rubygems-update 2.0.17 → 2.1.0.rc.1

data/lib/rubygems/request_set.rb

@@ -5,178 +5,176 @@ require 'rubygems/dependency_list'
 require 'rubygems/installer'
 require 'tsort'
 
-module Gem
-  class RequestSet
+class Gem::RequestSet
 
-    include TSort
+  include TSort
 
-    def initialize(*deps)
-      @dependencies = deps
+  ##
+  # Array of gems to install even if already installed
 
-      yield self if block_given?
-    end
+  attr_reader :always_install
 
-    attr_reader :dependencies
+  attr_reader :dependencies
 
-    # Declare that a gem of name +name+ with +reqs+ requirements
-    # is needed.
-    #
-    def gem(name, *reqs)
-      @dependencies << Gem::Dependency.new(name, reqs)
-    end
+  attr_accessor :development
 
-    # Add +deps+ Gem::Depedency objects to the set.
-    #
-    def import(deps)
-      @dependencies += deps
-    end
+  ##
+  # Treat missing dependencies as silent errors
 
-    # Resolve the requested dependencies and return an Array of
-    # Specification objects to be activated.
-    #
-    def resolve(set=nil)
-      r = Gem::DependencyResolver.new(@dependencies, set)
-      @requests = r.resolve
-    end
+  attr_accessor :soft_missing
 
-    # Resolve the requested dependencies against the gems
-    # available via Gem.path and return an Array of Specification
-    # objects to be activated.
-    #
-    def resolve_current
-      resolve DependencyResolver::CurrentSet.new
-    end
+  def initialize *deps
+    @dependencies = deps
 
-    # Load a dependency management file.
-    #
-    def load_gemdeps(path)
-      gf = GemDepedencyAPI.new(self, path)
-      gf.load
-    end
+    @always_install = []
+    @development    = false
+    @soft_missing   = false
 
-    def specs
-      @specs ||= @requests.map { |r| r.full_spec }
-    end
+    yield self if block_given?
+  end
 
-    def tsort_each_node(&block)
-      @requests.each(&block)
-    end
+  ##
+  # Declare that a gem of name +name+ with +reqs+ requirements is needed.
 
-    def tsort_each_child(node)
-      node.spec.dependencies.each do |dep|
-        next if dep.type == :development
-
-        match = @requests.find { |r| dep.match? r.spec.name, r.spec.version }
-        if match
-          begin
-            yield match
-          rescue TSort::Cyclic
-          end
-        else
-          raise Gem::DependencyError, "Unresolved depedency found during sorting - #{dep}"
-        end
-      end
-    end
+  def gem name, *reqs
+    @dependencies << Gem::Dependency.new(name, reqs)
+  end
+
+  ##
+  # Add +deps+ Gem::Dependency objects to the set.
+
+  def import deps
+    @dependencies += deps
+  end
 
-    def sorted_requests
-      @sorted ||= strongly_connected_components.flatten
+  def install options, &block
+    if dir = options[:install_dir]
+      return install_into dir, false, options, &block
     end
 
-    def specs_in(dir)
-      Dir["#{dir}/specifications/*.gemspec"].map do |g|
-        Gem::Specification.load g
+    cache_dir = options[:cache_dir] || Gem.dir
+
+    specs = []
+
+    sorted_requests.each do |req|
+      if req.installed? and
+         @always_install.none? { |spec| spec == req.spec.spec } then
+        yield req, nil if block_given?
+        next
       end
-    end
 
-    def install_into(dir, force=true, &b)
-      existing = force ? [] : specs_in(dir)
+      path = req.download cache_dir
 
-      dir = File.expand_path dir
+      inst = Gem::Installer.new path, options
 
-      installed = []
+      yield req, inst if block_given?
 
-      sorted_requests.each do |req|
-        if existing.find { |s| s.full_name == req.spec.full_name }
-          b.call req, nil if b
-          next
-        end
+      specs << inst.install
+    end
 
-        path = req.download(dir)
+    specs
+  end
 
-        inst = Gem::Installer.new path, :install_dir => dir,
-                                        :only_install_dir => true
+  def install_into dir, force = true, options = {}
+    existing = force ? [] : specs_in(dir)
+    existing.delete_if { |s| @always_install.include? s }
 
-        b.call req, inst if b
+    dir = File.expand_path dir
 
-        inst.install
+    installed = []
 
-        installed << req
+    sorted_requests.each do |req|
+      if existing.find { |s| s.full_name == req.spec.full_name }
+        yield req, nil if block_given?
+        next
       end
 
-      installed
-    end
+      path = req.download(dir)
 
-    def install(options, &b)
-      if dir = options[:install_dir]
-        return install_into(dir, false, &b)
+      unless path then # already installed
+        yield req, nil if block_given?
+        next
       end
 
-      cache_dir = options[:cache_dir] || Gem.dir
+      options[:install_dir] = dir
+      options[:only_install_dir] = true
 
-      specs = []
+      inst = Gem::Installer.new path, options
 
-      sorted_requests.each do |req|
-        if req.installed?
-          b.call req, nil if b
-          next
-        end
+      yield req, inst if block_given?
 
