rubygems-update 2.6.0 → 3.4.22

data/test/rubygems/test_gem_remote_fetcher.rb

@@ -1,17 +1,16 @@
 # frozen_string_literal: true
-require 'rubygems/test_case'
-
-require 'webrick'
-begin
-  require 'webrick/https'
-rescue LoadError => e
-  raise unless (e.respond_to?(:path) && e.path == 'openssl') ||
-               e.message =~ / -- openssl$/
+
+require_relative "helper"
+
+require "webrick"
+require "webrick/https" if Gem::HAVE_OPENSSL
+
+unless Gem::HAVE_OPENSSL
+  warn "Skipping Gem::RemoteFetcher tests.  openssl not found."
 end
 
-require 'rubygems/remote_fetcher'
-require 'rubygems/package'
-require 'minitest/mock'
+require "rubygems/remote_fetcher"
+require "rubygems/package"
 
 # = Testing Proxy Settings
 #
@@ -28,7 +27,6 @@ require 'minitest/mock'
 # proxy is configured.
 
 class TestGemRemoteFetcher < Gem::TestCase
-
   include Gem::DefaultUserInteraction
 
   SERVER_DATA = <<-EOY
@@ -47,10 +45,8 @@ gems:
     author: Jim Weirich
     email: jim@weirichhouse.org
     homepage: http://rake.rubyforge.org
-    rubyforge_project: rake
     description: Rake is a Make-like program implemented in Ruby. Tasks and dependencies are specified in standard Ruby syntax.
     autorequire:
-    default_executable: rake
     bindir: bin
     has_rdoc: true
     required_ruby_version: !ruby/object:Gem::Version::Requirement
@@ -74,15 +70,12 @@ gems:
     dependencies: []
   EOY
 
-  PROXY_DATA = SERVER_DATA.gsub(/0.4.11/, '0.4.2')
-
-  DIR = File.expand_path(File.dirname(__FILE__))
+  PROXY_DATA = SERVER_DATA.gsub(/0.4.11/, "0.4.2")
 
   # Generated via:
   #   x = OpenSSL::PKey::DH.new(2048) # wait a while...
   #   x.to_s => pem
-  #   x.priv_key.to_s => hex for OpenSSL::BN.new
-  TEST_KEY_DH2048 =  OpenSSL::PKey::DH.new <<-_end_of_pem_
+  TEST_KEY_DH2048 = OpenSSL::PKey::DH.new <<-_END_OF_PEM_
 -----BEGIN DH PARAMETERS-----
 MIIBCAKCAQEA3Ze2EHSfYkZLUn557torAmjBgPsqzbodaRaGZtgK1gEU+9nNJaFV
 G1JKhmGUiEDyIW7idsBpe4sX/Wqjnp48Lr8IeI/SlEzLdoGpf05iRYXC8Cm9o8aM
@@ -91,18 +84,7 @@ cfmVgoSEAo9YLBpzoji2jHkO7Q5IPt4zxbTdlmmGFLc/GO9q7LGHhC+rcMcNTGsM
 NP0fuvVAIB158VnQ0liHSwcl6+9vE1mL0Jo/qEXQxl0+UdKDjaGfTsn6HIrwTnmJ
 PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
 -----END DH PARAMETERS-----
-    _end_of_pem_
-
-  TEST_KEY_DH2048.priv_key = OpenSSL::BN.new("108911488509734781344423639" \
-     "5585749502236089033416160524030987005037540379474123441273555416835" \
-     "4725688238369352738266590757370603937618499698665047757588998555345" \
-     "3446251978586372525530219375408331096098220027413238477359960428372" \
-     "0195464393332338164504352015535549496585792320286513563739305843396" \
-     "9294344974028713065472959376197728193162272314514335882399554394661" \
-     "5306385003430991221886779612878793446851681835397455333989268503748" \
-     "7862488679178398716189205737442996155432191656080664090596502674943" \
-     "7902481557157485795980326766117882761941455140582265347052939604724" \
-     "964857770053363840471912215799994973597613931991572884", 16)
+    _END_OF_PEM_
 
   def setup
     @proxies = %w[https_proxy http_proxy HTTP_PROXY http_proxy_user HTTP_PROXY_USER http_proxy_pass HTTP_PROXY_PASS no_proxy NO_PROXY]
@@ -110,33 +92,33 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     @proxies.each {|k| ENV[k] = nil }
 
     super
-    self.class.start_servers
-    self.class.enable_yaml = true
-    self.class.enable_zip = false
+    start_servers
+    self.enable_yaml = true
+    self.enable_zip = false
 
-    base_server_uri = "http://localhost:#{self.class.normal_server_port}"
-    @proxy_uri = "http://localhost:#{self.class.proxy_server_port}"
+    base_server_uri = "http://localhost:#{normal_server_port}"
+    @proxy_uri = "http://localhost:#{proxy_server_port}"
 
     @server_uri = base_server_uri + "/yaml"
     @server_z_uri = base_server_uri + "/yaml.Z"
 
-    # REFACTOR: copied from test_gem_dependency_installer.rb
-    @gems_dir = File.join @tempdir, 'gems'
     @cache_dir = File.join @gemhome, "cache"
-    FileUtils.mkdir @gems_dir
 
     # TODO: why does the remote fetcher need it written to disk?
-    @a1, @a1_gem = util_gem 'a', '1' do |s| s.executables << 'a_bin' end
-    @a1.loaded_from = File.join(@gemhome, 'specifications', @a1.full_name)
+    @a1, @a1_gem = util_gem "a", "1" do |s|
+      s.executables << "a_bin"
+    end
 
-    Gem::RemoteFetcher.fetcher = nil
+    @a1.loaded_from = File.join(@gemhome, "specifications", @a1.full_name)
 
+    Gem::RemoteFetcher.fetcher = nil
+    @stub_ui = Gem::MockGemUi.new
     @fetcher = Gem::RemoteFetcher.fetcher
   end
 
   def teardown
     @fetcher.close_all
-    self.class.stop_servers
+    stop_servers
     super
     Gem.configuration[:http_proxy] = nil
     @proxies.each_with_index {|k, i| ENV[k] = @old_proxies[i] }
@@ -149,7 +131,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_self_fetcher_with_proxy
-    proxy_uri = 'http://proxy.example.com'
+    proxy_uri = "http://proxy.example.com"
     Gem.configuration[:http_proxy] = proxy_uri
     Gem::RemoteFetcher.fetcher = nil
 
