rubygems-update 2.7.10 → 3.0.0

data/lib/rubygems/security/policy.rb

@@ -24,7 +24,7 @@ class Gem::Security::Policy
   # Create a new Gem::Security::Policy object with the given mode and
   # options.
 
-  def initialize name, policy = {}, opt = {}
+  def initialize(name, policy = {}, opt = {})
     require 'openssl'
 
     @name = name
@@ -55,7 +55,7 @@ class Gem::Security::Policy
   # Verifies each certificate in +chain+ has signed the following certificate
   # and is valid for the given +time+.
 
-  def check_chain chain, time
+  def check_chain(chain, time)
     raise Gem::Security::Exception, 'missing signing chain' unless chain
     raise Gem::Security::Exception, 'empty signing chain' if chain.empty?
 
@@ -74,7 +74,7 @@ class Gem::Security::Policy
   # Verifies that +data+ matches the +signature+ created by +public_key+ and
   # the +digest+ algorithm.
 
-  def check_data public_key, digest, signature, data
+  def check_data(public_key, digest, signature, data)
     raise Gem::Security::Exception, "invalid signature" unless
       public_key.verify digest.new, signature, data.digest
 
@@ -85,22 +85,22 @@ class Gem::Security::Policy
   # Ensures that +signer+ is valid for +time+ and was signed by the +issuer+.
   # If the +issuer+ is +nil+ no verification is performed.
 
-  def check_cert signer, issuer, time
+  def check_cert(signer, issuer, time)
     raise Gem::Security::Exception, 'missing signing certificate' unless
       signer
 
     message = "certificate #{signer.subject}"
 
-    if not_before = signer.not_before and not_before > time then
+    if not_before = signer.not_before and not_before > time
       raise Gem::Security::Exception,
             "#{message} not valid before #{not_before}"
     end
 
-    if not_after = signer.not_after and not_after < time then
+    if not_after = signer.not_after and not_after < time
       raise Gem::Security::Exception, "#{message} not valid after #{not_after}"
     end
 
-    if issuer and not signer.verify issuer.public_key then
+    if issuer and not signer.verify issuer.public_key
       raise Gem::Security::Exception,
             "#{message} was not issued by #{issuer.subject}"
     end
@@ -111,8 +111,8 @@ class Gem::Security::Policy
   ##
   # Ensures the public key of +key+ matches the public key in +signer+
 
-  def check_key signer, key
-    unless signer and key then
+  def check_key(signer, key)
+    unless signer and key
       return true unless @only_signed
 
       raise Gem::Security::Exception, 'missing key or signature'
@@ -129,7 +129,7 @@ class Gem::Security::Policy
   # Ensures the root certificate in +chain+ is self-signed and valid for
   # +time+.
 
-  def check_root chain, time
+  def check_root(chain, time)
     raise Gem::Security::Exception, 'missing signing chain' unless chain
 
     root = chain.first
@@ -148,7 +148,7 @@ class Gem::Security::Policy
   # Ensures the root of +chain+ has a trusted certificate in +trust_dir+ and
   # the digests of the two certificates match according to +digester+
 
-  def check_trust chain, digester, trust_dir
+  def check_trust(chain, digester, trust_dir)
     raise Gem::Security::Exception, 'missing signing chain' unless chain
 
     root = chain.first
@@ -157,7 +157,7 @@ class Gem::Security::Policy
 
     path = Gem::Security.trust_dir.cert_path root
 
-    unless File.exist? path then
+    unless File.exist? path
       message = "root cert #{root.subject} is not trusted".dup
 
       message << " (root of signing cert #{chain.last.subject})" if
@@ -183,7 +183,7 @@ class Gem::Security::Policy
   ##
   # Extracts the email or subject from +certificate+
 
-  def subject certificate # :nodoc:
+  def subject(certificate) # :nodoc:
     certificate.extensions.each do |extension|
       next unless extension.oid == 'subjectAltName'
 
@@ -196,9 +196,9 @@ class Gem::Security::Policy
   def inspect # :nodoc:
     ("[Policy: %s - data: %p signer: %p chain: %p root: %p " +
      "signed-only: %p trusted-only: %p]") % [
-      @name, @verify_chain, @verify_data, @verify_root, @verify_signer,
-      @only_signed, @only_trusted,
-    ]
+       @name, @verify_chain, @verify_data, @verify_root, @verify_signer,
+       @only_signed, @only_trusted,
+     ]
   end
 
   ##
@@ -208,13 +208,13 @@ class Gem::Security::Policy
   #
   # If +key+ is given it is used to validate the signing certificate.
 
