rubygems-update 2.6.0 → 3.5.4

data/lib/rubygems/security/trust_dir.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
+
 ##
 # The TrustDir manages the trusted certificates for gem signature
 # verification.
 
 class Gem::Security::TrustDir
-
   ##
   # Default permissions for the trust directory and its contents
 
   DEFAULT_PERMISSIONS = {
-    :trust_dir    => 0700,
-    :trusted_cert => 0600,
-  }
+    trust_dir: 0o700,
+    trusted_cert: 0o600,
+  }.freeze
 
   ##
   # The directory where trusted certificates will be stored.
@@ -22,17 +22,17 @@ class Gem::Security::TrustDir
   # Creates a new TrustDir using +dir+ where the directory and file
   # permissions will be checked according to +permissions+
 
-  def initialize dir, permissions = DEFAULT_PERMISSIONS
+  def initialize(dir, permissions = DEFAULT_PERMISSIONS)
     @dir = dir
     @permissions = permissions
 
-    @digester = Gem::Security::DIGEST_ALGORITHM
+    @digester = Gem::Security.create_digest
   end
 
   ##
   # Returns the path to the trusted +certificate+
 
-  def cert_path certificate
+  def cert_path(certificate)
     name_path certificate.subject
   end
 
@@ -42,16 +42,14 @@ class Gem::Security::TrustDir
   def each_certificate
     return enum_for __method__ unless block_given?
 
-    glob = File.join @dir, '*.pem'
+    glob = File.join @dir, "*.pem"
 
     Dir[glob].each do |certificate_file|
-      begin
-        certificate = load_certificate certificate_file
+      certificate = load_certificate certificate_file
 
-        yield certificate, certificate_file
-      rescue OpenSSL::X509::CertificateError
-        next # HACK warn
-      end
+      yield certificate, certificate_file
+    rescue OpenSSL::X509::CertificateError
+      next # HACK: warn
     end
   end
 
@@ -59,7 +57,7 @@ class Gem::Security::TrustDir
   # Returns the issuer certificate of the given +certificate+ if it exists in
   # the trust directory.
 
-  def issuer_of certificate
+  def issuer_of(certificate)
     path = name_path certificate.issuer
 
     return unless File.exist? path
@@ -70,7 +68,7 @@ class Gem::Security::TrustDir
   ##
   # Returns the path to the trusted certificate with the given ASN.1 +name+
 
-  def name_path name
+  def name_path(name)
     digest = @digester.hexdigest name.to_s
 
     File.join @dir, "cert-#{digest}.pem"
@@ -79,7 +77,7 @@ class Gem::Security::TrustDir
   ##
   # Loads the given +certificate_file+
 
-  def load_certificate certificate_file
+  def load_certificate(certificate_file)
     pem = File.read certificate_file
 
     OpenSSL::X509::Certificate.new pem
@@ -88,13 +86,14 @@ class Gem::Security::TrustDir
   ##
   # Add a certificate to trusted certificate list.
 
-  def trust_cert certificate
+  def trust_cert(certificate)
     verify
 
     destination = cert_path certificate
 
-    open destination, 'wb', @permissions[:trusted_cert] do |io|
+    File.open destination, "wb", 0o600 do |io|
       io.write certificate.to_pem
+      io.chmod(@permissions[:trusted_cert])
     end
   end
 
@@ -104,16 +103,15 @@ class Gem::Security::TrustDir
   # permissions.
 
   def verify
-    if File.exist? @dir then
+    require "fileutils"
+    if File.exist? @dir
       raise Gem::Security::Exception,
         "trust directory #{@dir} is not a directory" unless
           File.directory? @dir
 
-      FileUtils.chmod 0700, @dir
+      FileUtils.chmod 0o700, @dir
     else
-      FileUtils.mkdir_p @dir, :mode => @permissions[:trust_dir]
+      FileUtils.mkdir_p @dir, mode: @permissions[:trust_dir]
     end
   end
-
 end
-

data/lib/rubygems/security.rb

@@ -1,19 +1,13 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems/exceptions'
-require 'fileutils'
-
-begin
-  require 'openssl'
-rescue LoadError => e
-  raise unless (e.respond_to?(:path) && e.path == 'openssl') ||
-               e.message =~ / -- openssl$/
-end
+require_relative "exceptions"
+require_relative "openssl"
 