@@ -160,169 +142,85 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     assert_equal proxy_uri, fetcher.instance_variable_get(:@proxy).to_s
   end
 
-  def test_fetch_size_bad_uri
-    fetcher = Gem::RemoteFetcher.new nil
-    @fetcher = fetcher
-
-    e = assert_raises ArgumentError do
-      fetcher.fetch_size 'gems.example.com/yaml'
-    end
-
-    assert_equal 'uri scheme is invalid: nil', e.message
-  end
-
-  def test_fetch_size_socket_error
+  def test_fetch_path_bad_uri
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
-    def fetcher.request(uri, request_class, last_modified = nil)
-      raise SocketError, "tarded"
-    end
 
-    uri = 'http://gems.example.com/yaml'
-    e = assert_raises Gem::RemoteFetcher::FetchError do
-      fetcher.fetch_size uri
+    e = assert_raise ArgumentError do
+      @fetcher.fetch_path("gems.example.com/yaml", nil, true)
     end
 
-    assert_equal "SocketError: tarded (#{uri})", e.message
+    assert_equal "uri scheme is invalid: nil", e.message
   end
 
   def test_no_proxy
-    use_ui @ui do
+    use_ui @stub_ui do
       assert_data_from_server @fetcher.fetch_path(@server_uri)
-      assert_equal SERVER_DATA.size, @fetcher.fetch_size(@server_uri)
+      response = @fetcher.fetch_path(@server_uri, nil, true)
+      assert_equal SERVER_DATA.size, response["content-length"].to_i
     end
   end
 
-  def test_api_endpoint
-    uri = URI.parse "http://example.com/foo"
-    target = MiniTest::Mock.new
-    target.expect :target, "gems.example.com"
-
-    dns = MiniTest::Mock.new
-    dns.expect :getresource, target, [String, Object]
-
-    fetch = Gem::RemoteFetcher.new nil, dns
-    assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
-
-    target.verify
-    dns.verify
-  end
-
-  def test_api_endpoint_ignores_trans_domain_values
-    uri = URI.parse "http://gems.example.com/foo"
-    target = MiniTest::Mock.new
-    target.expect :target, "blah.com"
-
-    dns = MiniTest::Mock.new
-    dns.expect :getresource, target, [String, Object]
-
-    fetch = Gem::RemoteFetcher.new nil, dns
-    assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
-
-    target.verify
-    dns.verify
-  end
+  def test_cache_update_path
+    uri = URI "http://example/file"
+    path = File.join @tempdir, "file"
 
-  def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original
-    uri = URI.parse "http://example.com/foo"
-    target = MiniTest::Mock.new
-    target.expect :target, "example.combadguy.com"
+    fetcher = util_fuck_with_fetcher "hello"
 
-    dns = MiniTest::Mock.new
-    dns.expect :getresource, target, [String, Object]
+    data = fetcher.cache_update_path uri, path
 
-    fetch = Gem::RemoteFetcher.new nil, dns
-    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+    assert_equal "hello", data
 
-    target.verify
-    dns.verify
+    assert_equal "hello", File.read(path)
   end
 
-  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
-    uri = URI.parse "http://example.com/foo"
-    target = MiniTest::Mock.new
-    target.expect :target, "badexample.com"
-
-    dns = MiniTest::Mock.new
-    dns.expect :getresource, target, [String, Object]
+  def test_cache_update_path_with_utf8_internal_encoding
+    with_internal_encoding("UTF-8") do
+      uri = URI "http://example/file"
+      path = File.join @tempdir, "file"
+      data = String.new("\xC8").force_encoding(Encoding::BINARY)
 
-    fetch = Gem::RemoteFetcher.new nil, dns
-    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+      fetcher = util_fuck_with_fetcher data
 
-    target.verify
-    dns.verify
-  end
+      written_data = fetcher.cache_update_path uri, path
 
-  def test_api_endpoint_timeout_warning
-    uri = URI.parse "http://gems.example.com/foo"
-
-    dns = MiniTest::Mock.new
-    def dns.getresource arg, *rest
-      raise Resolv::ResolvError.new('timeout!')
-    end
-
-    fetch = Gem::RemoteFetcher.new nil, dns
-    begin
-      old_verbose, Gem.configuration.verbose = Gem.configuration.verbose, 1
-      endpoint = use_ui @ui do
-        fetch.api_endpoint(uri)
-      end
-    ensure
-      Gem.configuration.verbose = old_verbose
+      assert_equal data, written_data
+      assert_equal data, File.binread(path)
     end
-
-    assert_equal uri, endpoint
-
-    assert_equal "Getting SRV record failed: timeout!\n", @ui.output
-
-    dns.verify
-  end
-
-  def test_cache_update_path
-    uri = URI 'http://example/file'
-    path = File.join @tempdir, 'file'
-
-    fetcher = util_fuck_with_fetcher 'hello'
-
-    data = fetcher.cache_update_path uri, path
-
-    assert_equal 'hello', data
-
-    assert_equal 'hello', File.read(path)
   end
 
   def test_cache_update_path_no_update
-    uri = URI 'http://example/file'
-    path = File.join @tempdir, 'file'
+    uri = URI "http://example/file"
+    path = File.join @tempdir, "file"
 
-    fetcher = util_fuck_with_fetcher 'hello'
+    fetcher = util_fuck_with_fetcher "hello"
 
     data = fetcher.cache_update_path uri, path, false
 
-    assert_equal 'hello', data
+    assert_equal "hello", data
 
-    refute_path_exists path
+    assert_path_not_exist path
   end
 
-  def util_fuck_with_fetcher data, blow = false
+  def util_fuck_with_fetcher(data, blow = false)
     fetcher = Gem::RemoteFetcher.fetcher
     fetcher.instance_variable_set :@test_data, data
 
-    unless blow then
-      def fetcher.fetch_path arg, *rest
+    unless blow
+      def fetcher.fetch_path(arg, *rest)
         @test_arg = arg
         @test_data
       end
     else
-      def fetcher.fetch_path arg, *rest
+      def fetcher.fetch_path(arg, *rest)
         # OMG I'm such an ass
         class << self; remove_method :fetch_path; end
-        def self.fetch_path arg, *rest
+        def self.fetch_path(arg, *rest)
           @test_arg = arg
           @test_data
         end
 
-        raise Gem::RemoteFetcher::FetchError.new("haha!", nil)
+        raise Gem::RemoteFetcher::FetchError.new("haha!", "")
       end
     end
 
