ruby_scep 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: be639a9b514a63be0075c577e716aab3076c4e29
-  data.tar.gz: 63cc039f8f0cc54436b3688d23e946282b38f562
+SHA256:
+  metadata.gz: 8641a708f5a69bdc558fb7b8ca8734e65dee33db559aebc26a1a3d1e5d4fba38
+  data.tar.gz: 7fa9f5520c8dae4d7d11ed09920a62206eb69ff90c7d97e075b5ae540715ada9
 SHA512:
-  metadata.gz: 47b704260abacb4787a1db950a1f19995181c04e2bc0d8fe5b13a91956772248ef7382ff5aaed647db0eba7200973c48135ce61ff840dd554d84d387630db0f5
-  data.tar.gz: 525f5dc3960a13fc3a4fe42fda7a36f91c36aab60ab430dc6c03698a8e7adf8e2893b67c50fbd646729fd1cc6f4584ecf284986a05ba9f5023401987d947dbe6
+  metadata.gz: 27f97adb6d2bf739f0f76430fbe9e1a44736fe7b3af88a40d7cfaba4d0821e50b9297353a8e16d91683da73a94a6bbf561ce9a3b5b0cbea53179633780ecb0e1
+  data.tar.gz: fc7f39457151f5c85ef71e20757d52bcfbdc17f7331a32856ac854bf26170f786fd4edecbaf5865674b4bf1c0ea9a548d41225f0df45a1d0694b0ba0cda0f268

data/.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  # Pushes to the default branch run here; every other branch is covered by
+  # pull_request. Matching '**' as well would fire both events for one push and
+  # duplicate every check on the pull request.
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ['3.2', '3.3', '3.4']
+
+    name: Ruby ${{ matrix.ruby }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Run tests
+        run: bundle exec rspec spec --format progress

data/CHANGELOG.md

@@ -1,6 +1,49 @@
 Changelog
 =========
 
+v0.3.0 (24/08/2026)
+-------------------
+
+Issued certificates change. Nothing already issued is invalidated, and no
+method signature changes, but a device enrolling against this version gets a
+materially different certificate.
+
+### Certificates
+
+- Issue X.509 v3. `version` was set to 1, which encodes **v2**, while a
+  `keyUsage` extension was attached -- and extensions are only legal in v3, so
+  the certificate was structurally invalid. Relying parties that enforce the
+  version/extension rule reject such a certificate.
+- Sign certificates with SHA-256 instead of SHA-1.
+- Add `basicConstraints CA:FALSE`, `subjectKeyIdentifier` and
+  `authorityKeyIdentifier`, and mark `keyUsage` critical.
+- Derive `subjectKeyIdentifier` per RFC 7093 method 1 -- the leftmost 160 bits of
+  SHA-256 over the subjectPublicKey BIT STRING -- rather than OpenSSL's SHA-1
+  `hash` keyword.
+- Carry over a `subjectAltName` requested through the CSR's `extensionRequest`
+  attribute, under an allowlist. Requests for `basicConstraints`, `keyUsage` or
+  `extendedKeyUsage` are dropped: a CSR will ask to become a CA, and must not be
+  granted it. A requested extension cannot displace one this gem sets, repeated
+  OIDs collapse to one, and a carried `subjectAltName` is forced non-critical.
+- `extendedKeyUsage` is deliberately still unset. Restricting it to `clientAuth`
+  makes OpenSSL's `PKCS7#verify` reject the certificate for S/MIME signing, which
+  is the purpose it checks by default and therefore how a device's signed
+  requests are authenticated. Setting it requires the verifying side to use
+  `store.purpose = OpenSSL::X509::PURPOSE_ANY` first.
+
+### Tooling
+
+- Fix the test suite on Ruby 3: `Factories.build` now forwards keyword arguments,
+  which Ruby 3 no longer converts from a trailing Hash. The whole suite was
+  failing before this.
+- Replace `OpenSSL::PKCS7::SignerInfo#name` with `#issuer` in the specs; the
+  former was removed from the openssl gem.
+- Replace the deprecated `OpenSSL::Cipher::Cipher` alias with `OpenSSL::Cipher`.
+  Same class, no behaviour change.
+- Stop committing the library `Gemfile.lock`, and declare development
+  dependencies once, in the gemspec.
+- Require Ruby >= 3.2 and test against 3.2, 3.3 and 3.4 in CI (was 2.3-2.5).
+
 v0.2.1 (17/10/2017)
 -------------------
 

data/README.md

@@ -1,4 +1,4 @@
-Ruby SCEP [![CircleCI](https://circleci.com/gh/appaloosa-store/ruby_scep.svg?style=svg)](https://circleci.com/gh/appaloosa-store/ruby_scep)
+Ruby SCEP [![CI](https://github.com/appaloosa-store/ruby_scep/actions/workflows/ci.yml/badge.svg)](https://github.com/appaloosa-store/ruby_scep/actions/workflows/ci.yml)
 ---
 A Ruby gem to handle SCEP.
 