-  def verify chain, key = nil, digests = {}, signatures = {},
-             full_name = '(unknown)'
-    if signatures.empty? then
-      if @only_signed then
+  def verify(chain, key = nil, digests = {}, signatures = {},
+             full_name = '(unknown)')
+    if signatures.empty?
+      if @only_signed
         raise Gem::Security::Exception,
           "unsigned gems are not allowed by the #{name} policy"
-      elsif digests.empty? then
+      elsif digests.empty?
         # lack of signatures is irrelevant if there is nothing to check
         # against
       else
@@ -232,7 +232,7 @@ class Gem::Security::Policy
       file_digests.values.first.name == Gem::Security::DIGEST_NAME
     end
 
-    if @verify_data then
+    if @verify_data
       raise Gem::Security::Exception, 'no digests provided (probable bug)' if
         signer_digests.nil? or signer_digests.empty?
     else
@@ -249,9 +249,9 @@ class Gem::Security::Policy
 
     check_root chain, time if @verify_root
 
-    if @only_trusted then
+    if @only_trusted
       check_trust chain, digester, trust_dir
-    elsif signatures.empty? and digests.empty? then
+    elsif signatures.empty? and digests.empty?
       # trust is irrelevant if there's no signatures to verify
     else
       alert_warning "#{subject signer} is not trusted for #{full_name}"
@@ -280,7 +280,7 @@ class Gem::Security::Policy
   # Extracts the certificate chain from the +spec+ and calls #verify to ensure
   # the signatures and certificate chain is valid according to the policy..
 
-  def verify_signatures spec, digests, signatures
+  def verify_signatures(spec, digests, signatures)
     chain = spec.cert_chain.map do |cert_pem|
       OpenSSL::X509::Certificate.new cert_pem
     end

data/lib/rubygems/security/signer.rb

@@ -2,8 +2,12 @@
 ##
 # Basic OpenSSL-based package signing class.
 
+require "rubygems/user_interaction"
+
 class Gem::Security::Signer
 
+  include Gem::UserInteraction
+
   ##
   # The chain of certificates for signing including the signing certificate
 
@@ -25,21 +29,54 @@ class Gem::Security::Signer
 
   attr_reader :digest_name # :nodoc:
 
+  ##
+  # Gem::Security::Signer options
+
+  attr_reader :options
+
+  DEFAULT_OPTIONS = {
+    expiration_length_days: 365
+  }.freeze
+
+  ##
+  # Attemps to re-sign an expired cert with a given private key
+  def self.re_sign_cert(expired_cert, expired_cert_path, private_key)
+    return unless expired_cert.not_after < Time.now
+
+    expiry = expired_cert.not_after.strftime('%Y%m%d%H%M%S')
+    expired_cert_file = "#{File.basename(expired_cert_path)}.expired.#{expiry}"
+    new_expired_cert_path = File.join(Gem.user_home, ".gem", expired_cert_file)
+
+    Gem::Security.write(expired_cert, new_expired_cert_path)
+
+    re_signed_cert = Gem::Security.re_sign(
+      expired_cert,
+      private_key,
+      (Gem::Security::ONE_DAY * Gem.configuration.cert_expiration_length_days)
+    )
+
+    Gem::Security.write(re_signed_cert, expired_cert_path)
+
+    yield(expired_cert_path, new_expired_cert_path) if block_given?
+  end
+
   ##
   # Creates a new signer with an RSA +key+ or path to a key, and a certificate
   # +chain+ containing X509 certificates, encoding certificates or paths to
   # certificates.
 
