rubygems-update 3.0.3 → 3.4.12

data/lib/rubygems/security.rb

@@ -5,15 +5,8 @@
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems/exceptions'
-require 'fileutils'
-
-begin
-  require 'openssl'
-rescue LoadError => e
-  raise unless (e.respond_to?(:path) && e.path == 'openssl') ||
-               e.message =~ / -- openssl$/
-end
+require_relative "exceptions"
+require_relative "openssl"
 
 ##
 # = Signing gems
@@ -62,11 +55,11 @@ end
 #
 #   $ tar tf your-gem-1.0.gem
 #   metadata.gz
-#   metadata.gz.sum
 #   metadata.gz.sig # metadata signature
 #   data.tar.gz
-#   data.tar.gz.sum
 #   data.tar.gz.sig # data signature
+#   checksums.yaml.gz
+#   checksums.yaml.gz.sig # checksums signature
 #
 # === Manually signing gems
 #
@@ -159,8 +152,11 @@ end
 #                                      certificate for EMAIL_ADDR
 #     -C, --certificate CERT           Signing certificate for --sign
 #     -K, --private-key KEY            Key for --sign or --build
+#     -A, --key-algorithm ALGORITHM    Select key algorithm for --build from RSA, DSA, or EC. Defaults to RSA.
 #     -s, --sign CERT                  Signs CERT with the key from -K
 #                                      and the certificate from -C
+#     -d, --days NUMBER_OF_DAYS        Days before the certificate expires
+#     -R, --re-sign                    Re-signs the certificate from -C with the key from -K
 #
 # We've already covered the <code>--build</code> option, and the
 # <code>--add</code>, <code>--list</code>, and <code>--remove</code> commands
@@ -265,7 +261,7 @@ end
 # 2. Grab the public key from the gemspec
 #
 #      gem spec some_signed_gem-1.0.gem cert_chain | \
-#        ruby -ryaml -e 'puts YAML.load_documents($stdin)' > public_key.crt
+#        ruby -rpsych -e 'puts Psych.load($stdin)' > public_key.crt
 #
 # 3. Generate a SHA1 hash of the data.tar.gz
 #
@@ -322,7 +318,6 @@ end
 # * Honor extension restrictions
 # * Might be better to store the certificate chain as a PKCS#7 or PKCS#12
 #   file, instead of an array embedded in the metadata.
-# * Flexible signature and key algorithms, not hard-coded to RSA and SHA1.
 #
 # == Original author
 #
@@ -337,46 +332,30 @@ module Gem::Security
   class Exception < Gem::Exception; end
 
   ##
-  # Digest algorithm used to sign gems
-
-  DIGEST_ALGORITHM =
-    if defined?(OpenSSL::Digest::SHA256)
-      OpenSSL::Digest::SHA256
-    elsif defined?(OpenSSL::Digest::SHA1)
-      OpenSSL::Digest::SHA1
-    else
-      require 'digest'
-      Digest::SHA512
-    end
+  # Used internally to select the signing digest from all computed digests
+
+  DIGEST_NAME = "SHA256" # :nodoc:
 
   ##
-  # Used internally to select the signing digest from all computed digests
+  # Length of keys created by RSA and DSA keys
 
-  DIGEST_NAME = # :nodoc:
-    if DIGEST_ALGORITHM.method_defined? :name
-      DIGEST_ALGORITHM.new.name
-    else
-      DIGEST_ALGORITHM.name[/::([^:]+)\z/, 1]
-    end
+  RSA_DSA_KEY_LENGTH = 3072
 
   ##
-  # Algorithm for creating the key pair used to sign gems
+  # Default algorithm to use when building a key pair
 
-  KEY_ALGORITHM =
-    if defined?(OpenSSL::PKey::RSA)
-      OpenSSL::PKey::RSA
-    end
+  DEFAULT_KEY_ALGORITHM = "RSA"
 
   ##
-  # Length of keys created by KEY_ALGORITHM
+  # Named curve used for Elliptic Curve
 
-  KEY_LENGTH = 3072
+  EC_NAME = "secp384r1"
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
   # Must be in the list returned by OpenSSL::Cipher.ciphers
 
-  KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
+  KEY_CIPHER = OpenSSL::Cipher.new("AES-256-CBC") if defined?(OpenSSL::Cipher)
 