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/example_server/Gemfile

@@ -1,4 +1,4 @@
-source 'http://rubygems.org'
-ruby '2.4.1'
+source 'https://rubygems.org'
+ruby '2.5.3'
 gem 'sinatra'
-gem 'ruby_scep', path: '../'
+gem 'ruby_scep', path: '../'

data/example_server/Gemfile.lock

@@ -1,19 +1,19 @@
 PATH
   remote: ..
   specs:
-    ruby_scep (0.1.0)
+    ruby_scep (0.2.1)
 
 GEM
-  remote: http://rubygems.org/
+  remote: https://rubygems.org/
   specs:
-    mustermann (1.0.1)
-    rack (2.0.3)
-    rack-protection (2.0.0)
+    mustermann (1.0.3)
+    rack (2.0.6)
+    rack-protection (2.0.4)
       rack
-    sinatra (2.0.0)
+    sinatra (2.0.4)
       mustermann (~> 1.0)
       rack (~> 2.0)
-      rack-protection (= 2.0.0)
+      rack-protection (= 2.0.4)
       tilt (~> 2.0)
     tilt (2.0.8)
 
@@ -25,7 +25,7 @@ DEPENDENCIES
   sinatra
 
 RUBY VERSION
-   ruby 2.4.1p111
+   ruby 2.5.3p105
 
 BUNDLED WITH
-   1.15.3
+   1.17.1

data/lib/ruby_scep/certificate_builder.rb

@@ -1,27 +1,116 @@
 # frozen_string_literal: true
+require 'securerandom'
+
 module RubyScep
   class CertificateBuilder
+    ONE_YEAR_IN_NUMBER_OF_SECONDS = 31_536_000
+
+    # Serial numbers must be positive and fit in 20 octets (RFC 5280 4.1.2.2).
+    SERIAL_BITS = 159
+
+    # RFC 7093 method 1 truncates the subjectKeyIdentifier to the leftmost
+    # 160 bits.
+    SKI_LENGTH = 20
+
+    # Extensions a CSR is allowed to influence. A device may legitimately ask
+    # for the names it will be known by; it may not ask to become a CA, nor to
+    # widen its own key usage. Everything outside this list is dropped rather
+    # than honoured -- a CSR requesting `basicConstraints CA:TRUE` must never
+    # produce a certificate that can sign others, and it will ask.
+    COPYABLE_EXTENSIONS = %w[subjectAltName].freeze
+
     class << self
-      ONE_YEAR_IN_NUMBER_OF_SECONDS = 31536000
+      # @param csr [OpenSSL::X509::Request] the decrypted certificate request
+      # @return [OpenSSL::X509::Certificate] an unsigned certificate
       def build(csr)
+        ca = RubyScep.configuration.ca
+        now = Time.now
+
         certificate = OpenSSL::X509::Certificate.new
-        certificate.serial = Random.rand(730750818665451459101842416358141509827966271488) # will need to improve that
-        certificate.version = 1
+        # 2 means X.509 v3: the version field is zero-indexed, and the
+        # extensions added below are only legal in v3.
+        certificate.version = 2
+        certificate.serial = generate_serial
         certificate.public_key = csr.public_key
-        certificate.issuer = RubyScep.configuration.ca.subject
+        certificate.issuer = ca.subject
         certificate.subject = csr.subject
-        certificate.not_before = Time.now
-        certificate.not_after = Time.now + ONE_YEAR_IN_NUMBER_OF_SECONDS
-        extension_factory = OpenSSL::X509::ExtensionFactory.new
-        extension_factory.subject_certificate = certificate
-        extension_factory.subject_request = csr
-        extension_factory.issuer_certificate = RubyScep.configuration.ca
+        certificate.not_before = now
+        certificate.not_after = now + ONE_YEAR_IN_NUMBER_OF_SECONDS
+
+        add_extensions(certificate, csr, ca)
+
+        certificate
+      end
+
+      private
+
+      def add_extensions(certificate, csr, ca)
+        factory = OpenSSL::X509::ExtensionFactory.new
+        factory.subject_certificate = certificate
+        factory.subject_request = csr
+        factory.issuer_certificate = ca
+
+        certificate.add_extension(factory.create_extension('basicConstraints', 'CA:FALSE', true))
         certificate.add_extension(
