passkit 0.8.3 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ba766112a286c8570851338476fee913b5eff4575cfc2fc6eeb91fb2617e5b0
-  data.tar.gz: 7b28c2c662b071529705a5fa409da39d42442eb702547a25ad960369d0c8500d
+  metadata.gz: b483356d4bcfb7898d15381b4ac43899fbc8b147965e6579110c562a19bf0a21
+  data.tar.gz: d529619e1ebdd0ae04943b0fe07f1bc0c43df6f976218ed8c472ad50da1dcf99
 SHA512:
-  metadata.gz: 53782d8dd386090a3fda13fa70ebf39a82d06afe3f00fd83cc54845cdeb59b5f0d0a414fe4e151e773451b4d18a3331720acfbd0ebd2e7eb6238effb1b8ab719
-  data.tar.gz: f37f52f4b3f105e1a5dde4c2613ffa35372d2c5734b8da28e3551f84bf978742c4d1a257ee380c46fa950fbba04e9f22fc37c67dfa05de7149c0c902735d91f7
+  metadata.gz: bee3e475d2beaed1f9305613893c9aee7cf9cbfee86e9ae95f46348f0d0e0a13f82b9428147f5132f5793d07c551b892104f3f9fac7478d50924183e03c344cb
+  data.tar.gz: 8e614ada638617a10ac3ff807f842e5ceef98d17048a283571809562872cd256ac2de7a05ae9f154eb6e8baf4874c50d03692f73d0719dc41d5d6aedd2932ca0

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## [0.9.0]
+- [#50](https://github.com/coorasse/passkit/pull/50): **Breaking:** require rubyzip 3.4 or later, which fixes CVE-2026-85396, and Ruby 3.2 or later.
+- [#47](https://github.com/coorasse/passkit/pull/47): Remove the generator's working directory once the `.pkpass` is built, and delete generated archives after sending them, so `tmp/passkit` no longer grows with every download.
+- [#48](https://github.com/coorasse/passkit/pull/48): Answer `304 Not Modified` before generating and signing the pass when `If-Modified-Since` shows the device already has the current version.
+
 ## [0.8.3]
 - Exclude development and test files from the packaged gem.
 

data/README.md

@@ -173,6 +173,11 @@ Passkit::UrlGenerator.new(Passkit::UserTicket, User.find(1), :tickets)
 and then use `.android` or `.ios` to get the URL to serve the Wallet Pass.
 Again, check the example mailer included in the gem to see how to use it.
 
+If you generate passes yourself with `Passkit::Factory.create_pass` or `Passkit::Generator#generate_and_sign`
+instead of going through the bundled controllers, note that the returned `.pkpass` lives in `tmp/passkit`.
+The bundled controllers delete it once it has been sent; if you serve it yourself, do the same, otherwise the
+folder grows by one archive per download.
+
 ## Debug issues 
 
 * On Mac, you can open the *.pkpass files with "Pass Viewer". Open the `Console.app` to log possible error messages and filter by "Pass Viewer" process.

data/app/controllers/concerns/passkit/pass_delivery.rb

@@ -0,0 +1,15 @@
+module Passkit
+  # Passes are generated into tmp/passkit. Send the archive's contents and
+  # delete the file, so the folder does not grow by one archive per download.
+  module PassDelivery
+    extend ActiveSupport::Concern
+
+    private
+
+    def send_pass_file(path, type:, filename: File.basename(path))
+      send_data File.binread(path), type: type, disposition: "attachment", filename: filename
+    ensure
+      FileUtils.rm_f(path)
+    end
+  end
+end

data/app/controllers/passkit/api/v1/passes_controller.rb

@@ -2,6 +2,8 @@ module Passkit
   module Api
     module V1
       class PassesController < ActionController::API
+        include Passkit::PassDelivery
+
         before_action :decrypt_payload, only: :create
 
         def create
@@ -11,11 +13,15 @@ module Passkit
             files = @generator.public_send(@payload[:collection_name]).collect do |collection_item|
               Passkit::Factory.create_pass(@payload[:pass_class], collection_item)
             end
-            file = Passkit::Generator.compress_passes_files(files)
-            send_file(file, type: "application/vnd.apple.pkpasses", disposition: "attachment")
+            begin
+              bundle = Passkit::Generator.compress_passes_files(files)
+            ensure
+              files.each { |file| FileUtils.rm_f(file) }
+            end
+            send_pass_file(bundle, type: "application/vnd.apple.pkpasses")
           else
             file = Passkit::Factory.create_pass(@payload[:pass_class], @generator)
-            send_file(file, type: "application/vnd.apple.pkpass", disposition: "attachment")
+            send_pass_file(file, type: "application/vnd.apple.pkpass")
           end
         end
 
