rubygems-update 2.6.1 → 3.5.0

data/lib/rubygems/security/signer.rb

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
+
 ##
 # Basic OpenSSL-based package signing class.
 
+require_relative "../user_interaction"
+
 class Gem::Security::Signer
+  include Gem::UserInteraction
 
   ##
   # The chain of certificates for signing including the signing certificate
@@ -25,32 +29,66 @@ class Gem::Security::Signer
 
   attr_reader :digest_name # :nodoc:
 
+  ##
+  # Gem::Security::Signer options
+
+  attr_reader :options
+
+  DEFAULT_OPTIONS = {
+    expiration_length_days: 365,
+  }.freeze
+
+  ##
+  # Attempts to re-sign an expired cert with a given private key
+  def self.re_sign_cert(expired_cert, expired_cert_path, private_key)
+    return unless expired_cert.not_after < Time.now
+
+    expiry = expired_cert.not_after.strftime("%Y%m%d%H%M%S")
+    expired_cert_file = "#{File.basename(expired_cert_path)}.expired.#{expiry}"
+    new_expired_cert_path = File.join(Gem.user_home, ".gem", expired_cert_file)
+
+    Gem::Security.write(expired_cert, new_expired_cert_path)
+
+    re_signed_cert = Gem::Security.re_sign(
+      expired_cert,
+      private_key,
+      (Gem::Security::ONE_DAY * Gem.configuration.cert_expiration_length_days)
+    )
+
+    Gem::Security.write(re_signed_cert, expired_cert_path)
+
+    yield(expired_cert_path, new_expired_cert_path) if block_given?
+  end
+
   ##
   # Creates a new signer with an RSA +key+ or path to a key, and a certificate
   # +chain+ containing X509 certificates, encoding certificates or paths to
   # certificates.
 
-  def initialize key, cert_chain, passphrase = nil
+  def initialize(key, cert_chain, passphrase = nil, options = {})
     @cert_chain = cert_chain
     @key        = key
+    @passphrase = passphrase
+    @options = DEFAULT_OPTIONS.merge(options)
 
-    unless @key then
-      default_key  = File.join Gem.default_key_path
+    unless @key
+      default_key = File.join Gem.default_key_path
       @key = default_key if File.exist? default_key
     end
 
-    unless @cert_chain then
+    unless @cert_chain
       default_cert = File.join Gem.default_cert_path
       @cert_chain = [default_cert] if File.exist? default_cert
     end
 
-    @digest_algorithm = Gem::Security::DIGEST_ALGORITHM
     @digest_name      = Gem::Security::DIGEST_NAME
+    @digest_algorithm = Gem::Security.create_digest(@digest_name)
 
-    @key = OpenSSL::PKey::RSA.new File.read(@key), passphrase if
-      @key and not OpenSSL::PKey::RSA === @key
+    if @key && !@key.is_a?(OpenSSL::PKey::PKey)
+      @key = OpenSSL::PKey.read(File.read(@key), @passphrase)
+    end
 
-    if @cert_chain then
+    if @cert_chain
       @cert_chain = @cert_chain.compact.map do |cert|
         next cert if OpenSSL::X509::Certificate === cert
 
@@ -67,11 +105,11 @@ class Gem::Security::Signer
   # Extracts the full name of +cert+.  If the certificate has a subjectAltName
   # this value is preferred, otherwise the subject is used.
 
-  def extract_name cert # :nodoc:
-    subject_alt_name = cert.extensions.find { |e| 'subjectAltName' == e.oid }
+  def extract_name(cert) # :nodoc:
+    subject_alt_name = cert.extensions.find {|e| e.oid == "subjectAltName" }
 
-    if subject_alt_name then
-      /\Aemail:/ =~ subject_alt_name.value
+    if subject_alt_name
+      /\Aemail:/ =~ subject_alt_name.value # rubocop:disable Performance/StartWith
 
       $' || subject_alt_name.value
     else
@@ -99,11 +137,17 @@ class Gem::Security::Signer
   ##
   # Sign data with given digest algorithm
 
-  def sign data
+  def sign(data)
     return unless @key
 
-    if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now then
-      re_sign_key
+    raise Gem::Security::Exception, "no certs provided" if @cert_chain.empty?
+
+    if @cert_chain.length == 1 && @cert_chain.last.not_after < Time.now
+      alert("Your certificate has expired, trying to re-sign it...")
+
+      re_sign_key(
+        expiration_length: (Gem::Security::ONE_DAY * options[:expiration_length_days])
+      )
     end
 
     full_name = extract_name @cert_chain.last
@@ -119,6 +163,7 @@ class Gem::Security::Signer
   # The key will be re-signed if:
   # * The expired certificate is self-signed
   # * The expired certificate is saved at ~/.gem/gem-public_cert.pem
+  #   and the private key is saved at ~/.gem/gem-private_key.pem
   # * There is no file matching the expiry date at
   #   ~/.gem/gem-public_cert.pem.expired.%Y%m%d%H%M%S
   #
@@ -126,30 +171,42 @@ class Gem::Security::Signer
   # be saved as ~/.gem/gem-public_cert.pem.expired.%Y%m%d%H%M%S where the
   # expiry time (not after) is used for the timestamp.
 
