rubygems-update 2.6.3 → 2.7.7

data/test/rubygems/test_gem_request.rb

@@ -8,6 +8,7 @@ class TestGemRequest < Gem::TestCase
 
   CA_CERT_FILE     = cert_path 'ca'
   CHILD_CERT       = load_cert 'child'
+  EXPIRED_CERT     = load_cert 'expired'
   PUBLIC_CERT      = load_cert 'public'
   PUBLIC_CERT_FILE = cert_path 'public'
   SSL_CERT         = load_cert 'ssl'
@@ -311,6 +312,136 @@ class TestGemRequest < Gem::TestCase
     util_restore_version
   end
 
+  def test_verify_certificate
+    store = OpenSSL::X509::Store.new
+    context = OpenSSL::X509::StoreContext.new store
+    context.error = OpenSSL::X509::V_ERR_OUT_OF_MEM
+
+    use_ui @ui do
+      Gem::Request.verify_certificate context
+    end
+
+    assert_equal "ERROR:  SSL verification error at depth 0: out of memory (17)\n",
+                 @ui.error
+  end
+
+  def test_verify_certificate_extra_message
+    store = OpenSSL::X509::Store.new
+    context = OpenSSL::X509::StoreContext.new store
+    context.error = OpenSSL::X509::V_ERR_INVALID_CA
+
+    use_ui @ui do
+      Gem::Request.verify_certificate context
+    end
+
+    expected = <<-ERROR
+ERROR:  SSL verification error at depth 0: invalid CA certificate (24)
+ERROR:  Certificate  is an invalid CA certificate
+    ERROR
+
+    assert_equal expected, @ui.error
+  end
+
+  def test_verify_certificate_message_CERT_HAS_EXPIRED
+    error_number = OpenSSL::X509::V_ERR_CERT_HAS_EXPIRED
+
+    message =
+      Gem::Request.verify_certificate_message error_number, EXPIRED_CERT
+
+    assert_equal "Certificate #{EXPIRED_CERT.subject} expired at #{EXPIRED_CERT.not_before.iso8601}",
+                 message
+  end
+
+  def test_verify_certificate_message_CERT_NOT_YET_VALID
+    error_number = OpenSSL::X509::V_ERR_CERT_NOT_YET_VALID
+
+    message =
+      Gem::Request.verify_certificate_message error_number, EXPIRED_CERT
+
+    assert_equal "Certificate #{EXPIRED_CERT.subject} not valid until #{EXPIRED_CERT.not_before.iso8601}",
+                 message
+  end
+
+  def test_verify_certificate_message_CERT_REJECTED
+    error_number = OpenSSL::X509::V_ERR_CERT_REJECTED
+
+    message =
+      Gem::Request.verify_certificate_message error_number, CHILD_CERT
+
+    assert_equal "Certificate #{CHILD_CERT.subject} is rejected",
+                 message
+  end
+
+  def test_verify_certificate_message_CERT_UNTRUSTED
+    error_number = OpenSSL::X509::V_ERR_CERT_UNTRUSTED
+
+    message =
+      Gem::Request.verify_certificate_message error_number, CHILD_CERT
+
+    assert_equal "Certificate #{CHILD_CERT.subject} is not trusted",
+                 message
+  end
+
+  def test_verify_certificate_message_DEPTH_ZERO_SELF_SIGNED_CERT
+    error_number = OpenSSL::X509::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT
+
+    message =
+      Gem::Request.verify_certificate_message error_number, CHILD_CERT
+
+    assert_equal "Certificate #{CHILD_CERT.issuer} is not trusted",
+                 message
+  end
+
+  def test_verify_certificate_message_INVALID_CA
+    error_number = OpenSSL::X509::V_ERR_INVALID_CA
+
+    message =
+      Gem::Request.verify_certificate_message error_number, CHILD_CERT
+
+    assert_equal "Certificate #{CHILD_CERT.subject} is an invalid CA certificate",
+                 message
+  end
+
+  def test_verify_certificate_message_INVALID_PURPOSE
+    error_number = OpenSSL::X509::V_ERR_INVALID_PURPOSE
+
+    message =
+      Gem::Request.verify_certificate_message error_number, CHILD_CERT
+
+    assert_equal "Certificate #{CHILD_CERT.subject} has an invalid purpose",
+                 message
+  end
+
+  def test_verify_certificate_message_SELF_SIGNED_CERT_IN_CHAIN
+    error_number = OpenSSL::X509::V_ERR_SELF_SIGNED_CERT_IN_CHAIN
+
+    message =
+      Gem::Request.verify_certificate_message error_number, EXPIRED_CERT
+
+    assert_equal "Root certificate is not trusted (#{EXPIRED_CERT.subject})",
+                 message
+  end
+
+  def test_verify_certificate_message_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
+    error_number = OpenSSL::X509::V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY
+
+    message =
+      Gem::Request.verify_certificate_message error_number, EXPIRED_CERT
+
+    assert_equal "You must add #{EXPIRED_CERT.issuer} to your local trusted store",
+                 message
+  end
+
+  def test_verify_certificate_message_UNABLE_TO_VERIFY_LEAF_SIGNATURE
+    error_number = OpenSSL::X509::V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE
+
+    message =
+      Gem::Request.verify_certificate_message error_number, EXPIRED_CERT
+
+    assert_equal "You must add #{EXPIRED_CERT.issuer} to your local trusted store",
+                 message
+  end
+
   def util_restore_version
     Object.send :remove_const, :RUBY_ENGINE if defined?(RUBY_ENGINE)
     Object.send :const_set,    :RUBY_ENGINE, @orig_RUBY_ENGINE if
@@ -344,6 +475,7 @@ class TestGemRequest < Gem::TestCase
 