@@ -331,14 +229,14 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
 
   def test_download
     a1_data = nil
-    File.open @a1_gem, 'rb' do |fp|
+    File.open @a1_gem, "rb" do |fp|
       a1_data = fp.read
     end
 
     fetcher = util_fuck_with_fetcher a1_data
 
     a1_cache_gem = @a1.cache_file
-    assert_equal a1_cache_gem, fetcher.download(@a1, 'http://gems.example.com')
+    assert_equal a1_cache_gem, fetcher.download(@a1, "http://gems.example.com")
     assert_equal("http://gems.example.com/gems/a-1.gem",
                  fetcher.instance_variable_get(:@test_arg).to_s)
     assert File.exist?(a1_cache_gem)
@@ -346,29 +244,59 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
 
   def test_download_with_auth
     a1_data = nil
-    File.open @a1_gem, 'rb' do |fp|
+    File.open @a1_gem, "rb" do |fp|
       a1_data = fp.read
     end
 
     fetcher = util_fuck_with_fetcher a1_data
 
     a1_cache_gem = @a1.cache_file
-    assert_equal a1_cache_gem, fetcher.download(@a1, 'http://user:password@gems.example.com')
+    assert_equal a1_cache_gem, fetcher.download(@a1, "http://user:password@gems.example.com")
     assert_equal("http://user:password@gems.example.com/gems/a-1.gem",
                  fetcher.instance_variable_get(:@test_arg).to_s)
     assert File.exist?(a1_cache_gem)
   end
 
+  def test_download_with_token
+    a1_data = nil
+    File.open @a1_gem, "rb" do |fp|
+      a1_data = fp.read
+    end
+
+    fetcher = util_fuck_with_fetcher a1_data
+
+    a1_cache_gem = @a1.cache_file
+    assert_equal a1_cache_gem, fetcher.download(@a1, "http://token@gems.example.com")
+    assert_equal("http://token@gems.example.com/gems/a-1.gem",
+                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert File.exist?(a1_cache_gem)
+  end
+
+  def test_download_with_x_oauth_basic
+    a1_data = nil
+    File.open @a1_gem, "rb" do |fp|
+      a1_data = fp.read
+    end
+
+    fetcher = util_fuck_with_fetcher a1_data
+
+    a1_cache_gem = @a1.cache_file
+    assert_equal a1_cache_gem, fetcher.download(@a1, "http://token:x-oauth-basic@gems.example.com")
+    assert_equal("http://token:x-oauth-basic@gems.example.com/gems/a-1.gem",
+                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert File.exist?(a1_cache_gem)
+  end
+
   def test_download_with_encoded_auth
     a1_data = nil
-    File.open @a1_gem, 'rb' do |fp|
+    File.open @a1_gem, "rb" do |fp|
       a1_data = fp.read
     end
 
     fetcher = util_fuck_with_fetcher a1_data
 
     a1_cache_gem = @a1.cache_file
-    assert_equal a1_cache_gem, fetcher.download(@a1, 'http://user:%25pas%25sword@gems.example.com')
+    assert_equal a1_cache_gem, fetcher.download(@a1, "http://user:%25pas%25sword@gems.example.com")
     assert_equal("http://user:%25pas%25sword@gems.example.com/gems/a-1.gem",
                  fetcher.instance_variable_get(:@test_arg).to_s)
     assert File.exist?(a1_cache_gem)
@@ -379,7 +307,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
 
     inst = Gem::RemoteFetcher.fetcher
 
-    assert_equal @a1.cache_file, inst.download(@a1, 'http://gems.example.com')
+    assert_equal @a1.cache_file, inst.download(@a1, "http://gems.example.com")
   end
 
   def test_download_local
@@ -395,7 +323,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_download_local_space
-    space_path = File.join @tempdir, 'space path'
+    space_path = File.join @tempdir, "space path"
     FileUtils.mkdir space_path
     FileUtils.mv @a1_gem, space_path
     local_path = File.join space_path, @a1.file_name
@@ -409,17 +337,17 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_download_install_dir
-    a1_data = File.open @a1_gem, 'rb' do |fp|
+    a1_data = File.open @a1_gem, "rb" do |fp|
       fp.read
     end
 
     fetcher = util_fuck_with_fetcher a1_data
 
-    install_dir = File.join @tempdir, 'more_gems'
+    install_dir = File.join @tempdir, "more_gems"
 
     a1_cache_gem = File.join install_dir, "cache", @a1.file_name
     FileUtils.mkdir_p(File.dirname(a1_cache_gem))
-    actual = fetcher.download(@a1, 'http://gems.example.com', install_dir)
+    actual = fetcher.download(@a1, "http://gems.example.com", install_dir)
 
     assert_equal a1_cache_gem, actual
     assert_equal("http://gems.example.com/gems/a-1.gem",
@@ -428,12 +356,18 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     assert File.exist?(a1_cache_gem)
   end
 
-  unless win_platform? # File.chmod doesn't work
+  unless win_platform? || Process.uid.zero? # File.chmod doesn't work
     def test_download_local_read_only
       FileUtils.mv @a1_gem, @tempdir
       local_path = File.join @tempdir, @a1.file_name
       inst = nil
-      FileUtils.chmod 0555, @a1.cache_dir
+      FileUtils.chmod 0o555, @a1.cache_dir
+      begin
+        FileUtils.mkdir_p File.join(Gem.user_dir, "cache")
+      rescue StandardError
+        nil
+      end
+      FileUtils.chmod 0o555, File.join(Gem.user_dir, "cache")
 
       Dir.chdir @tempdir do
         inst = Gem::RemoteFetcher.fetcher
@@ -442,34 +376,35 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       assert_equal(File.join(@tempdir, @a1.file_name),
                    inst.download(@a1, local_path))
     ensure
-      FileUtils.chmod 0755, @a1.cache_dir
+      FileUtils.chmod 0o755, File.join(Gem.user_dir, "cache")
+      FileUtils.chmod 0o755, @a1.cache_dir
     end
 
     def test_download_read_only
-      FileUtils.chmod 0555, @a1.cache_dir
-      FileUtils.chmod 0555, @gemhome
+      FileUtils.chmod 0o555, @a1.cache_dir
+      FileUtils.chmod 0o555, @gemhome
 
       fetcher = util_fuck_with_fetcher File.read(@a1_gem)
-      fetcher.download(@a1, 'http://gems.example.com')
+      fetcher.download(@a1, "http://gems.example.com")
       a1_cache_gem = File.join Gem.user_dir, "cache", @a1.file_name
       assert File.exist? a1_cache_gem
     ensure
-      FileUtils.chmod 0755, @gemhome
-      FileUtils.chmod 0755, @a1.cache_dir
+      FileUtils.chmod 0o755, @gemhome
+      FileUtils.chmod 0o755, @a1.cache_dir
     end
   end
 
   def test_download_platform_legacy
-    original_platform = 'old-platform'
+    original_platform = "old-platform"
 
