r509 0.10.0 → 1.0

data/lib/r509/spki.rb

@@ -12,20 +12,20 @@ module R509
     attr_reader :spki, :key
     # @option opts [String,OpenSSL::Netscape::SPKI] :spki the spki you want to parse
     # @option opts [R509::PrivateKey,String] :key optional private key to supply. either an unencrypted PEM/DER string or an R509::PrivateKey object (use the latter if you need password/hardware support). if supplied you do not need to pass an spki.
-    # @option opts [String] :message_digest Optional digest. sha1, sha224, sha256, sha384, sha512, md5. Defaults to sha1. Only used if you supply a :key and no :spki
-    def initialize(opts={})
-      if not opts.kind_of?(Hash)
+    # @option opts [String] :message_digest Optional digest. sha1, sha224, sha256, sha384, sha512, md5. Defaults to sha256. Only used if you supply a :key and no :spki
+    def initialize(opts = {})
+      if !opts.is_a?(Hash)
         raise ArgumentError, 'Must provide a hash of options'
-      elsif not opts.has_key?(:spki) and not opts.has_key?(:key)
+      elsif !opts.key?(:spki) && !opts.key?(:key)
         raise ArgumentError, 'Must provide either :spki or :key'
       end
 
       @key = load_private_key(opts)
 
-      if opts.has_key?(:spki)
+      if opts.key?(:spki)
         @spki = parse_spki(opts[:spki])
       else
-      # create the SPKI from the private key if it wasn't passed in
+        # create the SPKI from the private key if it wasn't passed in
         @spki = build_spki(opts[:message_digest])
       end
     end
@@ -41,14 +41,14 @@ module R509
       @spki.verify(public_key)
     end
 
-    alias :to_s :to_pem
+    alias_method :to_s, :to_pem
 
     # Returns the signature algorithm (e.g., RSA-SHA1, ecdsa-with-SHA256)
     #
     # @return [String] signature algorithm string
     def signature_algorithm
       data = OpenSSL::ASN1.decode(self.to_der)
-      return data.entries[1].value.entries[0].value
+      data.entries[1].value.entries[0].value
     end
 
     private
@@ -59,7 +59,7 @@ module R509
     def parse_spki(spki)
       # first let's try cleaning up the input a bit so OpenSSL is happy with it
       # OpenSSL hates SPKAC=
-      spki.sub!("SPKAC=","")
+      spki.sub!("SPKAC=", "")
       # it really hates newlines (Firefox loves 'em)
       # so let's normalize line endings
       spki.gsub!(/\r\n?/, "\n")
@@ -68,10 +68,10 @@ module R509
       # ...and leading/trailing whitespace
       spki.strip!
       spki = OpenSSL::Netscape::SPKI.new(spki)
-      if not @key.nil? and not spki.verify(@key.public_key) then
+      if @key && !spki.verify(@key.public_key)
         raise R509Error, 'Key does not match SPKI.'
       end
-      return spki
+      spki
     end
 
     # Tries to build an SPKI using an existing private key
@@ -81,21 +81,18 @@ module R509
       spki = OpenSSL::Netscape::SPKI.new
       spki.public_key = @key.public_key
       if @key.dsa?
-        #only DSS1 is acceptable for DSA signing in OpenSSL < 1.0
-        #post-1.0 you can sign with anything, but let's be conservative
-        #see: http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/PKey/DSA.html
+        # only DSS1 is acceptable for DSA signing in OpenSSL < 1.0
+        # post-1.0 you can sign with anything, but let's be conservative
+        # see: http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/PKey/DSA.html
         message_digest = R509::MessageDigest.new('dss1')
       else
         message_digest = R509::MessageDigest.new(md)
       end
-      spki.sign(@key.key,message_digest.digest)
-      return spki
+      spki.sign(@key.key, message_digest.digest)
+      spki
     end
 
     # Returns the proper instance variable
-    def internal_obj
-      @spki
-    end
-
+    alias_method :internal_obj, :spki
   end
 end

data/lib/r509/subject.rb

@@ -21,19 +21,19 @@ module R509
   #   subject.custom_oid="test"
   class Subject
     # @param [Array, OpenSSL::X509::Name, R509::Subject, DER, Hash, nil] arg
-    def initialize(arg=nil)
-      if arg.kind_of?(Array)
+    def initialize(arg = nil)
+      if arg.is_a?(Array)
         @array = arg
-      elsif arg.kind_of?(Hash)
-        @array = arg.map { |k,v| [k.to_s.upcase,v] }
-      elsif arg.kind_of?(OpenSSL::X509::Name)
+      elsif arg.is_a?(Hash)
+        @array = arg.map { |k, v| [k.to_s.upcase, v] }
+      elsif arg.is_a?(OpenSSL::X509::Name)
         sanitizer = R509::NameSanitizer.new
         @array = sanitizer.sanitize(arg)
-      elsif arg.kind_of?(R509::Subject)
+      elsif arg.is_a?(R509::Subject)
         @array = arg.to_a
       else
         @array = []
-        if not (begin OpenSSL::ASN1.decode(arg) rescue nil end).nil?
+        unless (begin OpenSSL::ASN1.decode(arg) rescue nil end).nil?
           parse_asn1(arg)
         end
       end
@@ -59,22 +59,22 @@ module R509
           return item[1]
         end
       end
-      return nil
+      nil
     end
 