     def new *args; self; end
     def use_ssl=(bool); end
+    def verify_callback=(setting); end
     def verify_mode=(setting); end
     def cert_store=(setting); end
     def start; end

data/test/rubygems/test_gem_request_connection_pools.rb

@@ -118,13 +118,12 @@ class TestGemRequestConnectionPool < Gem::TestCase
 
     pool.checkout
 
-    t1 = Thread.new {
-      Timeout.timeout(1) do
-        pool.checkout
+    Thread.new {
+      assert_raises(Timeout::Error) do
+        Timeout.timeout(1) do
+          pool.checkout
+        end
       end
-    }
-    assert_raises(Timeout::Error) do
-      t1.join
-    end
+    }.join
   end
 end

data/test/rubygems/test_gem_request_set.rb

@@ -52,7 +52,7 @@ class TestGemRequestSet < Gem::TestCase
     rs = Gem::RequestSet.new
     installed = []
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts 'gem "a"'
       io.flush
 
@@ -78,7 +78,7 @@ class TestGemRequestSet < Gem::TestCase
 
     rs = Gem::RequestSet.new
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts 'gem "a"'
       io.flush
 
@@ -104,7 +104,7 @@ Gems to install:
     rs = Gem::RequestSet.new
     installed = []
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts 'gem "a"'
     end
 
@@ -128,7 +128,7 @@ Gems to install:
 
     rs = Gem::RequestSet.new
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts 'gem "a"'
       io.flush
 
@@ -150,7 +150,7 @@ Gems to install:
     rs = Gem::RequestSet.new
     installed = []
 
-    open 'gem.deps.rb.lock', 'w' do |io|
+    File.open 'gem.deps.rb.lock', 'w' do |io|
       io.puts <<-LOCKFILE
 GEM
   remote: #{@gem_repo}
@@ -167,7 +167,7 @@ DEPENDENCIES
       LOCKFILE
     end
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts 'gem "b"'
     end
 
@@ -190,7 +190,7 @@ DEPENDENCIES
     rs = Gem::RequestSet.new
     installed = []
 
-    open 'gem.deps.rb', 'w' do |io|
+    File.open 'gem.deps.rb', 'w' do |io|
       io.puts <<-GEM_DEPS
 gem "a"
 ruby "0"

data/test/rubygems/test_gem_request_set_gem_dependency_api.rb

@@ -753,7 +753,7 @@ end
         @gda.ruby RUBY_VERSION, :engine => 'jruby', :engine_version => '1.7.4'
       end
 