-        path = req.download cache_dir
+      inst.install
 
-        inst = Gem::Installer.new path, options
+      installed << req
+    end
 
-        b.call req, inst if b
+    installed
+  end
 
-        specs << inst.install
-      end
+  ##
+  # Load a dependency management file.
 
-      specs
-    end
+  def load_gemdeps path
+    gf = Gem::RequestSet::GemDepedencyAPI.new self, path
+    gf.load
+  end
 
-    # A semi-compatible DSL for Bundler's Gemfile format
-    #
-    class GemDepedencyAPI
-      def initialize(set, path)
-        @set = set
-        @path = path
-      end
+  ##
+  # Resolve the requested dependencies and return an Array of Specification
+  # objects to be activated.
 
-      def load
-        instance_eval File.read(@path).untaint, @path, 1
-      end
+  def resolve set = nil
+    resolver = Gem::DependencyResolver.new @dependencies, set
+    resolver.development  = @development
+    resolver.soft_missing = @soft_missing
 
-      # DSL
+    @requests = resolver.resolve
+  end
 
-      def source(url)
-      end
+  ##
+  # Resolve the requested dependencies against the gems available via Gem.path
+  # and return an Array of Specification objects to be activated.
 
-      def gem(name, *reqs)
-        # Ignore the opts for now.
-        reqs.pop if reqs.last.kind_of?(Hash)
+  def resolve_current
+    resolve Gem::DependencyResolver::CurrentSet.new
+  end
 
-        @set.gem name, *reqs
-      end
+  def sorted_requests
+    @sorted ||= strongly_connected_components.flatten
+  end
 
-      def platform(what)
-        if what == :ruby
-          yield
-        end
-      end
+  def specs
+    @specs ||= @requests.map { |r| r.full_spec }
+  end
+
+  def specs_in dir
+    Dir["#{dir}/specifications/*.gemspec"].map do |g|
+      Gem::Specification.load g
+    end
+  end
+
+  def tsort_each_node &block # :nodoc:
+    @requests.each(&block)
+  end
 
-      alias_method :platforms, :platform
+  def tsort_each_child node # :nodoc:
+    node.spec.dependencies.each do |dep|
+      next if dep.type == :development and not @development
 
-      def group(*what)
+      match = @requests.find { |r| dep.match? r.spec.name, r.spec.version }
+      if match
+        begin
+          yield match
+        rescue TSort::Cyclic
+        end
+      else
+        unless @soft_missing
+          raise Gem::DependencyError, "Unresolved depedency found during sorting - #{dep}"
+        end
       end
     end
   end
+
 end
+
+require 'rubygems/request_set/gem_dependency_api'

data/lib/rubygems/request_set/gem_dependency_api.rb

@@ -0,0 +1,39 @@
+##
+# A semi-compatible DSL for Bundler's Gemfile format
+
+class Gem::RequestSet::GemDepedencyAPI
+
+  def initialize set, path
+    @set = set
+    @path = path
+  end
+
+  def load
+    instance_eval File.read(@path).untaint, @path, 1
+  end
+
+  # :category: Bundler Gemfile DSL
+
+  def gem name, *reqs
+    # Ignore the opts for now.
+    reqs.pop if reqs.last.kind_of?(Hash)
+
+    @set.gem name, *reqs
+  end
+
+  def group *what
+  end
+
+  def platform what
+    if what == :ruby
+      yield
+    end
+  end
+
+  alias :platforms :platform
+
+  def source url
+  end
+
+end
+

data/lib/rubygems/security.rb

@@ -12,20 +12,6 @@ begin
 rescue LoadError => e
   raise unless (e.respond_to?(:path) && e.path == 'openssl') ||
                e.message =~ / -- openssl$/
-
-  module OpenSSL # :nodoc:
-    class Digest # :nodoc:
-      class SHA1 # :nodoc:
-        def name
-          'SHA1'
-        end
-      end
-    end
-    module PKey # :nodoc:
-      class RSA # :nodoc:
-      end
-    end
-  end
 end
 
 ##
@@ -352,23 +338,38 @@ module Gem::Security
   ##
   # Digest algorithm used to sign gems
 
-  DIGEST_ALGORITHM = OpenSSL::Digest::SHA1
+  DIGEST_ALGORITHM =
+    if defined?(OpenSSL::Digest) then
+      OpenSSL::Digest::SHA1
+    end
 