   ##
   # One day in seconds
@@ -397,10 +376,10 @@ module Gem::Security
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
-    'basicConstraints'     => 'CA:FALSE',
-    'keyUsage'             =>
-      'keyEncipherment,dataEncipherment,digitalSignature',
-    'subjectKeyIdentifier' => 'hash',
+    "basicConstraints" => "CA:FALSE",
+    "keyUsage" =>
+      "keyEncipherment,dataEncipherment,digitalSignature",
+    "subjectKeyIdentifier" => "hash",
   }.freeze
 
   def self.alt_name_or_x509_entry(certificate, x509_entry)
@@ -423,7 +402,7 @@ module Gem::Security
                        serial = 1)
     cert = OpenSSL::X509::Certificate.new
 
-    cert.public_key = key.public_key
+    cert.public_key = get_public_key(key)
     cert.version    = 2
     cert.serial     = serial
 
@@ -441,6 +420,19 @@ module Gem::Security
     cert
   end
 
+  ##
+  # Gets the right public key from a PKey instance
+
+  def self.get_public_key(key)
+    # Ruby 3.0 (Ruby/OpenSSL 2.2) or later
+    return OpenSSL::PKey.read(key.public_to_der) if key.respond_to?(:public_to_der)
+    return key.public_key unless key.is_a?(OpenSSL::PKey::EC)
+
+    ec_key = OpenSSL::PKey::EC.new(key.group.curve_name)
+    ec_key.public_key = key.public_key
+    ec_key
+  end
+
   ##
   # Creates a self-signed certificate with an issuer and subject from +email+,
   # a subject alternative name of +email+ and the given +extensions+ for the
@@ -466,26 +458,55 @@ module Gem::Security
   end
 
   ##
-  # Creates a new key pair of the specified +length+ and +algorithm+.  The
-  # default is a 3072 bit RSA key.
+  # Creates a new digest instance using the specified +algorithm+. The default
+  # is SHA256.
+
+  if defined?(OpenSSL::Digest)
+    def self.create_digest(algorithm = DIGEST_NAME)
+      OpenSSL::Digest.new(algorithm)
+    end
+  else
+    require "digest"
 
-  def self.create_key(length = KEY_LENGTH, algorithm = KEY_ALGORITHM)
-    algorithm.new length
+    def self.create_digest(algorithm = DIGEST_NAME)
+      Digest.const_get(algorithm).new
+    end
+  end
+
+  ##
+  # Creates a new key pair of the specified +algorithm+. RSA, DSA, and EC
+  # are supported.
+
+  def self.create_key(algorithm)
+    if defined?(OpenSSL::PKey)
+      case algorithm.downcase
+      when "dsa"
+        OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
+      when "rsa"
+        OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
+      when "ec"
+        OpenSSL::PKey::EC.generate(EC_NAME)
+      else
+        raise Gem::Security::Exception,
+        "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
+      end
+    end
   end
 
   ##
   # Turns +email_address+ into an OpenSSL::X509::Name
 
   def self.email_to_name(email_address)
-    email_address = email_address.gsub(/[^\w@.-]+/i, '_')
-
-    cn, dcs = email_address.split '@'
+    email_address = email_address.gsub(/[^\w@.-]+/i, "_")
 
-    dcs = dcs.split '.'
+    cn, dcs = email_address.split "@"
 
-    name = "CN=#{cn}/#{dcs.map { |dc| "DC=#{dc}" }.join '/'}"
+    dcs = dcs.split "."
 
-    OpenSSL::X509::Name.parse name
+    OpenSSL::X509::Name.new([
+      ["CN", cn],
+      *dcs.map {|dc| ["DC", dc] },
+    ])
   end
 
   ##
@@ -499,7 +520,7 @@ module Gem::Security
     raise Gem::Security::Exception,
           "incorrect signing key for re-signing " +
           "#{expired_certificate.subject}" unless
-      expired_certificate.public_key.to_pem == private_key.public_key.to_pem
+      expired_certificate.check_private_key(private_key)
 
     unless expired_certificate.subject.to_s ==
            expired_certificate.issuer.to_s
@@ -526,7 +547,7 @@ module Gem::Security
 