-      assert_equal 'Your ruby engine is ruby, but your gem.deps.rb requires jruby',
+      assert_equal 'Your Ruby engine is ruby, but your gem.deps.rb requires jruby',
                    e.message
     end
   end
@@ -764,7 +764,7 @@ end
         @gda.ruby RUBY_VERSION, :engine => 'jruby', :engine_version => '1.7.4'
       end
 
-      assert_equal 'Your ruby engine version is jruby 1.7.6, but your gem.deps.rb requires jruby 1.7.4',
+      assert_equal 'Your Ruby engine version is jruby 1.7.6, but your gem.deps.rb requires jruby 1.7.4',
                    e.message
     end
   end
@@ -774,7 +774,7 @@ end
       @gda.ruby RUBY_VERSION, :engine => 'jruby'
     end
 
-    assert_equal 'you must specify engine_version along with the ruby engine',
+    assert_equal 'You must specify engine_version along with the Ruby engine',
                  e.message
   end
 

data/test/rubygems/test_gem_request_set_lockfile.rb

@@ -31,7 +31,7 @@ class TestGemRequestSetLockfile < Gem::TestCase
   def write_lockfile lockfile
     @lock_file = File.expand_path "#{@gem_deps_file}.lock"
 
-    open @lock_file, 'w' do |io|
+    File.open @lock_file, 'w' do |io|
       io.write lockfile
     end
   end
@@ -387,7 +387,7 @@ DEPENDENCIES
           s.add_dependency 'c', '~> 1.0'
         end
 
-        open 'b.gemspec', 'w' do |io|
+        File.open 'b.gemspec', 'w' do |io|
           io.write b.to_ruby
         end
 
@@ -400,7 +400,7 @@ DEPENDENCIES
       Dir.chdir 'c' do
         c = Gem::Specification.new 'c', 1
 
-        open 'c.gemspec', 'w' do |io|
+        File.open 'c.gemspec', 'w' do |io|
           io.write c.to_ruby
         end
 
@@ -455,7 +455,7 @@ DEPENDENCIES
 
     gem_deps_lock_file = "#{@gem_deps_file}.lock"
 
-    open gem_deps_lock_file, 'w' do |io|
+    File.open gem_deps_lock_file, 'w' do |io|
       io.write 'hello'
     end
 

data/test/rubygems/test_gem_request_set_lockfile_parser.rb

@@ -536,7 +536,7 @@ DEPENDENCIES
   end
 
   def write_lockfile lockfile
-    open @lock_file, 'w' do |io|
+    File.open @lock_file, 'w' do |io|
       io.write lockfile
     end
   end

data/test/rubygems/test_gem_request_set_lockfile_tokenizer.rb

@@ -295,7 +295,7 @@ GEM
   end
 
   def write_lockfile lockfile
-    open @lock_file, 'w' do |io|
+    File.open @lock_file, 'w' do |io|
       io.write lockfile
     end
   end

data/test/rubygems/test_gem_requirement.rb

@@ -30,6 +30,12 @@ class TestGemRequirement < Gem::TestCase
     assert_requirement_equal "= 2", v(2)
   end
 
+  def test_create
+    assert_equal req("= 1"), Gem::Requirement.create("= 1")
+    assert_equal req(">= 1.2", "<= 1.3"), Gem::Requirement.create([">= 1.2", "<= 1.3"])
+    assert_equal req(">= 1.2", "<= 1.3"), Gem::Requirement.create(">= 1.2", "<= 1.3")
+  end
+
   def test_empty_requirements_is_none
     r = Gem::Requirement.new
     assert_equal true, r.none?

data/test/rubygems/test_gem_resolver.rb

@@ -521,11 +521,11 @@ class TestGemResolver < Gem::TestCase
     assert_equal req('>= 0'), dependency.requirement
 
     activated = e.conflict.activated
-    assert_equal 'c-2', activated.full_name
+    assert_equal 'c-1', activated.full_name
 
-    assert_equal dep('c', '>= 2'), activated.request.dependency
+    assert_equal dep('c', '= 1'), activated.request.dependency
 