-  def initialize key, cert_chain, passphrase = nil
+  def initialize(key, cert_chain, passphrase = nil, options = {})
     @cert_chain = cert_chain
     @key        = key
+    @passphrase = passphrase
+    @options = DEFAULT_OPTIONS.merge(options)
 
-    unless @key then
+    unless @key
       default_key  = File.join Gem.default_key_path
       @key = default_key if File.exist? default_key
     end
 
-    unless @cert_chain then
+    unless @cert_chain
       default_cert = File.join Gem.default_cert_path
       @cert_chain = [default_cert] if File.exist? default_cert
     end
@@ -47,10 +84,12 @@ class Gem::Security::Signer
     @digest_algorithm = Gem::Security::DIGEST_ALGORITHM
     @digest_name      = Gem::Security::DIGEST_NAME
 
-    @key = OpenSSL::PKey::RSA.new File.read(@key), passphrase if
-      @key and not OpenSSL::PKey::RSA === @key
+    if @key && !@key.is_a?(OpenSSL::PKey::RSA)
+      @passphrase ||= ask_for_password("Enter PEM pass phrase:")
+      @key = OpenSSL::PKey::RSA.new(File.read(@key), @passphrase)
+    end
 
-    if @cert_chain then
+    if @cert_chain
       @cert_chain = @cert_chain.compact.map do |cert|
         next cert if OpenSSL::X509::Certificate === cert
 
@@ -67,10 +106,10 @@ class Gem::Security::Signer
   # Extracts the full name of +cert+.  If the certificate has a subjectAltName
   # this value is preferred, otherwise the subject is used.
 
-  def extract_name cert # :nodoc:
+  def extract_name(cert) # :nodoc:
     subject_alt_name = cert.extensions.find { |e| 'subjectAltName' == e.oid }
 
-    if subject_alt_name then
+    if subject_alt_name
       /\Aemail:/ =~ subject_alt_name.value
 
       $' || subject_alt_name.value
@@ -99,13 +138,15 @@ class Gem::Security::Signer
   ##
   # Sign data with given digest algorithm
 
-  def sign data
+  def sign(data)
     return unless @key
 
     raise Gem::Security::Exception, 'no certs provided' if @cert_chain.empty?
 
-    if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now then
-      re_sign_key
+    if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now
+      re_sign_key(
+        expiration_length: (Gem::Security::ONE_DAY * options[:expiration_length_days])
+      )
     end
 
     full_name = extract_name @cert_chain.last
@@ -121,6 +162,7 @@ class Gem::Security::Signer
   # The key will be re-signed if:
   # * The expired certificate is self-signed
   # * The expired certificate is saved at ~/.gem/gem-public_cert.pem
+  #   and the private key is saved at ~/.gem/gem-private_key.pem
   # * There is no file matching the expiry date at
   #   ~/.gem/gem-public_cert.pem.expired.%Y%m%d%H%M%S
   #
@@ -128,25 +170,32 @@ class Gem::Security::Signer
   # be saved as ~/.gem/gem-public_cert.pem.expired.%Y%m%d%H%M%S where the
   # expiry time (not after) is used for the timestamp.
 
-  def re_sign_key # :nodoc:
+  def re_sign_key(expiration_length: Gem::Security::ONE_YEAR) # :nodoc:
     old_cert = @cert_chain.last
 
-    disk_cert_path = File.join Gem.default_cert_path
-    disk_cert = File.read disk_cert_path rescue nil
-    disk_key  =
-      File.read File.join(Gem.default_key_path) rescue nil
+    disk_cert_path = File.join(Gem.default_cert_path)
+    disk_cert = File.read(disk_cert_path) rescue nil
 
-    if disk_key == @key.to_pem and disk_cert == old_cert.to_pem then
-      expiry = old_cert.not_after.strftime '%Y%m%d%H%M%S'
+    disk_key_path = File.join(Gem.default_key_path)
+    disk_key =
+      OpenSSL::PKey::RSA.new(File.read(disk_key_path), @passphrase) rescue nil
+
+    return unless disk_key
+
+    if disk_key.to_pem == @key.to_pem && disk_cert == old_cert.to_pem
+      expiry = old_cert.not_after.strftime('%Y%m%d%H%M%S')
       old_cert_file = "gem-public_cert.pem.expired.#{expiry}"
-      old_cert_path = File.join Gem.user_home, ".gem", old_cert_file
+      old_cert_path = File.join(Gem.user_home, ".gem", old_cert_file)
 