 ##
 # = Signing gems
@@ -62,11 +56,11 @@ end
 #
 #   $ tar tf your-gem-1.0.gem
 #   metadata.gz
-#   metadata.gz.sum
 #   metadata.gz.sig # metadata signature
 #   data.tar.gz
-#   data.tar.gz.sum
 #   data.tar.gz.sig # data signature
+#   checksums.yaml.gz
+#   checksums.yaml.gz.sig # checksums signature
 #
 # === Manually signing gems
 #
@@ -159,8 +153,11 @@ end
 #                                      certificate for EMAIL_ADDR
 #     -C, --certificate CERT           Signing certificate for --sign
 #     -K, --private-key KEY            Key for --sign or --build
+#     -A, --key-algorithm ALGORITHM    Select key algorithm for --build from RSA, DSA, or EC. Defaults to RSA.
 #     -s, --sign CERT                  Signs CERT with the key from -K
 #                                      and the certificate from -C
+#     -d, --days NUMBER_OF_DAYS        Days before the certificate expires
+#     -R, --re-sign                    Re-signs the certificate from -C with the key from -K
 #
 # We've already covered the <code>--build</code> option, and the
 # <code>--add</code>, <code>--list</code>, and <code>--remove</code> commands
@@ -265,7 +262,7 @@ end
 # 2. Grab the public key from the gemspec
 #
 #      gem spec some_signed_gem-1.0.gem cert_chain | \
-#        ruby -ryaml -e 'puts YAML.load_documents($stdin)' > public_key.crt
+#        ruby -rpsych -e 'puts Psych.load($stdin)' > public_key.crt
 #
 # 3. Generate a SHA1 hash of the data.tar.gz
 #
@@ -322,7 +319,6 @@ end
 # * Honor extension restrictions
 # * Might be better to store the certificate chain as a PKCS#7 or PKCS#12
 #   file, instead of an array embedded in the metadata.
-# * Flexible signature and key algorithms, not hard-coded to RSA and SHA1.
 #
 # == Original author
 #
@@ -330,51 +326,46 @@ end
 # http://pablotron.org/
 
 module Gem::Security
-
   ##
   # Gem::Security default exception type
 
   class Exception < Gem::Exception; end
 
   ##
-  # Digest algorithm used to sign gems
+  # Used internally to select the signing digest from all computed digests
 
-  DIGEST_ALGORITHM =
-    if defined?(OpenSSL::Digest::SHA1) then
-      OpenSSL::Digest::SHA1
-    end
+  DIGEST_NAME = "SHA256" # :nodoc:
 
   ##
-  # Used internally to select the signing digest from all computed digests
+  # Length of keys created by RSA and DSA keys
 
-  DIGEST_NAME = # :nodoc:
-    if DIGEST_ALGORITHM then
-      DIGEST_ALGORITHM.new.name
-    end
+  RSA_DSA_KEY_LENGTH = 3072
 
   ##
-  # Algorithm for creating the key pair used to sign gems
+  # Default algorithm to use when building a key pair
 
-  KEY_ALGORITHM =
-    if defined?(OpenSSL::PKey::RSA) then
-      OpenSSL::PKey::RSA
-    end
+  DEFAULT_KEY_ALGORITHM = "RSA"
 
   ##
-  # Length of keys created by KEY_ALGORITHM
+  # Named curve used for Elliptic Curve
 
-  KEY_LENGTH = 2048
+  EC_NAME = "secp384r1"
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
   # Must be in the list returned by OpenSSL::Cipher.ciphers
 
-  KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
+  KEY_CIPHER = OpenSSL::Cipher.new("AES-256-CBC") if defined?(OpenSSL::Cipher)
+
+  ##
+  # One day in seconds
+
+  ONE_DAY = 86_400
 
   ##
   # One year in seconds
 
-  ONE_YEAR = 86400 * 365
+  ONE_YEAR = ONE_DAY * 365
 
   ##
   # The default set of extensions are:
@@ -385,13 +376,13 @@ module Gem::Security
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
-    'basicConstraints'     => 'CA:FALSE',
-    'keyUsage'             =>
-      'keyEncipherment,dataEncipherment,digitalSignature',
-    'subjectKeyIdentifier' => 'hash',
-  }
+    "basicConstraints" => "CA:FALSE",
+    "keyUsage" =>
+      "keyEncipherment,dataEncipherment,digitalSignature",
+    "subjectKeyIdentifier" => "hash",
+  }.freeze
 
-  def self.alt_name_or_x509_entry certificate, x509_entry
+  def self.alt_name_or_x509_entry(certificate, x509_entry)
     alt_name = certificate.extensions.find do |extension|
       extension.oid == "#{x509_entry}AltName"
     end
@@ -407,11 +398,10 @@ module Gem::Security
   #
   # The +extensions+ restrict the key to the indicated uses.
 