-    assert_equal [dep('c', '= 1'), dep('c', '>= 2')],
+    assert_equal [dep('c', '>= 2'), dep('c', '= 1')],
                  e.conflict.conflicting_dependencies
   end
 
@@ -683,6 +683,32 @@ class TestGemResolver < Gem::TestCase
     assert_resolves_to [b1, c1, d2], r
   end
 
+  def test_sorts_by_source_then_version
+    sourceA = Gem::Source.new 'http://example.com/a'
+    sourceB = Gem::Source.new 'http://example.com/b'
+    sourceC = Gem::Source.new 'http://example.com/c'
+
+    spec_A_1 = new_spec 'some-dep', '0.0.1'
+    spec_A_2 = new_spec 'some-dep', '1.0.0'
+    spec_B_1 = new_spec 'some-dep', '0.0.1'
+    spec_B_2 = new_spec 'some-dep', '0.0.2'
+    spec_C_1 = new_spec 'some-dep', '0.1.0'
+
+    set = StaticSet.new [
+      Gem::Resolver::SpecSpecification.new(nil, spec_B_1, sourceB),
+      Gem::Resolver::SpecSpecification.new(nil, spec_B_2, sourceB),
+      Gem::Resolver::SpecSpecification.new(nil, spec_C_1, sourceC),
+      Gem::Resolver::SpecSpecification.new(nil, spec_A_2, sourceA),
+      Gem::Resolver::SpecSpecification.new(nil, spec_A_1, sourceA),
+    ]
+
+    dependency = make_dep 'some-dep', '> 0'
+
+    resolver = Gem::Resolver.new [dependency], set
+
+    assert_resolves_to [spec_B_2], resolver
+  end
+
   def test_select_local_platforms
     r = Gem::Resolver.new nil, nil
 

data/test/rubygems/test_gem_resolver_conflict.rb

@@ -15,7 +15,7 @@ class TestGemResolverConflict < Gem::TestCase
 
     dep = Gem::Resolver::DependencyRequest.new dep('net-ssh', '>= 2.0.13'), nil
 
-    spec = quick_spec 'net-ssh', '2.2.2'
+    spec = util_spec 'net-ssh', '2.2.2'
     active =
       Gem::Resolver::ActivationRequest.new spec, dep
 

data/test/rubygems/test_gem_resolver_git_specification.rb

@@ -70,7 +70,7 @@ class TestGemResolverGitSpecification < Gem::TestCase
     Dir.chdir 'git/a' do
       FileUtils.mkdir_p 'ext/lib'
 
-      open 'ext/extconf.rb', 'w' do |io|
+      File.open 'ext/extconf.rb', 'w' do |io|
         io.puts 'require "mkmf"'
         io.puts 'create_makefile "a"'
       end

data/test/rubygems/test_gem_security.rb

@@ -61,6 +61,7 @@ class TestGemSecurity < Gem::TestCase
     cert = @SEC.create_cert_self_signed subject, PRIVATE_KEY, 60
 
     assert_equal '/CN=nobody/DC=example', cert.issuer.to_s
+    assert_equal "sha256WithRSAEncryption", cert.signature_algorithm
   end
 
   def test_class_create_cert_email
@@ -120,6 +121,7 @@ class TestGemSecurity < Gem::TestCase
   end
 
   def test_class_re_sign
+    assert_equal "sha1WithRSAEncryption", EXPIRED_CERT.signature_algorithm
     re_signed = Gem::Security.re_sign EXPIRED_CERT, PRIVATE_KEY, 60
 
     assert_in_delta Time.now,      re_signed.not_before, 10
@@ -127,6 +129,7 @@ class TestGemSecurity < Gem::TestCase
     assert_equal EXPIRED_CERT.serial + 1, re_signed.serial
 
     assert re_signed.verify PUBLIC_KEY
+    assert_equal "sha256WithRSAEncryption", re_signed.signature_algorithm
   end
 
   def test_class_re_sign_not_self_signed
@@ -218,6 +221,8 @@ class TestGemSecurity < Gem::TestCase
     assert_in_delta Time.now,          signed.not_before, 10
     assert_in_delta Time.now + 60,     signed.not_after, 10
 