   ##
   # Used internally to select the signing digest from all computed digests
 
-  DIGEST_NAME = DIGEST_ALGORITHM.new.name # :nodoc:
+  DIGEST_NAME = # :nodoc:
+    if DIGEST_ALGORITHM then
+      DIGEST_ALGORITHM.new.name
+    end
 
   ##
   # Algorithm for creating the key pair used to sign gems
 
-  KEY_ALGORITHM = OpenSSL::PKey::RSA
+  KEY_ALGORITHM =
+    if defined?(OpenSSL::PKey) then
+      OpenSSL::PKey::RSA
+    end
 
   ##
   # Length of keys created by KEY_ALGORITHM
 
   KEY_LENGTH = 2048
 
+  ##
+  # Cipher used to encrypt the key pair used to sign gems.
+  # Must be in the list returned by OpenSSL::Cipher.ciphers
+
+  KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
+
   ##
   # One year in seconds
 
@@ -563,13 +564,18 @@ module Gem::Security
 
   ##
   # Writes +pemmable+, which must respond to +to_pem+ to +path+ with the given
-  # +permissions+.
+  # +permissions+. If passed +cipher+ and +passphrase+ those arguments will be
+  # passed to +to_pem+.
 
-  def self.write pemmable, path, permissions = 0600
+  def self.write pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER
     path = File.expand_path path
 
     open path, 'wb', permissions do |io|
-      io.write pemmable.to_pem
+      if passphrase and cipher
+        io.write pemmable.to_pem cipher, passphrase
+      else
+        io.write pemmable.to_pem
+      end
     end
 
     path
@@ -579,8 +585,11 @@ module Gem::Security
 
 end
 
-require 'rubygems/security/policy'
-require 'rubygems/security/policies'
+if defined?(OpenSSL::SSL) then
+  require 'rubygems/security/policy'
+  require 'rubygems/security/policies'
+  require 'rubygems/security/trust_dir'
+end
+
 require 'rubygems/security/signer'
-require 'rubygems/security/trust_dir'
 

data/lib/rubygems/security/policy.rb

@@ -1,3 +1,5 @@
+require 'rubygems/user_interaction'
+
 ##
 # A Gem::Security::Policy object encapsulates the settings for verifying
 # signed gem files.  This is the base class.  You can either declare an
@@ -6,6 +8,8 @@
 
 class Gem::Security::Policy
 
+  include Gem::UserInteraction
+
   attr_reader :name
 
   attr_accessor :only_signed
@@ -175,6 +179,19 @@ class Gem::Security::Policy
     true
   end
 
+  ##
+  # Extracts the email or subject from +certificate+
+
+  def subject certificate # :nodoc:
+    certificate.extensions.each do |extension|
+      next unless extension.oid == 'subjectAltName'
+
+      return extension.value
+    end
+
+    certificate.subject.to_s
+  end
+
   def inspect # :nodoc:
     ("[Policy: %s - data: %p signer: %p chain: %p root: %p " +
      "signed-only: %p trusted-only: %p]") % [
@@ -184,16 +201,21 @@ class Gem::Security::Policy
   end
 
   ##
-  # Verifies the certificate +chain+ is valid, the +digests+ match the
-  # signatures +signatures+ created by the signer depending on the +policy+
-  # settings.
+  # For +full_name+, verifies the certificate +chain+ is valid, the +digests+
+  # match the signatures +signatures+ created by the signer depending on the
+  # +policy+ settings.
   #
   # If +key+ is given it is used to validate the signing certificate.
 
-  def verify chain, key = nil, digests = {}, signatures = {}
-    if @only_signed and signatures.empty? then
-      raise Gem::Security::Exception,
-        "unsigned gems are not allowed by the #{name} policy"
+  def verify chain, key = nil, digests = {}, signatures = {},
+             full_name = '(unknown)'
+    if signatures.empty? then
+      if @only_signed then
+        raise Gem::Security::Exception,
+          "unsigned gems are not allowed by the #{name} policy"
+      else
+        alert_warning "#{full_name} is not signed"
+      end
     end
 
     opt       = @opt
@@ -222,7 +244,11 @@ class Gem::Security::Policy
 
     check_root chain, time if @verify_root
 
-    check_trust chain, digester, trust_dir if @only_trusted
+    if @only_trusted then
+      check_trust chain, digester, trust_dir
+    else
+      alert_warning "#{subject signer} is not trusted for #{full_name}"
+    end
 
     signatures.each do |file, _|
       digest = signer_digests[file]
@@ -252,7 +278,7 @@ class Gem::Security::Policy
       OpenSSL::X509::Certificate.new cert_pem
     end
 
-    verify chain, nil, digests, signatures
+    verify chain, nil, digests, signatures, spec.full_name
 
     true
   end