ActiveSupport::Concern
+
+    private
+
+    def send_pass_file(path, type:, filename: File.basename(path))
+      send_data File.binread(path), type: type, disposition: "attachment", filename: filename
+    ensure
+      FileUtils.rm_f(path)
+    end
+  end
+end

data/app/controllers/passkit/api/v1/passes_controller.rb

@@ -2,6 +2,8 @@ module Passkit
   module Api
     module V1
       class PassesController < ActionController::API
+        include Passkit::PassDelivery
+
         before_action :decrypt_payload, only: :create
 
         def create
@@ -11,11 +13,15 @@ module Passkit
             files = @generator.public_send(@payload[:collection_name]).collect do |collection_item|
               Passkit::Factory.create_pass(@payload[:pass_class], collection_item)
             end
-            file = Passkit::Generator.compress_passes_files(files)
-            send_file(file, type: "application/vnd.apple.pkpasses", disposition: "attachment")
+            begin
+              bundle = Passkit::Generator.compress_passes_files(files)
+            ensure
+              files.each { |file| FileUtils.rm_f(file) }
+            end
+            send_pass_file(bundle, type: "application/vnd.apple.pkpasses")
           else
             file = Passkit::Factory.create_pass(@payload[:pass_class], @generator)
-            send_file(file, type: "application/vnd.apple.pkpass", disposition: "attachment")
+            send_pass_file(file, type: "application/vnd.apple.pkpass")
           end
         end
 
@@ -35,19 +41,24 @@ module Passkit
             return
           end
 
-          pass_output_path = Passkit::Generator.new(pass).generate_and_sign
-
           response.headers["last-modified"] = pass.last_update.httpdate
-          if request.headers["If-Modified-Since"].nil? ||
-              (pass.last_update.to_i > Time.zone.parse(request.headers["If-Modified-Since"]).to_i)
-            send_file(pass_output_path, type: "application/vnd.apple.pkpass", disposition: "attachment")
-          else
-            head :not_modified
-          end
+          return head :not_modified unless pass_modified_since?(pass, request.headers["If-Modified-Since"])
+
+          pass_output_path = Passkit::Generator.new(pass).generate_and_sign
+          send_pass_file(pass_output_path, type: "application/vnd.apple.pkpass")
         end
 
         private
 
+        # Wallet sends back the Last-Modified it received with the previous
+        # download. When the pass has not changed since, there is nothing to
+        # generate or sign.
+        def pass_modified_since?(pass, if_modified_since)
+          return true if if_modified_since.nil?
+
+          pass.last_update.to_i > Time.zone.parse(if_modified_since).to_i
+        end
+
         def decrypt_payload
           @payload = Passkit::UrlEncrypt.decrypt(params[:payload])
           if DateTime.parse(@payload[:valid_until]).past?

data/app/controllers/passkit/dashboard/previews_controller.rb

@@ -1,6 +1,8 @@
 module Passkit
   module Dashboard
     class PreviewsController < ApplicationController
+      include Passkit::PassDelivery
+
       def index
       end
 
@@ -8,7 +10,7 @@ module Passkit
         builder = Passkit.configuration.available_passes[params[:class_name]]
         path = Factory.create_pass(params[:class_name].constantize, builder.call)
 
-        send_file path, type: "application/vnd.apple.pkpass", disposition: "attachment", filename: "pass.pkpass"
+        send_pass_file path, type: "application/vnd.apple.pkpass", filename: "pass.pkpass"
       end
     end
   end

data/lib/passkit/generator.rb

@@ -21,17 +21,15 @@ module Passkit
       generate_json_manifest
       sign_manifest
       compress_pass_file
+    ensure
+      remove_temporary_directory
     end
 
     def self.compress_passes_files(files)
       zip_path = TMP_FOLDER.join("#{SecureRandom.uuid}.pkpasses")
-      zipped_file = File.open(zip_path, "w")
 
-      Zip::OutputStream.open(zipped_file.path) do |z|
-        files.each do |file|
-          z.put_next_entry(File.basename(file))
-          z.print File.read(file)
-        end
+      Zip::File.open(zip_path, create: true) do |zip|
+        files.each { |file| zip.add(File.basename(file), file) }
       end
       zip_path
     end
@@ -49,6 +47,12 @@ module Passkit
       FileUtils.rm_rf(@temporary_path) if File.directory?(@temporary_path)
     end
 