+    assert_equal "sha256WithRSAEncryption", signed.signature_algorithm
+
     assert_equal 5, signed.extensions.length,
                  signed.extensions.map { |e| e.to_a.first }
 

data/test/rubygems/test_gem_security_policy.rb

@@ -1,4 +1,4 @@
-# coding: UTF-8
+# coding: utf-8
 # frozen_string_literal: true
 
 require 'rubygems/test_case'
@@ -34,7 +34,7 @@ class TestGemSecurityPolicy < Gem::TestCase
       s.files = %w[lib/code.rb]
     end
 
-    @sha1 = OpenSSL::Digest::SHA1
+    @digest = Gem::Security::DIGEST_ALGORITHM
     @trust_dir = Gem::Security.trust_dir.dir # HACK use the object
 
     @no        = Gem::Security::NoSecurity
@@ -69,7 +69,7 @@ class TestGemSecurityPolicy < Gem::TestCase
 
     signature = sign data
 
-    assert @almost_no.check_data(PUBLIC_KEY, @sha1, signature, data)
+    assert @almost_no.check_data(PUBLIC_KEY, @digest, signature, data)
   end
 
   def test_check_data_invalid
@@ -80,7 +80,7 @@ class TestGemSecurityPolicy < Gem::TestCase
     invalid = digest 'hello!'
 
     e = assert_raises Gem::Security::Exception do
-      @almost_no.check_data PUBLIC_KEY, @sha1, signature, invalid
+      @almost_no.check_data PUBLIC_KEY, @digest, signature, invalid
     end
 
     assert_equal 'invalid signature', e.message
@@ -238,18 +238,18 @@ class TestGemSecurityPolicy < Gem::TestCase
   def test_check_trust
     Gem::Security.trust_dir.trust_cert PUBLIC_CERT
 
-    assert @high.check_trust [PUBLIC_CERT], @sha1, @trust_dir
+    assert @high.check_trust [PUBLIC_CERT], @digest, @trust_dir
   end
 
   def test_check_trust_child
     Gem::Security.trust_dir.trust_cert PUBLIC_CERT
 
-    assert @high.check_trust [PUBLIC_CERT, CHILD_CERT], @sha1, @trust_dir
+    assert @high.check_trust [PUBLIC_CERT, CHILD_CERT], @digest, @trust_dir
   end
 
   def test_check_trust_empty_chain
     e = assert_raises Gem::Security::Exception do
-      @chain.check_trust [], @sha1, @trust_dir
+      @chain.check_trust [], @digest, @trust_dir
     end
 
     assert_equal 'missing root certificate', e.message
@@ -259,7 +259,7 @@ class TestGemSecurityPolicy < Gem::TestCase
     Gem::Security.trust_dir.trust_cert PUBLIC_CERT
 
     e = assert_raises Gem::Security::Exception do
-      @high.check_trust [WRONG_KEY_CERT], @sha1, @trust_dir
+      @high.check_trust [WRONG_KEY_CERT], @digest, @trust_dir
     end
 
     assert_equal "trusted root certificate #{PUBLIC_CERT.subject} checksum " +
@@ -268,7 +268,7 @@ class TestGemSecurityPolicy < Gem::TestCase
 
   def test_check_trust_no_chain
     e = assert_raises Gem::Security::Exception do
-      @chain.check_trust nil, @sha1, @trust_dir
+      @chain.check_trust nil, @digest, @trust_dir
     end
 
     assert_equal 'missing signing chain', e.message
@@ -276,7 +276,7 @@ class TestGemSecurityPolicy < Gem::TestCase
 
   def test_check_trust_no_trust
     e = assert_raises Gem::Security::Exception do
-      @high.check_trust [PUBLIC_CERT], @sha1, @trust_dir
+      @high.check_trust [PUBLIC_CERT], @digest, @trust_dir
     end
 
     assert_equal "root cert #{PUBLIC_CERT.subject} is not trusted", e.message
@@ -284,7 +284,7 @@ class TestGemSecurityPolicy < Gem::TestCase
 
   def test_check_trust_no_trust_child
     e = assert_raises Gem::Security::Exception do
-      @high.check_trust [PUBLIC_CERT, CHILD_CERT], @sha1, @trust_dir
+      @high.check_trust [PUBLIC_CERT, CHILD_CERT], @digest, @trust_dir
     end
 
     assert_equal "root cert #{PUBLIC_CERT.subject} is not trusted " +
@@ -370,7 +370,7 @@ class TestGemSecurityPolicy < Gem::TestCase
 
     data = digest 'goodbye'
 