     # set key and value
     def []=(key, value)
       added = false
-      @array = @array.map{ |item|
+      @array = @array.map do |item|
         if key == item[0]
           added = true
           [key, value]
         else
           item
         end
-      }
+      end
 
-      if not added
+      unless added
         @array << [key, value]
       end
 
@@ -118,8 +118,8 @@ module R509
     # @private
     def respond_to?(method_sym, include_private = false)
       method_sym.to_s =~ /([^=]*)/
-      oid = oid_check($1)
-      if not oid.nil?
+      oid = oid_check(Regexp.last_match[1])
+      if oid
         true
       else
         super(method_sym, include_private)
@@ -139,17 +139,17 @@ module R509
     #
     def method_missing(method_sym, *args, &block)
       if method_sym.to_s =~ /(.*)=$/
-        sn = oid_check($1)
-        if not sn.nil?
-          define_dynamic_setter(method_sym,sn)
+        sn = oid_check(Regexp.last_match[1])
+        if sn
+          define_dynamic_setter(method_sym, sn)
           send(method_sym, args.first)
         else
           return super(method_sym, *args, &block)
         end
       else
         sn = oid_check(method_sym)
-        if not sn.nil?
-          define_dynamic_getter(method_sym,sn)
+        if sn
+          define_dynamic_getter(method_sym, sn)
           send(method_sym)
         else
           return super(method_sym, *args, &block)
@@ -157,29 +157,29 @@ module R509
       end
     end
 
-    def define_dynamic_setter(name,sn)
+    def define_dynamic_setter(name, sn)
       instance_eval <<-RUBY
-        def #{name.to_s}(value)
+        def #{name}(value)
           self["#{sn}"]= value
         end
       RUBY
     end
 
-    def define_dynamic_getter(name,sn)
+    def define_dynamic_getter(name, sn)
       instance_eval <<-RUBY
-        def #{name.to_s}
+        def #{name}
           self["#{sn}"]
         end
       RUBY
     end
 
     def oid_check(name)
-        oid = OpenSSL::ASN1::ObjectId.new(camelize(name))
-        oid.short_name
+      oid = OpenSSL::ASN1::ObjectId.new(camelize(name))
+      oid.short_name
     end
 
     def camelize(sym)
-      sym.to_s.split('_').inject([]){ |buffer,e| buffer.push(buffer.empty? ? e : e.capitalize) }.join
+      sym.to_s.split('_').reduce([]) { |a, e| a.push(a.empty? ? e : e.capitalize) }.join
     end
 
     def parse_asn1(asn)
@@ -213,7 +213,7 @@ module R509
           if oids.size == 1
             oid = oids.first
           else
-            oid = oids.select{ |match| not used_oids.include?(match) }.first
+            oid = oids.select { |match| !used_oids.include?(match) }.first
           end
           # replace the "UNDEF" OID name in the array at the index the UNDEF was found
           array[component[:index]][0] = oid
@@ -244,5 +244,4 @@ module R509
       components
     end
   end
-
 end

data/lib/r509/trollop.rb

@@ -1,3 +1,4 @@
+# rubocop:disable all
 ## NOTE: namespaced Trollop inside R509 to prevent conflicts if other libs
 ## choose to load Trollop as well
 

data/lib/r509/validity.rb

@@ -1,29 +1,31 @@
 require 'openssl'
 
-#Module for holding classes for writing and reading certificate validity information (used for serving OCSP responses)
+# Module for holding classes for writing and reading certificate validity
+# information (used for serving OCSP responses)
 module R509::Validity
-  #mapping from OpenSSL
+  # mapping from OpenSSL
   VALID = OpenSSL::OCSP::V_CERTSTATUS_GOOD
-  #mapping from OpenSSL
+  # mapping from OpenSSL
   REVOKED = OpenSSL::OCSP::V_CERTSTATUS_REVOKED
-  #mapping from OpenSSL
+  # mapping from OpenSSL
   UNKNOWN = OpenSSL::OCSP::V_CERTSTATUS_UNKNOWN
 
-  #data about the status of a certificate
+  # data about the status of a certificate
   class Status
     attr_reader :status, :revocation_time, :revocation_reason
 
-    def initialize(options={})
+    def initialize(options = {})
       @status = options[:status]
       @revocation_time = options[:revocation_time] || nil
       @revocation_reason = options[:revocation_reason] || 0
 