+    # Only the .pkpass is returned to the caller; the unpacked files it was
+    # built from have no further use once it exists.
+    def remove_temporary_directory
+      FileUtils.rm_rf(@temporary_path) if @temporary_path
+    end
+
     def copy_pass_to_tmp_location
       FileUtils.cp_r(@pass.pass_path, @temporary_path)
     end
@@ -148,13 +152,12 @@ module Passkit
 
     def compress_pass_file
       zip_path = TMP_FOLDER.join("#{@pass.file_name}.pkpass")
-      zipped_file = File.open(zip_path, "w")
+      FileUtils.rm_f(zip_path)
 
-      Zip::OutputStream.open(zipped_file.path) do |z|
-        Dir.glob(@temporary_path.join("**")).each do |file|
-          z.put_next_entry(File.basename(file))
-          z.print File.read(file)
-        end
+      # Entries added from files have a known size, so rubyzip writes a plain zip without the Zip64 extra fields
+      # it adds to streamed entries since 3.0.
+      Zip::File.open(zip_path, create: true) do |zip|
+        Dir.glob(@temporary_path.join("**")).each { |file| zip.add(File.basename(file), file) }
       end
       zip_path
     end

data/lib/passkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Passkit
-  VERSION = "0.8.2"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: passkit
 version: !ruby/object:Gem::Version
-  version: 0.8.2
+  version: 0.9.0
 platform: ruby
 authors:
 - Alessandro Rodi
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.4'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -143,17 +143,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".env.test"
-- ".example.env"
-- ".semaphore/release.yml"
-- ".semaphore/semaphore.yml"
-- ".standard.yml"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
-- Gemfile
 - LICENSE.txt
 - README.md
-- Rakefile
 - app/assets/config/passkit_manifest.js
 - app/assets/images/passkit/add_to_apple_wallet_de.png
 - app/assets/images/passkit/add_to_apple_wallet_en.png
@@ -163,6 +156,7 @@ files:
 - app/assets/images/passkit/add_to_walletpass_en.png
 - app/assets/images/passkit/add_to_walletpass_fr.png
 - app/assets/images/passkit/add_to_walletpass_it.png
+- app/controllers/concerns/passkit/pass_delivery.rb
 - app/controllers/passkit/api/v1/logs_controller.rb
 - app/controllers/passkit/api/v1/passes_controller.rb
 - app/controllers/passkit/api/v1/registrations_controller.rb
@@ -181,18 +175,7 @@ files:
 - app/views/passkit/dashboard/previews/index.html.erb
 - app/views/passkit/example_mailer/example_email.html.erb
 - app/views/shared/passkit/_navigation.html.erb
-- bin/console
-- bin/generate_test_certificates
-- bin/setup
 - config/routes.rb
-- docs/membership.png
-- docs/passkit_environment_variables.md
-- docs/step1.png
-- docs/step2.png
-- docs/step3.png
-- docs/step4.png
-- docs/step5.png
-- docs/wallet.png
 - lib/generators/passkit/install_generator.rb
 - lib/generators/templates/create_passkit_tables.rb.tt
 - lib/generators/templates/passkit.rb
@@ -232,14 +215,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.9
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Serve Wallet Passes for iOS and Android directly from your Rails app
 test_files: []

data/.env.test

@@ -1,8 +0,0 @@
-PASSKIT_WEB_SERVICE_HOST=https://localhost:3000
-PASSKIT_CERTIFICATE_KEY=passkit
-PASSKIT_PRIVATE_P12_CERTIFICATE=certificates/certificate.p12
-PASSKIT_APPLE_INTERMEDIATE_CERTIFICATE=certificates/intermediate.cer
-PASSKIT_APPLE_TEAM_IDENTIFIER=XXXXXXXXXX
-PASSKIT_PASS_TYPE_IDENTIFIER=pass.com.example.pass
-PASSKIT_DASHBOARD_USERNAME=admin
-PASSKIT_DASHBOARD_PASSWORD=admin

data/.example.env

@@ -1,8 +0,0 @@
-PASSKIT_WEB_SERVICE_HOST=https://localhost:3000
-PASSKIT_CERTIFICATE_KEY=theCertPassword
-PASSKIT_PRIVATE_P12_CERTIFICATE=path/to/certificate.p12
-PASSKIT_APPLE_INTERMEDIATE_CERTIFICATE=path/to/AppleWWDRCA.cer
-PASSKIT_APPLE_TEAM_IDENTIFIER=XXXXXXXXXX
-PASSKIT_PASS_TYPE_IDENTIFIER=pass.com.example.pass
-PASSKIT_DASHBOARD_USERNAME=admin
-PASSKIT_DASHBOARD_PASSWORD=admin