-    e1, e1_gem = util_gem 'e', '1' do |s|
+    e1, e1_gem = util_gem "e", "1" do |s|
       s.platform = Gem::Platform::CURRENT
       s.instance_variable_set :@original_platform, original_platform
     end
-    e1.loaded_from = File.join(@gemhome, 'specifications', e1.full_name)
+    e1.loaded_from = File.join(@gemhome, "specifications", e1.full_name)
 
     e1_data = nil
-    File.open e1_gem, 'rb' do |fp|
+    File.open e1_gem, "rb" do |fp|
       e1_data = fp.read
     end
 
@@ -477,7 +412,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
 
     e1_cache_gem = e1.cache_file
 
-    assert_equal e1_cache_gem, fetcher.download(e1, 'http://gems.example.com')
+    assert_equal e1_cache_gem, fetcher.download(e1, "http://gems.example.com")
 
     assert_equal("http://gems.example.com/gems/#{e1.original_name}.gem",
                  fetcher.instance_variable_get(:@test_arg).to_s)
@@ -504,20 +439,20 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   def test_download_unsupported
     inst = Gem::RemoteFetcher.fetcher
 
-    e = assert_raises ArgumentError do
-      inst.download @a1, 'ftp://gems.rubyforge.org'
+    e = assert_raise ArgumentError do
+      inst.download @a1, "ftp://gems.rubyforge.org"
     end
 
-    assert_equal 'unsupported URI scheme ftp', e.message
+    assert_equal "unsupported URI scheme ftp", e.message
   end
 
   def test_download_to_cache
-    @a2, @a2_gem = util_gem 'a', '2'
+    @a2, @a2_gem = util_gem "a", "2"
 
     util_setup_spec_fetcher @a1, @a2
     @fetcher.instance_variable_set :@a1, @a1
     @fetcher.instance_variable_set :@a2, @a2
-    def @fetcher.fetch_path uri, mtime = nil, head = false
+    def @fetcher.fetch_path(uri, mtime = nil, head = false)
       case uri.request_uri
       when /#{@a1.spec_name}/ then
         Gem.deflate Marshal.dump @a1
@@ -528,7 +463,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       end
     end
 
-    gem = Gem::RemoteFetcher.fetcher.download_to_cache dep 'a'
+    gem = Gem::RemoteFetcher.fetcher.download_to_cache dep "a"
 
     assert_equal @a2.file_name, File.basename(gem)
   end
@@ -538,10 +473,10 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     @fetcher = fetcher
 
     def fetcher.fetch_http(uri, mtime, head = nil)
-      Gem.gzip 'foo'
+      Gem::Util.gzip "foo"
     end
 
-    assert_equal 'foo', fetcher.fetch_path(@uri + 'foo.gz')
+    assert_equal "foo", fetcher.fetch_path(@uri + "foo.gz")
   end
 
   def test_fetch_path_gzip_unmodified
@@ -552,7 +487,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       nil
     end
 
-    assert_equal nil, fetcher.fetch_path(@uri + 'foo.gz', Time.at(0))
+    assert_nil fetcher.fetch_path(@uri + "foo.gz", Time.at(0))
   end
 
   def test_fetch_path_io_error
@@ -563,9 +498,9 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       raise EOFError
     end
 
-    url = 'http://example.com/uri'
+    url = "http://example.com/uri"
 
-    e = assert_raises Gem::RemoteFetcher::FetchError do
+    e = assert_raise Gem::RemoteFetcher::FetchError do
       fetcher.fetch_path url
     end
 
@@ -581,9 +516,9 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       raise SocketError
     end
 
-    url = 'http://example.com/uri'
+    url = "http://example.com/uri"
 
-    e = assert_raises Gem::RemoteFetcher::FetchError do
+    e = assert_raise Gem::RemoteFetcher::FetchError do
       fetcher.fetch_path url
     end
 
@@ -596,20 +531,76 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     @fetcher = fetcher
 
     def fetcher.fetch_http(uri, mtime = nil, head = nil)
-      raise Errno::ECONNREFUSED, 'connect(2)'
+      raise Errno::ECONNREFUSED, "connect(2)"
+    end
+
+    url = "http://example.com/uri"
+
+    e = assert_raise Gem::RemoteFetcher::FetchError do
+      fetcher.fetch_path url
+    end
+
+    assert_match %r{ECONNREFUSED:.*connect\(2\) \(#{Regexp.escape url}\)\z},
+                 e.message
+    assert_equal url, e.uri
+  end
+
+  def test_fetch_path_timeout_error
+    fetcher = Gem::RemoteFetcher.new nil
+    @fetcher = fetcher
+
+    def fetcher.fetch_http(uri, mtime = nil, head = nil)
+      raise Timeout::Error, "timed out"
+    end
+
+    url = "http://example.com/uri"
+
+    e = assert_raise Gem::RemoteFetcher::FetchError do
+      fetcher.fetch_path url
+    end
+
+    assert_match %r{Timeout::Error: timed out \(#{Regexp.escape url}\)\z},
+                 e.message
+    assert_equal url, e.uri
+  end
+
+  def test_fetch_path_getaddrinfo_error
+    fetcher = Gem::RemoteFetcher.new nil
+    @fetcher = fetcher
+
+    def fetcher.fetch_http(uri, mtime = nil, head = nil)
+      raise SocketError, "getaddrinfo: nodename nor servname provided"
     end
 
-    url = 'http://example.com/uri'
+    url = "http://example.com/uri"
 
-    e = assert_raises Gem::RemoteFetcher::FetchError do
+    e = assert_raise Gem::RemoteFetcher::FetchError do
       fetcher.fetch_path url
     end
 
-    assert_match %r|ECONNREFUSED:.*connect\(2\) \(#{Regexp.escape url}\)\z|,
+    assert_match %r{SocketError: getaddrinfo: nodename nor servname provided \(#{Regexp.escape url}\)\z},
                  e.message
     assert_equal url, e.uri
   end
 