-    signatures[1] = PRIVATE_KEY.sign @sha1.new, data.digest
+    signatures[1] = PRIVATE_KEY.sign @digest.new, data.digest
 
     e = assert_raises Gem::Security::Exception do
       @almost_no.verify [PUBLIC_CERT], nil, digests, signatures
@@ -450,20 +450,20 @@ class TestGemSecurityPolicy < Gem::TestCase
 
     @spec.cert_chain = [PUBLIC_CERT.to_s]
 
-    metadata_gz = Gem.gzip @spec.to_yaml
+    metadata_gz = Gem::Util.gzip @spec.to_yaml
 
     package = Gem::Package.new 'nonexistent.gem'
-    package.checksums['SHA1'] = {}
+    package.checksums[Gem::Security::DIGEST_NAME] = {}
 
     s = StringIO.new metadata_gz
     def s.full_name() 'metadata.gz' end
 
     digests = package.digest s
-    metadata_gz_digest = digests['SHA1']['metadata.gz']
+    metadata_gz_digest = digests[Gem::Security::DIGEST_NAME]['metadata.gz']
 
     signatures = {}
     signatures['metadata.gz'] =
-      PRIVATE_KEY.sign @sha1.new, metadata_gz_digest.digest
+      PRIVATE_KEY.sign @digest.new, metadata_gz_digest.digest
 
     assert @high.verify_signatures @spec, digests, signatures
   end
@@ -473,22 +473,22 @@ class TestGemSecurityPolicy < Gem::TestCase
 
     @spec.cert_chain = [PUBLIC_CERT.to_s]
 
-    metadata_gz = Gem.gzip @spec.to_yaml
+    metadata_gz = Gem::Util.gzip @spec.to_yaml
 
     package = Gem::Package.new 'nonexistent.gem'
-    package.checksums['SHA1'] = {}
+    package.checksums[Gem::Security::DIGEST_NAME] = {}
 
     s = StringIO.new metadata_gz
     def s.full_name() 'metadata.gz' end
 
     digests = package.digest s
-    digests['SHA1']['data.tar.gz'] = OpenSSL::Digest.new 'SHA1', 'hello'
+    digests[Gem::Security::DIGEST_NAME]['data.tar.gz'] = @digest.new 'hello'
 
-    metadata_gz_digest = digests['SHA1']['metadata.gz']
+    metadata_gz_digest = digests[Gem::Security::DIGEST_NAME]['metadata.gz']
 
     signatures = {}
     signatures['metadata.gz'] =
-      PRIVATE_KEY.sign @sha1.new, metadata_gz_digest.digest
+      PRIVATE_KEY.sign @digest.new, metadata_gz_digest.digest
 
     e = assert_raises Gem::Security::Exception do
       @high.verify_signatures @spec, digests, signatures
@@ -502,16 +502,16 @@ class TestGemSecurityPolicy < Gem::TestCase
 
     @spec.cert_chain = [PUBLIC_CERT.to_s]
 
-    metadata_gz = Gem.gzip @spec.to_yaml
+    metadata_gz = Gem::Util.gzip @spec.to_yaml
 
     package = Gem::Package.new 'nonexistent.gem'
-    package.checksums['SHA1'] = {}
+    package.checksums[Gem::Security::DIGEST_NAME] = {}
 
     s = StringIO.new metadata_gz
     def s.full_name() 'metadata.gz' end
 
     digests = package.digest s
-    digests['SHA1']['data.tar.gz'] = OpenSSL::Digest.new 'SHA1', 'hello'
+    digests[Gem::Security::DIGEST_NAME]['data.tar.gz'] = @digest.new 'hello'
 
     assert_raises Gem::Security::Exception do
       @high.verify_signatures @spec, digests, {}
@@ -519,19 +519,19 @@ class TestGemSecurityPolicy < Gem::TestCase
   end
 
   def digest data
-    digester = @sha1.new
+    digester = @digest.new
     digester << data
     digester
   end
 
   def sign data, key = PRIVATE_KEY
-    key.sign @sha1.new, data.digest
+    key.sign @digest.new, data.digest
   end
 
   def dummy_signatures key = PRIVATE_KEY
     data = digest 'hello'
 