-          extension_factory.create_extension(
-            'keyUsage', 'digitalSignature,keyEncipherment'
-          )
+          factory.create_extension('keyUsage', 'digitalSignature,keyEncipherment', true)
         )
-        certificate
+        # No extendedKeyUsage here, deliberately. Restricting EKU to clientAuth
+        # makes OpenSSL's PKCS7#verify reject the certificate for S/MIME
+        # signing, which is the purpose it checks by default -- and that is how
+        # a device's signed requests are authenticated. Adding it requires the
+        # verifying side to set `store.purpose = OpenSSL::X509::PURPOSE_ANY`
+        # first, which keeps chain validation while dropping the purpose check.
+        certificate.add_extension(
+          factory.create_extension('subjectKeyIdentifier', subject_key_identifier(certificate.public_key))
+        )
+        # keyid here is a copy of the issuer's own subjectKeyIdentifier, so this
+        # follows whatever derivation the CA certificate used.
+        certificate.add_extension(factory.create_extension('authorityKeyIdentifier', 'keyid,issuer'))
+
+        server_set = certificate.extensions.map(&:oid)
+        copyable_extensions(csr, server_set).each { |extension| certificate.add_extension(extension) }
+      end
+
+      # @param already_set [Array<String>] OIDs this builder has already decided
+      def copyable_extensions(csr, already_set)
+        requested_extensions(csr)
+          .select { |extension| COPYABLE_EXTENSIONS.include?(extension.oid) }
+          .reject { |extension| already_set.include?(extension.oid) }
+          .uniq(&:oid)
+          .each { |extension| extension.critical = false }
+      end
+
+      # Extensions the CSR asked for through its extensionRequest attribute.
+      # A malformed attribute is ignored rather than raised on: this builder
+      # decides policy, it does not validate the request.
+      def requested_extensions(csr)
+        attribute = csr.attributes.find do |candidate|
+          %w[extReq extensionRequest msExtReq].include?(candidate.oid)
+        end
+        return [] if attribute.nil?
+
+        attribute.value.value.first.value.map { |asn1| OpenSSL::X509::Extension.new(asn1) }
+      rescue StandardError
+        []
+      end
+
+      def generate_serial
+        SecureRandom.random_number((1 << SERIAL_BITS) - 1) + 1
+      end
+
+      # RFC 7093 method 1: the leftmost 160 bits of SHA-256 over the
+      # subjectPublicKey BIT STRING contents, excluding the tag, length and
+      # unused-bits octet. OpenSSL's `hash` keyword would derive this with SHA-1
+      # instead (RFC 5280 4.2.1.2 method 1). This matches the derivation the CA
+      # uses, and micromdm's cryptoutil.GenerateSubjectKeyID.
+      #
+      # The BIT STRING contents are the second element of SubjectPublicKeyInfo,
+      # which for RSA is the RSAPublicKey DER -- already stripped of exactly what
+      # the RFC excludes.
+      def subject_key_identifier(public_key)
+        bit_string = OpenSSL::ASN1.decode(public_key.to_der).value[1].value
+        OpenSSL::Digest::SHA256.digest(bit_string)[0, SKI_LENGTH]
+                               .unpack1('H*').upcase.scan(/../).join(':')
       end
     end
   end

data/lib/ruby_scep/pki_message.rb

@@ -89,7 +89,7 @@ module RubyScep
     # The certificate will be embedded in the PKIMessage response to complete the SCEP process.
     def generate_device_certificate!(csr)
       certificate = CertificateBuilder.build(csr)
-      certificate.sign(RubyScep.configuration.ca_key, OpenSSL::Digest::SHA1.new)
+      certificate.sign(RubyScep.configuration.ca_key, OpenSSL::Digest.new('SHA256'))
       @device_certificate = certificate
     end
 