-  def self.create_cert subject, key, age = ONE_YEAR, extensions = EXTENSIONS,
-                       serial = 1
+  def self.create_cert(subject, key, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     cert = OpenSSL::X509::Certificate.new
 
-    cert.public_key = key.public_key
+    cert.public_key = get_public_key(key)
     cert.version    = 2
     cert.serial     = serial
 
@@ -429,12 +419,25 @@ module Gem::Security
     cert
   end
 
+  ##
+  # Gets the right public key from a PKey instance
+
+  def self.get_public_key(key)
+    # Ruby 3.0 (Ruby/OpenSSL 2.2) or later
+    return OpenSSL::PKey.read(key.public_to_der) if key.respond_to?(:public_to_der)
+    return key.public_key unless key.is_a?(OpenSSL::PKey::EC)
+
+    ec_key = OpenSSL::PKey::EC.new(key.group.curve_name)
+    ec_key.public_key = key.public_key
+    ec_key
+  end
+
   ##
   # Creates a self-signed certificate with an issuer and subject from +email+,
   # a subject alternative name of +email+ and the given +extensions+ for the
   # +key+.
 
-  def self.create_cert_email email, key, age = ONE_YEAR, extensions = EXTENSIONS
+  def self.create_cert_email(email, key, age = ONE_YEAR, extensions = EXTENSIONS)
     subject = email_to_name email
 
     extensions = extensions.merge "subjectAltName" => "email:#{email}"
@@ -446,34 +449,54 @@ module Gem::Security
   # Creates a self-signed certificate with an issuer and subject of +subject+
   # and the given +extensions+ for the +key+.
 
-  def self.create_cert_self_signed subject, key, age = ONE_YEAR,
-                                   extensions = EXTENSIONS, serial = 1
+  def self.create_cert_self_signed(subject, key, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     certificate = create_cert subject, key, age, extensions
 
     sign certificate, key, certificate, age, extensions, serial
   end
 
   ##
-  # Creates a new key pair of the specified +length+ and +algorithm+.  The
-  # default is a 2048 bit RSA key.
+  # Creates a new digest instance using the specified +algorithm+. The default
+  # is SHA256.
 
-  def self.create_key length = KEY_LENGTH, algorithm = KEY_ALGORITHM
-    algorithm.new length
+  def self.create_digest(algorithm = DIGEST_NAME)
+    OpenSSL::Digest.new(algorithm)
   end
 
   ##
-  # Turns +email_address+ into an OpenSSL::X509::Name
+  # Creates a new key pair of the specified +algorithm+. RSA, DSA, and EC
+  # are supported.
+
+  def self.create_key(algorithm)
+    if defined?(OpenSSL::PKey)
+      case algorithm.downcase
+      when "dsa"
+        OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
+      when "rsa"
+        OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
+      when "ec"
+        OpenSSL::PKey::EC.generate(EC_NAME)
+      else
+        raise Gem::Security::Exception,
+        "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
+      end
+    end
+  end
 
-  def self.email_to_name email_address
-    email_address = email_address.gsub(/[^\w@.-]+/i, '_')
+  ##
+  # Turns +email_address+ into an OpenSSL::X509::Name
 
-    cn, dcs = email_address.split '@'
+  def self.email_to_name(email_address)
+    email_address = email_address.gsub(/[^\w@.-]+/i, "_")
 
-    dcs = dcs.split '.'
+    cn, dcs = email_address.split "@"
 
-    name = "CN=#{cn}/#{dcs.map { |dc| "DC=#{dc}" }.join '/'}"
+    dcs = dcs.split "."
 
-    OpenSSL::X509::Name.parse name
+    OpenSSL::X509::Name.new([
+      ["CN", cn],
+      *dcs.map {|dc| ["DC", dc] },
+    ])
   end
 
   ##
@@ -482,20 +505,19 @@ module Gem::Security
   #--
   # TODO increment serial
 
-  def self.re_sign expired_certificate, private_key, age = ONE_YEAR,
-                   extensions = EXTENSIONS
+  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR, extensions = EXTENSIONS)
     raise Gem::Security::Exception,
           "incorrect signing key for re-signing " +
-          "#{expired_certificate.subject}" unless
-      expired_certificate.public_key.to_pem == private_key.public_key.to_pem
+          expired_certificate.subject.to_s unless
+      expired_certificate.check_private_key(private_key)
 
     unless expired_certificate.subject.to_s ==
-           expired_certificate.issuer.to_s then
+           expired_certificate.issuer.to_s
       subject = alt_name_or_x509_entry expired_certificate, :subject
       issuer  = alt_name_or_x509_entry expired_certificate, :issuer
 
       raise Gem::Security::Exception,
-            "#{subject} is not self-signed, contact #{issuer} " +
+            "#{subject} is not self-signed, contact #{issuer} " \
             "to obtain a valid certificate"
     end
 
@@ -514,34 +536,33 @@ module Gem::Security
 
   ##
   # Sign the public key from +certificate+ with the +signing_key+ and
-  # +signing_cert+, using the Gem::Security::DIGEST_ALGORITHM.  Uses the
+  # +signing_cert+, using the Gem::Security::DIGEST_NAME.  Uses the
   # default certificate validity range and extensions.
   #
   # Returns the newly signed certificate.
 