-      unless File.exist? old_cert_path then
-        Gem::Security.write old_cert, old_cert_path
+      unless File.exist?(old_cert_path)
+        Gem::Security.write(old_cert, old_cert_path)
 
-        cert = Gem::Security.re_sign old_cert, @key
+        cert = Gem::Security.re_sign(old_cert, @key, expiration_length)
 
-        Gem::Security.write cert, disk_cert_path
+        Gem::Security.write(cert, disk_cert_path)
+
+        alert("Your cert: #{disk_cert_path} has been auto re-signed with the key: #{disk_key_path}")
+        alert("Your expired cert will be located at: #{old_cert_path}")
 
         @cert_chain = [cert]
       end
@@ -154,4 +203,3 @@ class Gem::Security::Signer
   end
 
 end
-

data/lib/rubygems/security/trust_dir.rb

@@ -11,7 +11,7 @@ class Gem::Security::TrustDir
   DEFAULT_PERMISSIONS = {
     :trust_dir    => 0700,
     :trusted_cert => 0600,
-  }
+  }.freeze
 
   ##
   # The directory where trusted certificates will be stored.
@@ -22,7 +22,7 @@ class Gem::Security::TrustDir
   # Creates a new TrustDir using +dir+ where the directory and file
   # permissions will be checked according to +permissions+
 
-  def initialize dir, permissions = DEFAULT_PERMISSIONS
+  def initialize(dir, permissions = DEFAULT_PERMISSIONS)
     @dir = dir
     @permissions = permissions
 
@@ -32,7 +32,7 @@ class Gem::Security::TrustDir
   ##
   # Returns the path to the trusted +certificate+
 
-  def cert_path certificate
+  def cert_path(certificate)
     name_path certificate.subject
   end
 
@@ -59,7 +59,7 @@ class Gem::Security::TrustDir
   # Returns the issuer certificate of the given +certificate+ if it exists in
   # the trust directory.
 
-  def issuer_of certificate
+  def issuer_of(certificate)
     path = name_path certificate.issuer
 
     return unless File.exist? path
@@ -70,7 +70,7 @@ class Gem::Security::TrustDir
   ##
   # Returns the path to the trusted certificate with the given ASN.1 +name+
 
-  def name_path name
+  def name_path(name)
     digest = @digester.hexdigest name.to_s
 
     File.join @dir, "cert-#{digest}.pem"
@@ -79,7 +79,7 @@ class Gem::Security::TrustDir
   ##
   # Loads the given +certificate_file+
 
-  def load_certificate certificate_file
+  def load_certificate(certificate_file)
     pem = File.read certificate_file
 
     OpenSSL::X509::Certificate.new pem
@@ -88,13 +88,14 @@ class Gem::Security::TrustDir
   ##
   # Add a certificate to trusted certificate list.
 
-  def trust_cert certificate
+  def trust_cert(certificate)
     verify
 
     destination = cert_path certificate
 
-    File.open destination, 'wb', @permissions[:trusted_cert] do |io|
+    File.open destination, 'wb', 0600 do |io|
       io.write certificate.to_pem
+      io.chmod(@permissions[:trusted_cert])
     end
   end
 
@@ -104,7 +105,7 @@ class Gem::Security::TrustDir
   # permissions.
 
   def verify
-    if File.exist? @dir then
+    if File.exist? @dir
       raise Gem::Security::Exception,
         "trust directory #{@dir} is not a directory" unless
           File.directory? @dir
@@ -116,4 +117,3 @@ class Gem::Security::TrustDir
   end
 
 end
-

data/lib/rubygems/server.rb

@@ -35,7 +35,7 @@ class Gem::Server
   include ERB::Util
   include Gem::UserInteraction
 
-  SEARCH = <<-ERB
+  SEARCH = <<-ERB.freeze
       <form class="headerSearch" name="headerSearchForm" method="get" action="/rdoc">
         <div id="search" style="float:right">
           <label for="q">Filter/Search</label>
@@ -45,7 +45,7 @@ class Gem::Server
       </form>
   ERB
 