@@ -103,7 +103,7 @@ module RubyScep
     end
 
     def encrypt_payload(der)
-      des = OpenSSL::Cipher::Cipher.new('des-ede3-cbc')
+      des = OpenSSL::Cipher.new('des-ede3-cbc')
       des.encrypt
       encryption_key = des.random_key
       encryption_iv = des.random_iv

data/lib/ruby_scep/version.rb

@@ -3,7 +3,7 @@
 
 module RubyScep
   module Version
-    STRING = '0.2.1'
+    STRING = '0.3.0'
 
     module_function
 

data/ruby_scep.gemspec

@@ -7,7 +7,7 @@ Gem::Specification.new do |s|
   s.name = 'ruby_scep'
   s.version = RubyScep::Version::STRING
   s.platform = Gem::Platform::RUBY
-  s.required_ruby_version = '>= 2.3.0'
+  s.required_ruby_version = '>= 3.2.0'
   s.authors = ['Christophe Valentin']
   s.description = <<-EOF
    Ruby implementation of SCEP
@@ -28,7 +28,8 @@ Gem::Specification.new do |s|
 
   s.summary = 'Ruby implementation of SCEP'
 
-  s.add_development_dependency('rspec', '~> 3.6')
-  s.add_development_dependency('rspec-its', '~> 1.2.0')
-  s.add_development_dependency('timecop', '~> 0.9.1')
-end
+  s.add_development_dependency('rake', '~> 13.0')
+  s.add_development_dependency('rspec', '~> 3.13')
+  s.add_development_dependency('rspec-its', '~> 2.0')
+  s.add_development_dependency('timecop', '~> 0.9')
+end

metadata

@@ -1,57 +1,70 @@
 --- !ruby/object:Gem::Specification
 name: ruby_scep
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Christophe Valentin
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-17 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.13'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.13'
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: '0.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: '0.9'
 description: "   Ruby implementation of SCEP\n"
 email: dev@appaloosa-store.com
 executables: []
@@ -59,11 +72,11 @@ extensions: []
 extra_rdoc_files:
 - README.md
 files:
-- ".circleci/config.yml"
+- ".github/workflows/ci.yml"
 - CHANGELOG.md
-- Gemfile.lock
 - License
 - README.md
+- Rakefile
 - example_server/Gemfile
 - example_server/Gemfile.lock
 - example_server/Procfile
@@ -86,7 +99,6 @@ homepage: https://github.com/appaloosa-store/ruby_scep
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -94,16 +106,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14
-signing_key: 
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Ruby implementation of SCEP
 test_files: []

data/.circleci/config.yml

@@ -1,30 +0,0 @@
-version: 2.0
-jobs:
-  "ruby-2.3":
-    docker:
-      - image: circleci/ruby:2.3-node
-    working_directory: ~/ruby_scep
-    steps:
-      - checkout
-      - run: bundle install --path vendor/bundle
-      - run:
-          name: Run tests
-          command: bundle exec rspec spec --format progress
-
-  "ruby-2.4":
-    docker:
-      - image: circleci/ruby:2.4-node
-    working_directory: ~/ruby_scep
-    steps:
-      - checkout
-      - run: bundle install --path vendor/bundle
-      - run:
-          name: Run tests
-          command: bundle exec rspec spec --format progress
-
-workflows:
-  version: 2
-  build:
-    jobs:
-      - "ruby-2.3"
-      - "ruby-2.4"

data/Gemfile.lock

@@ -1,40 +0,0 @@
-GEM
-  remote: http://rubygems.org/
-  specs:
-    coderay (1.1.1)
-    diff-lcs (1.3)
-    method_source (0.8.2)
-    pry (0.10.4)
-      coderay (~> 1.1.0)
-      method_source (~> 0.8.1)
-      slop (~> 3.4)
-    rspec (3.6.0)
-      rspec-core (~> 3.6.0)
-      rspec-expectations (~> 3.6.0)
-      rspec-mocks (~> 3.6.0)
-    rspec-core (3.6.0)
-      rspec-support (~> 3.6.0)
-    rspec-expectations (3.6.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.6.0)
-    rspec-its (1.2.0)
-      rspec-core (>= 3.0.0)
-      rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.6.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.6.0)
-    rspec-support (3.6.0)
-    slop (3.6.0)
-    timecop (0.9.1)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  pry
-  rspec
-  rspec-its
-  timecop
-
-BUNDLED WITH
-   1.15.3