-  def self.sign certificate, signing_key, signing_cert,
-                age = ONE_YEAR, extensions = EXTENSIONS, serial = 1
+  def self.sign(certificate, signing_key, signing_cert, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     signee_subject = certificate.subject
     signee_key     = certificate.public_key
 
     alt_name = certificate.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'subjectAltName' => alt_name.value if
+    extensions = extensions.merge "subjectAltName" => alt_name.value if
       alt_name
 
     issuer_alt_name = signing_cert.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'issuerAltName' => issuer_alt_name.value if
+    extensions = extensions.merge "issuerAltName" => issuer_alt_name.value if
       issuer_alt_name
 
     signed = create_cert signee_subject, signee_key, age, extensions, serial
     signed.issuer = signing_cert.subject
 
-    signed.sign signing_key, Gem::Security::DIGEST_ALGORITHM.new
+    signed.sign signing_key, Gem::Security::DIGEST_NAME
   end
 
   ##
@@ -551,7 +572,7 @@ module Gem::Security
   def self.trust_dir
     return @trust_dir if @trust_dir
 
-    dir = File.join Gem.user_home, '.gem', 'trust'
+    dir = File.join Gem.user_home, ".gem", "trust"
 
     @trust_dir ||= Gem::Security::TrustDir.new dir
   end
@@ -559,7 +580,7 @@ module Gem::Security
   ##
   # Enumerates the trusted certificates via Gem::Security::TrustDir.
 
-  def self.trusted_certificates &block
+  def self.trusted_certificates(&block)
     trust_dir.each_certificate(&block)
   end
 
@@ -568,11 +589,11 @@ module Gem::Security
   # +permissions+. If passed +cipher+ and +passphrase+ those arguments will be
   # passed to +to_pem+.
 
-  def self.write pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER
+  def self.write(pemmable, path, permissions = 0o600, passphrase = nil, cipher = KEY_CIPHER)
     path = File.expand_path path
 
-    open path, 'wb', permissions do |io|
-      if passphrase and cipher
+    File.open path, "wb", permissions do |io|
+      if passphrase && cipher
         io.write pemmable.to_pem cipher, passphrase
       else
         io.write pemmable.to_pem
@@ -583,14 +604,12 @@ module Gem::Security
   end
 
   reset
-
 end
 
-if defined?(OpenSSL::SSL) then
-  require 'rubygems/security/policy'
-  require 'rubygems/security/policies'
-  require 'rubygems/security/trust_dir'
+if Gem::HAVE_OPENSSL
+  require_relative "security/policy"
+  require_relative "security/policies"
+  require_relative "security/trust_dir"
 end
 
-require 'rubygems/security/signer'
-
+require_relative "security/signer"

data/lib/rubygems/security_option.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+#--
+# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
+# All rights reserved.
+# See LICENSE.txt for permissions.
+#++
+
+require_relative "../rubygems"
+
+# forward-declare
+
+module Gem::Security # :nodoc:
+  class Policy # :nodoc:
+  end
+end
+
+##
+# Mixin methods for security option for Gem::Commands
+
+module Gem::SecurityOption
+  def add_security_option
+    Gem::OptionParser.accept Gem::Security::Policy do |value|
+      require_relative "security"
+
+      raise Gem::OptionParser::InvalidArgument, "OpenSSL not installed" unless
+        defined?(Gem::Security::HighSecurity)
+
+      policy = Gem::Security::Policies[value]
+      unless policy
+        valid = Gem::Security::Policies.keys.sort
+        raise Gem::OptionParser::InvalidArgument, "#{value} (#{valid.join ", "} are valid)"
+      end
+      policy
+    end
+
+    add_option(:"Install/Update", "-P", "--trust-policy POLICY",
+               Gem::Security::Policy,
+               "Specify gem trust policy") do |value, options|
+      options[:security_policy] = value
+    end
+  end
+end

data/lib/rubygems/shellwords.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+autoload :Shellwords, "shellwords"