pindo 5.21.1 → 5.21.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b5f3575cc74dd8a938b4d669903f9a80bdd3a097919b0e28b22cb62eb90a804
-  data.tar.gz: d7317665a2b0e1175236e1818f033220827ba5debab25e05d2a0dc809780a2e7
+  metadata.gz: 8fc2d66a2010bba4e00fe508252a291bac2efda4623ded2135bf707b6f93ade0
+  data.tar.gz: cfca3acb943122590ffeba33d95249c2d73143b7e51ff87e74ef5342e44dd67f
 SHA512:
-  metadata.gz: cbe2ea9dba2f316e0c9bffe62821f4d96beceb57de318d22e3a16c12944361c83ab49f1c1ae0db6e987c7433ce535af5523d0b30e95ac92a01646ff14825a205
-  data.tar.gz: 54d5ed72289954705f10f91bbb8281c7b9bdf543fbdc16f63d7bf863f84f4c0a606c0d5d2386aa6620d51e1349ce91de05a0fbe88aa9b8a68a45bce7a9d3d9f6
+  metadata.gz: 652bf861a3896a3763e38ff0f7142128dace9d221350db4a353b1f6ad22fd19dc5661ac926825438cf5dae7fdf287221b3888b8b84d6dccf6d54be024bac759b
+  data.tar.gz: bfd8a3891dc78f37fa1bccec6a67eb9dd7f6f8a4f4cac86d95788d0d64b63e938dd6385579ac3d0bc50141629bc236f2bf4a16d69f597b7036f8a1b497c03cb4

data/lib/pindo/module/cert/mode/custom_https_cert_operator.rb

@@ -417,7 +417,7 @@ module Pindo
       end
 
       def install_certificate_to_keychain(cert_path:, key_path:, cert_password:)
-        P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
         unless Pindo::CertHelper.is_cert_valid?(cert_path)
           raise Informative, "证书已经过期，请重新生成新证书!"
         end
@@ -427,8 +427,19 @@ module Pindo
         return if signing_identity_installed?(cert_path, keychain_path)
 
         keychain_password = Pindoconfig.instance.cert_key_password
-        KeychainHelper.import_file(key_path, keychain_path,
-          keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+        if material.is_a?(P12Material::PemMaterial)
+          # security 需要完整的证书与私钥；在受限目录中将 PEM 封装为 P12。
+          Dir.mktmpdir('pindo_pem_import_') do |directory|
+            import_path = File.join(directory, 'identity.p12')
+            p12 = OpenSSL::PKCS12.create(cert_password, 'pindo', material.key, material.certificate)
+            File.open(import_path, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(p12.to_der) }
+            KeychainHelper.import_file(import_path, keychain_path,
+              keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+          end
+        else
+          KeychainHelper.import_file(key_path, keychain_path,
+            keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+        end
         unless signing_identity_installed?(cert_path, keychain_path)
           raise Informative, "钥匙串未出现证书与私钥组成的签名身份，请检查钥匙串访问权限"
         end

data/lib/pindo/module/cert/p12_material.rb

@@ -4,8 +4,16 @@ module Pindo
   module CertProcess
     # Validate the freshly downloaded material before touching a user's keychain.
     class P12Material
+      PemMaterial = Struct.new(:key, :certificate)
+
       def self.load(cert_path:, key_path:, password:)
-        material = parse(key_path, password)
+        certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
+        content = File.binread(key_path)
+        material = if content.include?('-----BEGIN ')
+                     parse_pem(content, password, certificate)
+                   else
+                     parse(key_path, password)
+                   end
         unless material.key
           raise Informative, 'P12 私钥缺失，请重新导出包含私钥的 P12', cause: nil
         end
@@ -13,9 +21,8 @@ module Pindo
           raise Informative, 'P12 证书缺失，请重新导出包含证书的 P12', cause: nil
         end
 
-        certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
         unless material.certificate.to_der == certificate.to_der && certificate.check_private_key(material.key)
-          raise Informative, 'P12 私钥或证书与下载的 CER 证书不匹配，请更新同一套证书材料', cause: nil
+          raise Informative, '私钥或证书与下载的 CER 证书不匹配，请更新同一套证书材料', cause: nil
         end
         material
       rescue OpenSSL::X509::CertificateError, OpenSSL::PKey::PKeyError
@@ -24,6 +31,26 @@ module Pindo
         raise Informative, '无法读取证书材料，请重新下载', cause: nil
       end
 
+      def self.parse_pem(content, password, certificate)
+        unless content.match?(/-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/)
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        key = OpenSSL::PKey.read(content, password.to_s)
+        unless key.respond_to?(:private?) && key.private?
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        PemMaterial.new(key, certificate)
+      rescue OpenSSL::PKey::PKeyError => error
+        if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
+          raise Informative, 'PEM 加密算法不兼容当前 OpenSSL，请以现代算法重新导出', cause: nil
+        elsif content.include?('ENCRYPTED')
+          raise Informative, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
+        else
+          raise Informative, 'PEM 私钥格式无效或文件已损坏', cause: nil
+        end
+      end
+      private_class_method :parse_pem
+
       def self.parse(key_path, password)
         OpenSSL::PKCS12.new(File.binread(key_path), password)
       rescue OpenSSL::PKCS12::PKCS12Error => error

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.21.1"
+  VERSION = "5.21.2"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.21.1
+  version: 5.21.2
 platform: ruby
 authors:
 - wade