+  def test_fetch_path_openssl_ssl_sslerror
+    fetcher = Gem::RemoteFetcher.new nil
+    @fetcher = fetcher
+
+    def fetcher.fetch_http(uri, mtime = nil, head = nil)
+      raise OpenSSL::SSL::SSLError
+    end
+
+    url = "http://example.com/uri"
+
+    e = assert_raise Gem::RemoteFetcher::FetchError do
+      fetcher.fetch_path url
+    end
+
+    assert_equal "OpenSSL::SSL::SSLError: OpenSSL::SSL::SSLError (#{url})", e.message
+    assert_equal url, e.uri
+  end
+
   def test_fetch_path_unmodified
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
@@ -618,12 +609,12 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
       nil
     end
 
-    assert_equal nil, fetcher.fetch_path(URI.parse(@gem_repo), Time.at(0))
+    assert_nil fetcher.fetch_path(URI.parse(@gem_repo), Time.at(0))
   end
 
   def test_implicit_no_proxy
-    use_ui @ui do
-      ENV['http_proxy'] = 'http://fakeurl:12345'
+    use_ui @stub_ui do
+      ENV["http_proxy"] = "http://fakeurl:12345"
       fetcher = Gem::RemoteFetcher.new :no_proxy
       @fetcher = fetcher
       assert_data_from_server fetcher.fetch_path(@server_uri)
@@ -631,8 +622,8 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_implicit_proxy
-    use_ui @ui do
-      ENV['http_proxy'] = @proxy_uri
+    use_ui @stub_ui do
+      ENV["http_proxy"] = @proxy_uri
       fetcher = Gem::RemoteFetcher.new nil
       @fetcher = fetcher
       assert_data_from_proxy fetcher.fetch_path(@server_uri)
@@ -640,8 +631,8 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_implicit_upper_case_proxy
-    use_ui @ui do
-      ENV['HTTP_PROXY'] = @proxy_uri
+    use_ui @stub_ui do
+      ENV["HTTP_PROXY"] = @proxy_uri
       fetcher = Gem::RemoteFetcher.new nil
       @fetcher = fetcher
       assert_data_from_proxy fetcher.fetch_path(@server_uri)
@@ -649,7 +640,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_implicit_proxy_no_env
-    use_ui @ui do
+    use_ui @stub_ui do
       fetcher = Gem::RemoteFetcher.new nil
       @fetcher = fetcher
       assert_data_from_server fetcher.fetch_path(@server_uri)
@@ -659,92 +650,284 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   def test_fetch_http
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
-    url = 'http://gems.example.com/redirect'
+    url = "http://gems.example.com/redirect"
 
     def fetcher.request(uri, request_class, last_modified = nil)
-      url = 'http://gems.example.com/redirect'
-      unless defined? @requested then
+      url = "http://gems.example.com/redirect"
+      unless defined? @requested
         @requested = true
         res = Net::HTTPMovedPermanently.new nil, 301, nil
-        res.add_field 'Location', url
+        res.add_field "Location", url
         res
       else
         res = Net::HTTPOK.new nil, 200, nil
-        def res.body() 'real_path' end
+        def res.body() "real_path" end
         res
       end
     end
 
     data = fetcher.fetch_http URI.parse(url)
 
-    assert_equal 'real_path', data
+    assert_equal "real_path", data
   end
 
   def test_fetch_http_redirects
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
-    url = 'http://gems.example.com/redirect'
+    url = "http://gems.example.com/redirect"
 
     def fetcher.request(uri, request_class, last_modified = nil)
-      url = 'http://gems.example.com/redirect'
+      url = "http://gems.example.com/redirect"
       res = Net::HTTPMovedPermanently.new nil, 301, nil
-      res.add_field 'Location', url
+      res.add_field "Location", url
       res
     end
 
-    e = assert_raises Gem::RemoteFetcher::FetchError do
+    e = assert_raise Gem::RemoteFetcher::FetchError do
       fetcher.fetch_http URI.parse(url)
     end
 
     assert_equal "too many redirects (#{url})", e.message
   end
 
+  def test_fetch_http_redirects_without_location
+    fetcher = Gem::RemoteFetcher.new nil
+    @fetcher = fetcher
+    url = "http://gems.example.com/redirect"
+
+    def fetcher.request(uri, request_class, last_modified = nil)
+      res = Net::HTTPMovedPermanently.new nil, 301, nil
+      res
+    end
+
+    e = assert_raise Gem::RemoteFetcher::FetchError do
+      fetcher.fetch_http URI.parse(url)
+    end
+
+    assert_equal "redirecting but no redirect location was given (#{url})", e.message
+  end
+
   def test_fetch_http_with_additional_headers
     ENV["http_proxy"] = @proxy_uri
     ENV["no_proxy"] = URI::parse(@server_uri).host
-    fetcher = Gem::RemoteFetcher.new nil, nil, {"X-Captain" => "murphy"}
+    fetcher = Gem::RemoteFetcher.new nil, nil, { "X-Captain" => "murphy" }
     @fetcher = fetcher
     assert_equal "murphy", fetcher.fetch_path(@server_uri)
   end
 
-  def test_fetch_s3
+  def assert_fetch_s3(url, signature, token=nil, region="us-east-1", instance_profile_json=nil)
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
-    url = 's3://testuser:testpass@my-bucket/gems/specs.4.8.gz'
     $fetched_uri = nil
+    $instance_profile = instance_profile_json
 
     def fetcher.request(uri, request_class, last_modified = nil)
       $fetched_uri = uri
       res = Net::HTTPOK.new nil, 200, nil
-      def res.body() 'success' end
+      def res.body() "success" end
       res
     end
 
-    def fetcher.s3_expiration
-      1395098371
+    def fetcher.s3_uri_signer(uri)
+      require "json"
+      s3_uri_signer = Gem::S3URISigner.new(uri)
+      def s3_uri_signer.ec2_metadata_credentials_json
+        JSON.parse($instance_profile)
+      end
+      # Running sign operation to make sure uri.query is not mutated
+      s3_uri_signer.sign
+      raise "URI query is not empty: #{uri.query}" unless uri.query.nil?
+      s3_uri_signer
     end
 
     data = fetcher.fetch_s3 URI.parse(url)
 
-    assert_equal 'https://my-bucket.s3.amazonaws.com/gems/specs.4.8.gz?AWSAccessKeyId=testuser&Expires=1395098371&Signature=eUTr7NkpZEet%2BJySE%2BfH6qukroI%3D', $fetched_uri.to_s
-    assert_equal 'success', data
+    assert_equal "https://my-bucket.s3.#{region}.amazonaws.com/gems/specs.4.8.gz?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=testuser%2F20190624%2F#{region}%2Fs3%2Faws4_request&X-Amz-Date=20190624T050641Z&X-Amz-Expires=86400#{token ? "&X-Amz-Security-Token=" + token : ""}&X-Amz-SignedHeaders=host&X-Amz-Signature=#{signature}", $fetched_uri.to_s
+    assert_equal "success", data
   ensure
     $fetched_uri = nil
   end
 