@@ -35,19 +41,24 @@ module Passkit
             return
           end
 
-          pass_output_path = Passkit::Generator.new(pass).generate_and_sign
-
           response.headers["last-modified"] = pass.last_update.httpdate
-          if request.headers["If-Modified-Since"].nil? ||
-              (pass.last_update.to_i > Time.zone.parse(request.headers["If-Modified-Since"]).to_i)
-            send_file(pass_output_path, type: "application/vnd.apple.pkpass", disposition: "attachment")
-          else
-            head :not_modified
-          end
+          return head :not_modified unless pass_modified_since?(pass, request.headers["If-Modified-Since"])
+
+          pass_output_path = Passkit::Generator.new(pass).generate_and_sign
+          send_pass_file(pass_output_path, type: "application/vnd.apple.pkpass")
         end
 
         private
 
+        # Wallet sends back the Last-Modified it received with the previous
+        # download. When the pass has not changed since, there is nothing to
+        # generate or sign.
+        def pass_modified_since?(pass, if_modified_since)
+          return true if if_modified_since.nil?
+
+          pass.last_update.to_i > Time.zone.parse(if_modified_since).to_i
+        end
+
         def decrypt_payload
           @payload = Passkit::UrlEncrypt.decrypt(params[:payload])
           if DateTime.parse(@payload[:valid_until]).past?

data/app/controllers/passkit/dashboard/previews_controller.rb

@@ -1,6 +1,8 @@
 module Passkit
   module Dashboard
     class PreviewsController < ApplicationController
+      include Passkit::PassDelivery
+
       def index
       end
 
@@ -8,7 +10,7 @@ module Passkit
         builder = Passkit.configuration.available_passes[params[:class_name]]
         path = Factory.create_pass(params[:class_name].constantize, builder.call)
 
-        send_file path, type: "application/vnd.apple.pkpass", disposition: "attachment", filename: "pass.pkpass"
+        send_pass_file path, type: "application/vnd.apple.pkpass", filename: "pass.pkpass"
       end
     end
   end

data/lib/passkit/generator.rb

@@ -21,17 +21,15 @@ module Passkit
       generate_json_manifest
       sign_manifest
       compress_pass_file
+    ensure
+      remove_temporary_directory
     end
 
     def self.compress_passes_files(files)
       zip_path = TMP_FOLDER.join("#{SecureRandom.uuid}.pkpasses")
-      zipped_file = File.open(zip_path, "w")
 
-      Zip::OutputStream.open(zipped_file.path) do |z|
-        files.each do |file|
-          z.put_next_entry(File.basename(file))
-          z.print File.read(file)
-        end
+      Zip::File.open(zip_path, create: true) do |zip|
+        files.each { |file| zip.add(File.basename(file), file) }
       end
       zip_path
     end
@@ -49,6 +47,12 @@ module Passkit
       FileUtils.rm_rf(@temporary_path) if File.directory?(@temporary_path)
     end
 
+    # Only the .pkpass is returned to the caller; the unpacked files it was
+    # built from have no further use once it exists.
+    def remove_temporary_directory
+      FileUtils.rm_rf(@temporary_path) if @temporary_path
+    end
+
     def copy_pass_to_tmp_location
       FileUtils.cp_r(@pass.pass_path, @temporary_path)
     end
@@ -148,13 +152,12 @@ module Passkit
 
     def compress_pass_file
       zip_path = TMP_FOLDER.join("#{@pass.file_name}.pkpass")
-      zipped_file = File.open(zip_path, "w")
+      FileUtils.rm_f(zip_path)
 
-      Zip::OutputStream.open(zipped_file.path) do |z|
-        Dir.glob(@temporary_path.join("**")).each do |file|
-          z.put_next_entry(File.basename(file))
-          z.print File.read(file)
-        end
+      # Entries added from files have a known size, so rubyzip writes a plain zip without the Zip64 extra fields
+      # it adds to streamed entries since 3.0.
+      Zip::File.open(zip_path, create: true) do |zip|
+        Dir.glob(@temporary_path.join("**")).each { |file| zip.add(File.basename(file), file) }
       end
       zip_path
     end

data/lib/passkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Passkit
-  VERSION = "0.8.3"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: passkit
 version: !ruby/object:Gem::Version
-  version: 0.8.3
+  version: 0.9.0
 platform: ruby
 authors:
 - Alessandro Rodi
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '3.4'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -156,6 +156,7 @@ files:
 - app/assets/images/passkit/add_to_walletpass_en.png
 - app/assets/images/passkit/add_to_walletpass_fr.png
 - app/assets/images/passkit/add_to_walletpass_it.png
+- app/controllers/concerns/passkit/pass_delivery.rb
 - app/controllers/passkit/api/v1/logs_controller.rb
 - app/controllers/passkit/api/v1/passes_controller.rb
 - app/controllers/passkit/api/v1/registrations_controller.rb
@@ -214,14 +215,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.9
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Serve Wallet Passes for iOS and Android directly from your Rails app
 test_files: []