-  def re_sign_key # :nodoc:
+  def re_sign_key(expiration_length: Gem::Security::ONE_YEAR) # :nodoc:
     old_cert = @cert_chain.last
 
-    disk_cert_path = File.join Gem.default_cert_path
-    disk_cert = File.read disk_cert_path rescue nil
-    disk_key  =
-      File.read File.join(Gem.default_key_path) rescue nil
+    disk_cert_path = File.join(Gem.default_cert_path)
+    disk_cert = begin
+                  File.read(disk_cert_path)
+                rescue StandardError
+                  nil
+                end
 
-    if disk_key == @key.to_pem and disk_cert == old_cert.to_pem then
-      expiry = old_cert.not_after.strftime '%Y%m%d%H%M%S'
+    disk_key_path = File.join(Gem.default_key_path)
+    disk_key = begin
+                 OpenSSL::PKey.read(File.read(disk_key_path), @passphrase)
+               rescue StandardError
+                 nil
+               end
+
+    return unless disk_key
+
+    if disk_key.to_pem == @key.to_pem && disk_cert == old_cert.to_pem
+      expiry = old_cert.not_after.strftime("%Y%m%d%H%M%S")
       old_cert_file = "gem-public_cert.pem.expired.#{expiry}"
-      old_cert_path = File.join Gem.user_home, ".gem", old_cert_file
+      old_cert_path = File.join(Gem.user_home, ".gem", old_cert_file)
+
+      unless File.exist?(old_cert_path)
+        Gem::Security.write(old_cert, old_cert_path)
 
-      unless File.exist? old_cert_path then
-        Gem::Security.write old_cert, old_cert_path
+        cert = Gem::Security.re_sign(old_cert, @key, expiration_length)
 
-        cert = Gem::Security.re_sign old_cert, @key
+        Gem::Security.write(cert, disk_cert_path)
 
-        Gem::Security.write cert, disk_cert_path
+        alert("Your cert: #{disk_cert_path} has been auto re-signed with the key: #{disk_key_path}")
+        alert("Your expired cert will be located at: #{old_cert_path}")
 
         @cert_chain = [cert]
       end
     end
   end
-
 end
-

data/lib/rubygems/security/trust_dir.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
+
 ##
 # The TrustDir manages the trusted certificates for gem signature
 # verification.
 
 class Gem::Security::TrustDir
-
   ##
   # Default permissions for the trust directory and its contents
 
   DEFAULT_PERMISSIONS = {
-    :trust_dir    => 0700,
-    :trusted_cert => 0600,
-  }
+    trust_dir: 0o700,
+    trusted_cert: 0o600,
+  }.freeze
 
   ##
   # The directory where trusted certificates will be stored.
@@ -22,17 +22,17 @@ class Gem::Security::TrustDir
   # Creates a new TrustDir using +dir+ where the directory and file
   # permissions will be checked according to +permissions+
 
-  def initialize dir, permissions = DEFAULT_PERMISSIONS
+  def initialize(dir, permissions = DEFAULT_PERMISSIONS)
     @dir = dir
     @permissions = permissions
 
-    @digester = Gem::Security::DIGEST_ALGORITHM
+    @digester = Gem::Security.create_digest
   end
 
   ##
   # Returns the path to the trusted +certificate+
 
-  def cert_path certificate
+  def cert_path(certificate)
     name_path certificate.subject
   end
 
@@ -42,16 +42,14 @@ class Gem::Security::TrustDir
   def each_certificate
     return enum_for __method__ unless block_given?
 
-    glob = File.join @dir, '*.pem'
+    glob = File.join @dir, "*.pem"
 
     Dir[glob].each do |certificate_file|
-      begin
-        certificate = load_certificate certificate_file
+      certificate = load_certificate certificate_file
 
-        yield certificate, certificate_file
-      rescue OpenSSL::X509::CertificateError
-        next # HACK warn
-      end
+      yield certificate, certificate_file
+    rescue OpenSSL::X509::CertificateError
+      next # HACK: warn
     end
   end
 
@@ -59,7 +57,7 @@ class Gem::Security::TrustDir
   # Returns the issuer certificate of the given +certificate+ if it exists in
   # the trust directory.
 
-  def issuer_of certificate
+  def issuer_of(certificate)
     path = name_path certificate.issuer
 
     return unless File.exist? path
@@ -70,7 +68,7 @@ class Gem::Security::TrustDir
   ##
   # Returns the path to the trusted certificate with the given ASN.1 +name+
 
-  def name_path name
+  def name_path(name)
     digest = @digester.hexdigest name.to_s
 
     File.join @dir, "cert-#{digest}.pem"
@@ -79,7 +77,7 @@ class Gem::Security::TrustDir
   ##
   # Loads the given +certificate_file+
 
-  def load_certificate certificate_file
+  def load_certificate(certificate_file)
     pem = File.read certificate_file
 
     OpenSSL::X509::Certificate.new pem
@@ -88,13 +86,14 @@ class Gem::Security::TrustDir
   ##
   # Add a certificate to trusted certificate list.
 
-  def trust_cert certificate
+  def trust_cert(certificate)
     verify
 
     destination = cert_path certificate
 
-    open destination, 'wb', @permissions[:trusted_cert] do |io|
+    File.open destination, "wb", 0o600 do |io|
       io.write certificate.to_pem
+      io.chmod(@permissions[:trusted_cert])
     end
   end
 
@@ -104,16 +103,15 @@ class Gem::Security::TrustDir
   # permissions.
 
   def verify
-    if File.exist? @dir then
+    require "fileutils"
+    if File.exist? @dir
       raise Gem::Security::Exception,
         "trust directory #{@dir} is not a directory" unless
           File.directory? @dir
 
-      FileUtils.chmod 0700, @dir
+      FileUtils.chmod 0o700, @dir
     else
-      FileUtils.mkdir_p @dir, :mode => @permissions[:trust_dir]
+      FileUtils.mkdir_p @dir, mode: @permissions[:trust_dir]
     end
   end
-
 end
-