-  def test_fetch_s3_no_creds
+  def test_fetch_s3_config_creds
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :id => "testuser", :secret => "testpass" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "20f974027db2f3cd6193565327a7c73457a138efb1a63ea248d185ce6827d41b"
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_config_creds_with_region
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :id => "testuser", :secret => "testpass", :region => "us-west-2" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "4afc3010757f1fd143e769f1d1dabd406476a4fc7c120e9884fd02acbb8f26c9", nil, "us-west-2"
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_config_creds_with_token
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :id => "testuser", :secret => "testpass", :security_token => "testtoken" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "935160a427ef97e7630f799232b8f208c4a4e49aad07d0540572a2ad5fe9f93c", "testtoken"
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_env_creds
+    ENV["AWS_ACCESS_KEY_ID"] = "testuser"
+    ENV["AWS_SECRET_ACCESS_KEY"] = "testpass"
+    ENV["AWS_SESSION_TOKEN"] = nil
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "env" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "20f974027db2f3cd6193565327a7c73457a138efb1a63ea248d185ce6827d41b"
+    end
+  ensure
+    ENV.each_key {|key| ENV.delete(key) if key.start_with?("AWS") }
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_env_creds_with_region
+    ENV["AWS_ACCESS_KEY_ID"] = "testuser"
+    ENV["AWS_SECRET_ACCESS_KEY"] = "testpass"
+    ENV["AWS_SESSION_TOKEN"] = nil
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "env", :region => "us-west-2" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "4afc3010757f1fd143e769f1d1dabd406476a4fc7c120e9884fd02acbb8f26c9", nil, "us-west-2"
+    end
+  ensure
+    ENV.each_key {|key| ENV.delete(key) if key.start_with?("AWS") }
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_env_creds_with_token
+    ENV["AWS_ACCESS_KEY_ID"] = "testuser"
+    ENV["AWS_SECRET_ACCESS_KEY"] = "testpass"
+    ENV["AWS_SESSION_TOKEN"] = "testtoken"
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "env" },
+    }
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "935160a427ef97e7630f799232b8f208c4a4e49aad07d0540572a2ad5fe9f93c", "testtoken"
+    end
+  ensure
+    ENV.each_key {|key| ENV.delete(key) if key.start_with?("AWS") }
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_url_creds
+    url = "s3://testuser:testpass@my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "20f974027db2f3cd6193565327a7c73457a138efb1a63ea248d185ce6827d41b"
+    end
+  end
+
+  def test_fetch_s3_instance_profile_creds
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "instance_profile" },
+    }
+
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "20f974027db2f3cd6193565327a7c73457a138efb1a63ea248d185ce6827d41b", nil, "us-east-1",
+                      '{"AccessKeyId": "testuser", "SecretAccessKey": "testpass"}'
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_instance_profile_creds_with_region
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "instance_profile", :region => "us-west-2" },
+    }
+
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "4afc3010757f1fd143e769f1d1dabd406476a4fc7c120e9884fd02acbb8f26c9", nil, "us-west-2",
+                      '{"AccessKeyId": "testuser", "SecretAccessKey": "testpass"}'
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_instance_profile_creds_with_token
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :provider => "instance_profile" },
+    }
+
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    Time.stub :now, Time.at(1_561_353_581) do
+      assert_fetch_s3 url, "935160a427ef97e7630f799232b8f208c4a4e49aad07d0540572a2ad5fe9f93c", "testtoken", "us-east-1",
+                      '{"AccessKeyId": "testuser", "SecretAccessKey": "testpass", "Token": "testtoken"}'
+    end
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def refute_fetch_s3(url, expected_message)
     fetcher = Gem::RemoteFetcher.new nil
     @fetcher = fetcher
-    url = 's3://my-bucket/gems/specs.4.8.gz'
-    e = assert_raises Gem::RemoteFetcher::FetchError do
+
+    e = assert_raise Gem::RemoteFetcher::FetchError do
       fetcher.fetch_s3 URI.parse(url)
     end
 
-    assert_match "credentials needed", e.message
+    assert_match expected_message, e.message
+  end
+
+  def test_fetch_s3_no_source_key
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    refute_fetch_s3 url, "no s3_source key exists in .gemrc"
+  end
+
+  def test_fetch_s3_no_host
+    Gem.configuration[:s3_source] = {
+      "my-bucket" => { :id => "testuser", :secret => "testpass" },
+    }
+
+    url = "s3://other-bucket/gems/specs.4.8.gz"
+    refute_fetch_s3 url, "no key for host other-bucket in s3_source in .gemrc"
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_no_id
+    Gem.configuration[:s3_source] = { "my-bucket" => { :secret => "testpass" } }
+
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    refute_fetch_s3 url, "s3_source for my-bucket missing id or secret"
+  ensure
+    Gem.configuration[:s3_source] = nil
+  end
+
+  def test_fetch_s3_no_secret
+    Gem.configuration[:s3_source] = { "my-bucket" => { :id => "testuser" } }
+
+    url = "s3://my-bucket/gems/specs.4.8.gz"
+    refute_fetch_s3 url, "s3_source for my-bucket missing id or secret"
+  ensure
+    Gem.configuration[:s3_source] = nil
   end
 
   def test_observe_no_proxy_env_single_host
-    use_ui @ui do
+    use_ui @stub_ui do
       ENV["http_proxy"] = @proxy_uri
       ENV["no_proxy"] = URI::parse(@server_uri).host
       fetcher = Gem::RemoteFetcher.new nil
@@ -754,7 +937,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_observe_no_proxy_env_list
-    use_ui @ui do
+    use_ui @stub_ui do
       ENV["http_proxy"] = @proxy_uri
       ENV["no_proxy"] = "fakeurl.com, #{URI::parse(@server_uri).host}"
       fetcher = Gem::RemoteFetcher.new nil
@@ -768,7 +951,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     @fetcher = fetcher
 
     assert_throws :block_called do
-      fetcher.request URI('http://example'), Net::HTTP::Get do |req|
+      fetcher.request URI("http://example"), Net::HTTP::Get do |req|
         assert_kind_of Net::HTTPGenericRequest, req
         throw :block_called
       end
@@ -776,8 +959,8 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_yaml_error_on_size
-    use_ui @ui do
-      self.class.enable_yaml = false
+    use_ui @stub_ui do
+      self.enable_yaml = false
       fetcher = Gem::RemoteFetcher.new nil
       @fetcher = fetcher
       assert_error { fetcher.size }
@@ -785,22 +968,20 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_ssl_connection
-    ssl_server = self.class.start_ssl_server
-    temp_ca_cert = File.join(DIR, 'ca_cert.pem')
+    ssl_server = start_ssl_server
+    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/yaml")
     end
   end
 
   def test_ssl_client_cert_auth_connection
-    skip 'openssl is missing' unless defined?(OpenSSL::SSL)
-
-    ssl_server = self.class.start_ssl_server({
+    ssl_server = start_ssl_server({
       :SSLVerifyClient =>
-        OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT})
+        OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT })
 