-  DOC_TEMPLATE = <<-'ERB'
+  DOC_TEMPLATE = <<-'ERB'.freeze
   <?xml version="1.0" encoding="iso-8859-1"?>
   <!DOCTYPE html
        PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
@@ -129,7 +129,7 @@ class Gem::Server
   ERB
 
   # CSS is copy & paste from rdoc-style.css, RDoc V1.0.1 - 20041108
-  RDOC_CSS = <<-CSS
+  RDOC_CSS = <<-CSS.freeze
 body {
     font-family: Verdana,Arial,Helvetica,sans-serif;
     font-size:   90%;
@@ -339,7 +339,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 .ruby-value   { color: #7fffd4; background: transparent; }
   CSS
 
-  RDOC_NO_DOCUMENTATION = <<-'ERB'
+  RDOC_NO_DOCUMENTATION = <<-'ERB'.freeze
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
@@ -373,7 +373,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 </html>
   ERB
 
-  RDOC_SEARCH_TEMPLATE = <<-'ERB'
+  RDOC_SEARCH_TEMPLATE = <<-'ERB'.freeze
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
@@ -450,7 +450,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     @have_rdoc_4_plus = nil
   end
 
-  def add_date res
+  def add_date(res)
     res['date'] = @spec_dirs.map do |spec_dir|
       File.stat(spec_dir).mtime
     end.max
@@ -462,8 +462,8 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     end
   end
 
-  def doc_root gem_name
-    if have_rdoc_4_plus? then
+  def doc_root(gem_name)
+    if have_rdoc_4_plus?
       "/doc_root/#{u gem_name}/"
     else
       "/doc_root/#{u gem_name}/rdoc/index.html"
@@ -491,14 +491,14 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
     specs = Marshal.dump specs
 
-    if req.path =~ /\.gz$/ then
+    if req.path =~ /\.gz$/
       specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'
     end
 
-    if req.request_method == 'HEAD' then
+    if req.request_method == 'HEAD'
       res['content-length'] = specs.length
     else
       res.body << specs
@@ -509,7 +509,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
   # Creates server sockets based on the addresses option.  If no addresses
   # were given a server socket for all interfaces is created.
 
-  def listen addresses = @addresses
+  def listen(addresses = @addresses)
     addresses = [nil] unless addresses
 
     listeners = 0
@@ -529,14 +529,14 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
       end
     end
 
-    if @server.listeners.empty? then
+    if @server.listeners.empty?
       say "Unable to start a server."
       say "Check for running servers or your --bind and --port arguments"
       terminate_interaction 1
     end
   end
 
-  def prerelease_specs req, res
+  def prerelease_specs(req, res)
     reset_gems
 
     res['content-type'] = 'application/x-gzip'
@@ -552,14 +552,14 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
     specs = Marshal.dump specs
 
-    if req.path =~ /\.gz$/ then
+    if req.path =~ /\.gz$/
       specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'
     end
 
-    if req.request_method == 'HEAD' then
+    if req.request_method == 'HEAD'
       res['content-length'] = specs.length
     else
       res.body << specs
@@ -579,13 +579,13 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
       selector = full_name.inspect
 
-      if specs.empty? then
+      if specs.empty?
         res.status = 404
         res.body = "No gems found matching #{selector}"
-      elsif specs.length > 1 then
+      elsif specs.length > 1
         res.status = 500
         res.body = "Multiple gems found matching #{selector}"
-      elsif marshal_format then
+      elsif marshal_format
         res['content-type'] = 'application/x-deflate'
         res.body << Gem.deflate(Marshal.dump(specs.first))
       end
@@ -818,7 +818,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
       '/gems' => '/cache/',
     }
 
-    if have_rdoc_4_plus? then
+    if have_rdoc_4_plus?
       @server.mount '/doc_root', RDoc::Servlet, '/doc_root'
     else
       file_handlers['/doc_root'] = '/doc/'
@@ -851,14 +851,14 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
     specs = Marshal.dump specs
 
-    if req.path =~ /\.gz$/ then
+    if req.path =~ /\.gz$/
       specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'
     end
 
-    if req.request_method == 'HEAD' then
+    if req.request_method == 'HEAD'
       res['content-length'] = specs.length
     else
       res.body << specs