-    digests    = { 'SHA1' => { 0 => data } }
+    digests    = { Gem::Security::DIGEST_NAME => { 0 => data } }
     signatures = { 0 => sign(data, key) }
 
     return digests, signatures

data/test/rubygems/test_gem_security_signer.rb

@@ -121,12 +121,12 @@ class TestGemSecuritySigner < Gem::TestCase
     signature = signer.sign 'hello'
 
     expected = <<-EXPECTED
-pxSf9ScaghbMNmNp8fqSJj7BiIGpbuoOVYCOM3TJNH9STLILA5z3xKp3gM6w
-VJ7aGsh9KCP485ftS3J9Kb/lKJsyoSkkRSQ5QG+LnyZwMuWlThPDR5o7q6al
-0oxE7vvbbqxFqcT4ojWIkwxJxOluFWmt2D8I6QTX2vLAn09y+Kl66AOrT7R5
-UinbXkz04VwcNvkBqJyko3yWxFKiGNpntZQg4jIw4L+h97EOaZp8H96udzQH
-Da3K0YZ6FsqLDFNnWAFhve3kmpE3CludpvDqH0piq0zKqnOiqAcvICIpPaJP
-c7NM7KZZjj7G++SXjYTEI1PHSA7aFQ/i/+qSUvx+Pg==
+cHze2sEfRysoUMCfGVAx/7o8jxj5liJJ2ptNxe2jf3l+EZvyjdqpXo9Ndzxx
+6xLp2rxLG4K2//ip4aCH5Sh7hnia+F5u6iuLBETPlklPrmw5dnuKZxolz+vM
+0O1aOZsQHcVzQoESTGjkms3KZk+gn3lg0sSBbAV5/LyDYoHCEjxlcA5D+Olb
+rDmRyBMOnMS+q489OZ5Hr6B2YJJ3QbUwIZNhUeNmOxIBEYTrrKkZ92qkxbRN
+qhlqFP4jR6zXFeyBCOr0KpTiWBNuxBFXDsxmhGyt2BOIjD6qmKn7RSIfYg/U
+toqvglr0kdbknSRRjBVLK6tsgr07aLT9gNP7mTW2PA==
     EXPECTED
 
     assert_equal expected, [signature].pack('m')
@@ -205,5 +205,13 @@ c7NM7KZZjj7G++SXjYTEI1PHSA7aFQ/i/+qSUvx+Pg==
     end
   end
 
+  def test_sign_no_certs
+    signer = Gem::Security::Signer.new ALTERNATE_KEY, []
+
+    assert_raises Gem::Security::Exception do
+      signer.sign 'hello'
+    end
+  end
+
 end if defined?(OpenSSL::SSL)
 

data/test/rubygems/test_gem_security_trust_dir.rb

@@ -18,7 +18,7 @@ class TestGemSecurityTrustDir < Gem::TestCase
   end
 
   def test_cert_path
-    digest = OpenSSL::Digest::SHA1.hexdigest PUBLIC_CERT.subject.to_s
+    digest = Gem::Security::DIGEST_ALGORITHM.hexdigest PUBLIC_CERT.subject.to_s
 
     expected = File.join @dest_dir, "cert-#{digest}.pem"
 
@@ -42,7 +42,7 @@ class TestGemSecurityTrustDir < Gem::TestCase
   end
 
   def test_name_path
-    digest = OpenSSL::Digest::SHA1.hexdigest PUBLIC_CERT.subject.to_s
+    digest = Gem::Security::DIGEST_ALGORITHM.hexdigest PUBLIC_CERT.subject.to_s
 
     expected = File.join @dest_dir, "cert-#{digest}.pem"