-    temp_ca_cert = File.join(DIR, 'ca_cert.pem')
-    temp_client_cert = File.join(DIR, 'client.pem')
+    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
+    temp_client_cert = File.join(__dir__, "client.pem")
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" +
@@ -810,54 +991,68 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
   end
 
   def test_do_not_allow_invalid_client_cert_auth_connection
-    skip 'openssl is missing' unless defined?(OpenSSL::SSL)
-
-    ssl_server = self.class.start_ssl_server({
+    ssl_server = start_ssl_server({
       :SSLVerifyClient =>
-        OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT})
+        OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT })
 
-    temp_ca_cert = File.join(DIR, 'ca_cert.pem')
-    temp_client_cert = File.join(DIR, 'invalid_client.pem')
+    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
+    temp_client_cert = File.join(__dir__, "invalid_client.pem")
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" +
       ":ssl_client_cert: #{temp_client_cert}\n") do |fetcher|
-        assert_raises Gem::RemoteFetcher::FetchError do
-          fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/yaml")
-        end
+      assert_raise Gem::RemoteFetcher::FetchError do
+        fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/yaml")
+      end
     end
   end
 
   def test_do_not_allow_insecure_ssl_connection_by_default
-    ssl_server = self.class.start_ssl_server
+    ssl_server = start_ssl_server
     with_configured_fetcher do |fetcher|
-      assert_raises Gem::RemoteFetcher::FetchError do
+      assert_raise Gem::RemoteFetcher::FetchError do
         fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/yaml")
       end
     end
   end
 
   def test_ssl_connection_allow_verify_none
-    ssl_server = self.class.start_ssl_server
+    ssl_server = start_ssl_server
     with_configured_fetcher(":ssl_verify_mode: 0") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/yaml")
     end
   end
 
   def test_do_not_follow_insecure_redirect
-    ssl_server = self.class.start_ssl_server
-    temp_ca_cert = File.join(DIR, 'ca_cert.pem'),
+    ssl_server = start_ssl_server
+    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
+    expected_error_message =
+      "redirecting to non-https resource: #{@server_uri} (https://localhost:#{ssl_server.config[:Port]}/insecure_redirect?to=#{@server_uri})"
+
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
-      assert_raises Gem::RemoteFetcher::FetchError do
+      err = assert_raise Gem::RemoteFetcher::FetchError do
         fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}/insecure_redirect?to=#{@server_uri}")
       end
+
+      assert_equal(err.message, expected_error_message)
+    end
+  end
+
+  def test_nil_ca_cert
+    ssl_server = start_ssl_server
+    temp_ca_cert = nil
+
+    with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
+      assert_raise Gem::RemoteFetcher::FetchError do
+        fetcher.fetch_path("https://localhost:#{ssl_server.config[:Port]}")
+      end
     end
   end
 
   def with_configured_fetcher(config_str = nil, &block)
     if config_str
-      temp_conf = File.join @tempdir, '.gemrc'
-      File.open temp_conf, 'w' do |fp|
+      temp_conf = File.join @tempdir, ".gemrc"
+      File.open temp_conf, "w" do |fp|
         fp.puts config_str
       end
       Gem.configuration = Gem::ConfigFile.new %W[--config-file #{temp_conf}]
@@ -894,158 +1089,139 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     end
   end
 
-  class << self
-    attr_reader :normal_server, :proxy_server
-    attr_accessor :enable_zip, :enable_yaml
+  private
+
+  attr_reader :normal_server, :proxy_server
+  attr_accessor :enable_zip, :enable_yaml
+
+  def start_servers
+    @normal_server ||= start_server(SERVER_DATA)
+    @proxy_server  ||= start_server(PROXY_DATA)
+    @enable_yaml = true
+    @enable_zip = false
+    @ssl_server = nil
+    @ssl_server_thread = nil
+  end
 
-    def start_servers
-      @normal_server ||= start_server(SERVER_DATA)
-      @proxy_server  ||= start_server(PROXY_DATA)
-      @enable_yaml = true
-      @enable_zip = false
+  def stop_servers
+    if @normal_server
+      @normal_server.kill.join
+      @normal_server = nil
+    end
+    if @proxy_server
+      @proxy_server.kill.join
+      @proxy_server = nil
+    end
+    if @ssl_server
+      @ssl_server.stop
       @ssl_server = nil
+    end
+    if @ssl_server_thread
+      @ssl_server_thread.kill.join
       @ssl_server_thread = nil
     end
+    utils = WEBrick::Utils # TimeoutHandler is since 1.9
+    utils::TimeoutHandler.terminate if defined?(utils::TimeoutHandler.terminate)
+  end
 