data/.semaphore/release.yml

@@ -1,21 +0,0 @@
-version: "v1.0"
-name: Release gem
-agent:
-  machine:
-    type: f1-standard-2
-    os_image: ubuntu2204
-
-blocks:
-  - name: publish
-    execution_time_limit:
-      minutes: 10
-    task:
-      secrets:
-        - name: rubygems
-      jobs:
-        - name: build and push to rubygems.org
-          commands:
-            - checkout
-            - sem-version ruby 3.3
-            - gem build passkit.gemspec
-            - gem push passkit-*.gem < /dev/null

data/.semaphore/semaphore.yml

@@ -1,42 +0,0 @@
-version: "v1.0"
-name: passkit
-agent:
-  machine:
-    type: f1-standard-2
-    os_image: ubuntu2204
-auto_cancel:
-  running:
-    when: "true"
-
-blocks:
-  - name: tests
-    execution_time_limit:
-      minutes: 10
-    task:
-      env_vars:
-        - name: RAILS_ENV
-          value: test
-        - name: BUNDLE_PATH
-          value: vendor/bundle
-      prologue:
-        commands:
-          - checkout --use-cache
-          - sem-version ruby 3.3
-          - cache restore gems-$(checksum passkit.gemspec)-$(checksum Gemfile)
-          - bundle install -j 4
-          - cache store gems-$(checksum passkit.gemspec)-$(checksum Gemfile) vendor/bundle
-          - bin/generate_test_certificates
-      jobs:
-        - name: linter
-          commands:
-            - bundle exec standardrb
-        - name: tests
-          commands:
-            - bundle exec rake test
-        - name: system tests
-          commands:
-            - bundle exec rake test:system
-
-promotions:
-  - name: Release gem
-    pipeline_file: release.yml

data/.standard.yml

@@ -1,2 +0,0 @@
-# For available configuration options, see:
-#   https://github.com/testdouble/standard

data/Gemfile

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-source "https://rubygems.org"
-
-# Specify your gem's dependencies in passkit.gemspec
-gemspec
-
-gem "rake", "~> 13.0"
-
-gem "minitest", "~> 5.0"
-
-gem "standard", "~> 1.3"

data/Rakefile

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.libs << "lib"
-  t.test_files = FileList["test/**/test_*.rb"]
-end
-
-Rake::TestTask.new("test:system") do |t|
-  t.libs << "test"
-  t.libs << "lib"
-  t.test_files = FileList["test/system/**/*_test.rb"]
-end
-
-require "standard/rake"
-
-task default: %i[test standard]

data/bin/console

@@ -1,15 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "bundler/setup"
-require "passkit"
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-require "irb"
-IRB.start(__FILE__)