-      if (@status == R509::Validity::REVOKED and @revocation_time.nil?)
+      if @status == R509::Validity::REVOKED && @revocation_time.nil?
         @revocation_time = Time.now.to_i
       end
     end
 
-    # @return [OpenSSL::OCSP::STATUS] OpenSSL status constants when passing R509 constants
+    # @return [OpenSSL::OCSP::STATUS] OpenSSL status constants when passing
+    #   R509 constants
     def ocsp_status
       case @status
       when R509::Validity::VALID
@@ -38,37 +40,44 @@ module R509::Validity
     end
   end
 
-  #abstract base class for a Writer
+  # abstract base class for a Writer
   class Writer
     def issue(issuer, serial)
-      raise NotImplementedError, "You must call #issue on a subclass of Writer"
+      fail NotImplementedError,
+           "You must call #issue on a subclass of Writer"
     end
 
     def revoke(issuer, serial, reason)
-      raise NotImplementedError, "You must call #revoke on a subclass of Writer"
+      fail NotImplementedError,
+           "You must call #revoke on a subclass of Writer"
     end
 
-    # is_available? is meant to be implemented to check if the backend store you choose to implement is currently working.
-    # see r509-ocsp-responder and r509-validity-redis for an example of use
+    # is_available? is meant to be implemented to check if the backend store
+    # you choose to implement is currently working. see r509-ocsp-responder
+    # and r509-validity-redis for an example of use
     def is_available?
-      raise NotImplementedError, "You must call #is_available? on a subclass of Writer"
+      fail NotImplementedError,
+           "You must call #is_available? on a subclass of Writer"
     end
   end
 
-  #abstract base class for a Checker
+  # abstract base class for a Checker
   class Checker
     def check(issuer, serial)
-      raise NotImplementedError, "You must call #check on a subclass of Checker"
+      fail NotImplementedError, "You must call #check on a subclass of Checker"
     end
 
-    # is_available? is meant to be implemented to check if the backend store you choose to implement is currently working.
-    # see r509-ocsp-responder and r509-validity-redis for an example of use
+    # is_available? is meant to be implemented to check if the backend store
+    # you choose to implement is currently working. see r509-ocsp-responder
+    # and r509-validity-redis for an example of use
     def is_available?
-      raise NotImplementedError, "You must call #is_available? on a subclass of Checker"
+      fail NotImplementedError,
+           "You must call #is_available? on a subclass of Checker"
     end
   end
 
-  #default implementaton of the Checker class. Used for tests. DO NOT USE OTHERWISE
+  # default implementaton of the Checker class. Used for tests.
+  # DO NOT USE OTHERWISE
   class DefaultChecker < R509::Validity::Checker
     def check(issuer, serial)
       R509::Validity::Status.new(:status => R509::Validity::VALID)
@@ -79,7 +88,7 @@ module R509::Validity
     end
   end
 
-  #default implementaton of the Writer class. Does nothing (obviously)
+  # default implementaton of the Writer class. Does nothing (obviously)
   class DefaultWriter < R509::Validity::Writer
     def issue(issuer, serial)
     end

data/lib/r509/version.rb

@@ -1,4 +1,6 @@
+# A module for building an easy to use CA. Includes CSR, Certificate, and CRL
+# support.
 module R509
-  #The version of the r509 gem
-  VERSION="0.10.0"
+  # The version of the r509 gem
+  VERSION = "1.0"
 end

data/r509.yaml

@@ -23,7 +23,7 @@ certificate_authorities:
     crl_list_file: spec/fixtures/test_ca_crl_list.txt
     crl_number_file: spec/fixtures/test_ca_crl_number.txt
     crl_validity_hours: 168
-    crl_md: SHA1
+    crl_md: SHA256
     profiles:
       server:
         basic_constraints:
@@ -64,11 +64,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       client:
         basic_constraints:
           :ca: false
@@ -91,11 +90,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       email:
         basic_constraints:
           :ca: false
@@ -118,11 +116,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       clientserver:
         basic_constraints:
           :ca: false
@@ -146,11 +143,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       codesigning:
         basic_constraints:
           :ca: false
@@ -172,11 +168,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       timestamping:
         basic_constraints:
           :ca: false
@@ -198,11 +193,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       subroot:
         basic_constraints:
           :ca: true
@@ -261,11 +255,10 @@ certificate_authorities:
           :value:
           - :type: URI
             :value: http://crl.domain.com/test_ca.crl
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1
       ocsp_delegate:
         basic_constraints:
           :ca: false
@@ -282,8 +275,7 @@ certificate_authorities:
         ocsp_no_check:
           :critical: false
           :value: true
-        default_md: SHA1
+        default_md: SHA256
         allowed_mds:
         - SHA256
         - SHA512
-        - SHA1