-    def stop_servers
-      if @normal_server
-        @normal_server.kill.join
-        @normal_server = nil
-      end
-      if @proxy_server
-        @proxy_server.kill.join
-        @proxy_server = nil
-      end
-      if @ssl_server
-        @ssl_server.stop
-        @ssl_server = nil
-      end
-      if @ssl_server_thread
-        @ssl_server_thread.kill.join
-        @ssl_server_thread = nil
-      end
-      utils = WEBrick::Utils    # TimeoutHandler is since 1.9
-      utils::TimeoutHandler.terminate if defined?(utils::TimeoutHandler.terminate)
-    end
-
-    def normal_server_port
-      @normal_server[:server].config[:Port]
-    end
-
-    def proxy_server_port
-      @proxy_server[:server].config[:Port]
-    end
-
-    DIR = File.expand_path(File.dirname(__FILE__))
-
-    def start_ssl_server(config = {})
-      raise MiniTest::Skip, 'openssl not installed' unless
-        defined?(OpenSSL::SSL)
-
-      null_logger = NilLog.new
-      server = WEBrick::HTTPServer.new({
-        :Port => 0,
-        :Logger => null_logger,
-        :AccessLog => [],
-        :SSLEnable => true,
-        :SSLCACertificateFile => File.join(DIR, 'ca_cert.pem'),
-        :SSLCertificate => cert('ssl_cert.pem'),
-        :SSLPrivateKey => key('ssl_key.pem'),
-        :SSLVerifyClient => nil,
-        :SSLCertName => nil
-      }.merge(config))
-      server.mount_proc("/yaml") { |req, res|
-        res.body = "--- true\n"
-      }
-      server.mount_proc("/insecure_redirect") { |req, res|
-        res.set_redirect(WEBrick::HTTPStatus::MovedPermanently, req.query['to'])
-      }
-      server.ssl_context.tmp_dh_callback = proc { TEST_KEY_DH2048 }
-      t = Thread.new do
-        begin
-          server.start
-        rescue Exception => ex
-          abort ex.message
-          puts "ERROR during server thread: #{ex.message}"
-        ensure
-          server.shutdown
-        end
-      end
-      while server.status != :Running
-        sleep 0.1
-        unless t.alive?
-          t.join
-          raise
-        end
-      end
-      @ssl_server = server
-      @ssl_server_thread = t
-      server
-    end
-
-    private
-
-    def start_server(data)
-      null_logger = NilLog.new
-      s = WEBrick::HTTPServer.new(
-        :Port            => 0,
-        :DocumentRoot    => nil,
-        :Logger          => null_logger,
-        :AccessLog       => null_logger
-        )
-      s.mount_proc("/kill") { |req, res| s.shutdown }
-      s.mount_proc("/yaml") { |req, res|
-        if req["X-Captain"]
-          res.body = req["X-Captain"]
-        elsif @enable_yaml
-          res.body = data
-          res['Content-Type'] = 'text/plain'
-          res['content-length'] = data.size
-        else
-          res.status = "404"
-          res.body = "<h1>NOT FOUND</h1>"
-          res['Content-Type'] = 'text/html'
-        end
-      }
-      s.mount_proc("/yaml.Z") { |req, res|
-        if @enable_zip
-          res.body = Zlib::Deflate.deflate(data)
-          res['Content-Type'] = 'text/plain'
-        else
-          res.status = "404"
-          res.body = "<h1>NOT FOUND</h1>"
-          res['Content-Type'] = 'text/html'
-        end
-      }
-      th = Thread.new do
-        begin
-          s.start
-        rescue Exception => ex
-          abort "ERROR during server thread: #{ex.message}"
-        ensure
-          s.shutdown
-        end
+  def normal_server_port
+    @normal_server[:server].config[:Port]
+  end
+
+  def proxy_server_port
+    @proxy_server[:server].config[:Port]
+  end
+
+  def start_ssl_server(config = {})
+    pend "starting this test server fails randomly on jruby" if Gem.java_platform?
+
+    null_logger = NilLog.new
+    server = WEBrick::HTTPServer.new({
+      :Port => 0,
+      :Logger => null_logger,
+      :AccessLog => [],
+      :SSLEnable => true,
+      :SSLCACertificateFile => File.join(__dir__, "ca_cert.pem"),
+      :SSLCertificate => cert("ssl_cert.pem"),
+      :SSLPrivateKey => key("ssl_key.pem"),
+      :SSLVerifyClient => nil,
+      :SSLCertName => nil,
+    }.merge(config))
+    server.mount_proc("/yaml") do |req, res|
+      res.body = "--- true\n"
+    end
+    server.mount_proc("/insecure_redirect") do |req, res|
+      res.set_redirect(WEBrick::HTTPStatus::MovedPermanently, req.query["to"])
+    end
+    server.ssl_context.tmp_dh_callback = proc { TEST_KEY_DH2048 }
+    t = Thread.new do
+      server.start
+    rescue Exception => ex
+      puts "ERROR during server thread: #{ex.message}"
+      raise
+    ensure
+      server.shutdown
+    end
+    while server.status != :Running
+      sleep 0.1
+      unless t.alive?
+        t.join
+        raise
       end
-      th[:server] = s
-      th
     end
+    @ssl_server = server
+    @ssl_server_thread = t
+    server
+  end
 
-    def cert(filename)
-      OpenSSL::X509::Certificate.new(File.read(File.join(DIR, filename)))
+  def start_server(data)
+    null_logger = NilLog.new
+    s = WEBrick::HTTPServer.new(
+      :Port => 0,
+      :DocumentRoot => nil,
+      :Logger => null_logger,
+      :AccessLog => null_logger
+    )
+    s.mount_proc("/kill") {|req, res| s.shutdown }
+    s.mount_proc("/yaml") do |req, res|
+      if req["X-Captain"]
+        res.body = req["X-Captain"]
+      elsif @enable_yaml
+        res.body = data
+        res["Content-Type"] = "text/plain"
+        res["content-length"] = data.size
+      else
+        res.status = "404"
+        res.body = "<h1>NOT FOUND</h1>"
+        res["Content-Type"] = "text/html"
+      end
     end
-
-    def key(filename)
-      OpenSSL::PKey::RSA.new(File.read(File.join(DIR, filename)))
+    s.mount_proc("/yaml.Z") do |req, res|
+      if @enable_zip
+        res.body = Zlib::Deflate.deflate(data)
+        res["Content-Type"] = "text/plain"
+      else
+        res.status = "404"
+        res.body = "<h1>NOT FOUND</h1>"
+        res["Content-Type"] = "text/html"
+      end
+    end
+    th = Thread.new do
+      s.start
+    rescue Exception => ex
+      abort "ERROR during server thread: #{ex.message}"
+    ensure
+      s.shutdown
     end
+    th[:server] = s
+    th
   end
 
-  def test_correct_for_windows_path
-    path = "/C:/WINDOWS/Temp/gems"
-    assert_equal "C:/WINDOWS/Temp/gems", @fetcher.correct_for_windows_path(path)
-
-    path = "/home/skillet"
-    assert_equal "/home/skillet", @fetcher.correct_for_windows_path(path)
+  def cert(filename)
+    OpenSSL::X509::Certificate.new(File.read(File.join(__dir__, filename)))
   end
 
-end
-
+  def key(filename)
+    OpenSSL::PKey::RSA.new(File.read(File.join(__dir__, filename)))
+  end
+end if Gem::HAVE_OPENSSL