data/bin/generate_test_certificates

@@ -1,55 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-# Generates a self-signed pass certificate and a fake "Apple intermediate"
-# certificate, so that the test suite can sign passes without a real Apple
-# Developer certificate.
-
-require "openssl"
-require "fileutils"
-
-output_directory = File.expand_path("../test/dummy/certificates", __dir__)
-password = ENV.fetch("PASSKIT_CERTIFICATE_KEY", "passkit")
-
-FileUtils.mkdir_p(output_directory)
-
-intermediate_key = OpenSSL::PKey::RSA.new(2048)
-intermediate_certificate = OpenSSL::X509::Certificate.new
-intermediate_certificate.version = 2
-intermediate_certificate.serial = 1
-intermediate_certificate.subject = OpenSSL::X509::Name.parse("/CN=Passkit Test Intermediate CA")
-intermediate_certificate.issuer = intermediate_certificate.subject
-intermediate_certificate.public_key = intermediate_key.public_key
-intermediate_certificate.not_before = Time.now - 60
-intermediate_certificate.not_after = Time.now + (10 * 365 * 24 * 60 * 60)
-
-extension_factory = OpenSSL::X509::ExtensionFactory.new
-extension_factory.subject_certificate = intermediate_certificate
-extension_factory.issuer_certificate = intermediate_certificate
-intermediate_certificate.add_extension(extension_factory.create_extension("basicConstraints", "CA:TRUE", true))
-intermediate_certificate.add_extension(extension_factory.create_extension("keyUsage", "keyCertSign, cRLSign", true))
-intermediate_certificate.sign(intermediate_key, OpenSSL::Digest.new("SHA256"))
-
-pass_key = OpenSSL::PKey::RSA.new(2048)
-pass_certificate = OpenSSL::X509::Certificate.new
-pass_certificate.version = 2
-pass_certificate.serial = 2
-pass_certificate.subject = OpenSSL::X509::Name.parse("/CN=#{ENV.fetch("PASSKIT_PASS_TYPE_IDENTIFIER", "pass.com.example.pass")}")
-pass_certificate.issuer = intermediate_certificate.subject
-pass_certificate.public_key = pass_key.public_key
-pass_certificate.not_before = Time.now - 60
-pass_certificate.not_after = Time.now + (10 * 365 * 24 * 60 * 60)
-
-extension_factory = OpenSSL::X509::ExtensionFactory.new
-extension_factory.subject_certificate = pass_certificate
-extension_factory.issuer_certificate = intermediate_certificate
-pass_certificate.add_extension(extension_factory.create_extension("basicConstraints", "CA:FALSE", true))
-pass_certificate.add_extension(extension_factory.create_extension("keyUsage", "digitalSignature", true))
-pass_certificate.sign(intermediate_key, OpenSSL::Digest.new("SHA256"))
-
-p12 = OpenSSL::PKCS12.create(password, "Passkit Test Certificate", pass_key, pass_certificate)
-
-File.binwrite(File.join(output_directory, "intermediate.cer"), intermediate_certificate.to_der)
-File.binwrite(File.join(output_directory, "certificate.p12"), p12.to_der)
-
-puts "Certificates written to #{output_directory}"

data/bin/setup

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-set -vx
-
-bundle install
-
-bin/generate_test_certificates

data/docs/passkit_environment_variables.md

@@ -1,53 +0,0 @@
-# Setup Passkit Environment variables
-
-### `PASSKIT_WEB_SERVICE_HOST`
-
-This is the host where your Rails app is running. It is used to generate the URLs for the passes. 
-When the device wants to update the Pass, it will invoke services on this host.
-In production, it will simply be your domain name, but in development you can use [ngrok](https://ngrok.com/) to expose your local server to the internet.
-
-**Remember that it must always start with `https://`.**
-
-### `PASSKIT_APPLE_INTERMEDIATE_CERTIFICATE`
-
-This is the easy one.
-Head to https://www.apple.com/certificateauthority/ and download the latest Apple Intermediate Certificate Worldwide Developer Relations.
-You might want to choose the one with the longest expiration date. PASSKIT_APPLE_INTERMEDIATE_CERTIFICATE is the path to the certificate.
-
-### `PASSKIT_APPLE_TEAM_IDENTIFIER`
-
-You find this in your Apple Developer dashboard, under Membership.
-
-![Membership](membership.png)
-
-### `PASSKIT_PASS_TYPE_IDENTIFIER`, `PASSKIT_PRIVATE_P12_CERTIFICATE` and `PASSKIT_CERTIFICATE_KEY`
-
-Head to your Apple Developers console and generate a new certificate.
-
-![Step 1](step1.png)
-
-![Step 2](step2.png)
-
-![Step 3](step3.png)
-
-The identifier is the `PASSKIT_PASS_TYPE_IDENTIFIER` variable.
-
-**Note**: When renewing your certificate, make sure that this identifier stays the same as before. Changing this identifier will
-require existing passes to be regenerated, as they will otherwise no longer be updateable via the web service URL.
-
-Now, create a certificate signing request: https://developer.apple.com/help/account/create-certificates/create-a-certificate-signing-request/
-
-And create the certificate:
-
-![Step 4](step4.png)
-
-At the end, you'll have a `pass.cer` file.
-
-Open it in the Keychain Access tool and export it (you must be in the My Certificates tab):
-
-![Step 5](step5.png)
-
-Set a password and get your p12 file. The path to this file is the `PASSKIT_PRIVATE_P12_CERTIFICATE` variable.
-Save the password. This is the `PASSKIT_CERTIFICATE_KEY` variable.
-
-`PKCS12_parse: unsupported`: you might encounter this issue: https://help.heroku.com/88GYDTB2/how-do-i-configure-openssl-to-allow-the-use-of-legacy-cryptographic-algorithms