   ##
   # Sign the public key from +certificate+ with the +signing_key+ and
-  # +signing_cert+, using the Gem::Security::DIGEST_ALGORITHM.  Uses the
+  # +signing_cert+, using the Gem::Security::DIGEST_NAME.  Uses the
   # default certificate validity range and extensions.
   #
   # Returns the newly signed certificate.
@@ -537,23 +558,23 @@ module Gem::Security
     signee_key     = certificate.public_key
 
     alt_name = certificate.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'subjectAltName' => alt_name.value if
+    extensions = extensions.merge "subjectAltName" => alt_name.value if
       alt_name
 
     issuer_alt_name = signing_cert.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'issuerAltName' => issuer_alt_name.value if
+    extensions = extensions.merge "issuerAltName" => issuer_alt_name.value if
       issuer_alt_name
 
     signed = create_cert signee_subject, signee_key, age, extensions, serial
     signed.issuer = signing_cert.subject
 
-    signed.sign signing_key, Gem::Security::DIGEST_ALGORITHM.new
+    signed.sign signing_key, Gem::Security::DIGEST_NAME
   end
 
   ##
@@ -563,7 +584,7 @@ module Gem::Security
   def self.trust_dir
     return @trust_dir if @trust_dir
 
-    dir = File.join Gem.user_home, '.gem', 'trust'
+    dir = File.join Gem.user_home, ".gem", "trust"
 
     @trust_dir ||= Gem::Security::TrustDir.new dir
   end
@@ -583,8 +604,8 @@ module Gem::Security
   def self.write(pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER)
     path = File.expand_path path
 
-    File.open path, 'wb', permissions do |io|
-      if passphrase and cipher
+    File.open path, "wb", permissions do |io|
+      if passphrase && cipher
         io.write pemmable.to_pem cipher, passphrase
       else
         io.write pemmable.to_pem
@@ -598,10 +619,10 @@ module Gem::Security
 
 end
 
-if defined?(OpenSSL::SSL)
-  require 'rubygems/security/policy'
-  require 'rubygems/security/policies'
-  require 'rubygems/security/trust_dir'
+if Gem::HAVE_OPENSSL
+  require_relative "security/policy"
+  require_relative "security/policies"
+  require_relative "security/trust_dir"
 end
 
-require 'rubygems/security/signer'
+require_relative "security/signer"

data/lib/rubygems/security_option.rb

@@ -5,7 +5,7 @@
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems'
+require_relative "../rubygems"
 
 # forward-declare
 
@@ -19,24 +19,23 @@ end
 
 module Gem::SecurityOption
   def add_security_option
-    # TODO: use @parser.accept
-    OptionParser.accept Gem::Security::Policy do |value|
-      require 'rubygems/security'
+    Gem::OptionParser.accept Gem::Security::Policy do |value|
+      require_relative "security"
 
-      raise OptionParser::InvalidArgument, 'OpenSSL not installed' unless
+      raise Gem::OptionParser::InvalidArgument, "OpenSSL not installed" unless
         defined?(Gem::Security::HighSecurity)
 
       policy = Gem::Security::Policies[value]
       unless policy
         valid = Gem::Security::Policies.keys.sort
-        raise OptionParser::InvalidArgument, "#{value} (#{valid.join ', '} are valid)"
+        raise Gem::OptionParser::InvalidArgument, "#{value} (#{valid.join ', '} are valid)"
       end
       policy
     end
 
-    add_option(:"Install/Update", '-P', '--trust-policy POLICY',
+    add_option(:"Install/Update", "-P", "--trust-policy POLICY",
                Gem::Security::Policy,
-               'Specify gem trust policy') do |value, options|
+               "Specify gem trust policy") do |value, options|
       options[:security_policy] = value
     end
   end

data/lib/rubygems/source/git.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'rubygems/util'
 
 ##
 # A git gem for use in a gem dependencies file.
@@ -12,7 +11,6 @@ require 'rubygems/util'
 #   source.specs
 
 class Gem::Source::Git < Gem::Source
-
   ##
   # The name of the gem created by this git gem.
 
@@ -51,16 +49,16 @@ class Gem::Source::Git < Gem::Source
   # will be checked out when the gem is installed.
 
   def initialize(name, repository, reference, submodules = false)
-    super repository
-
+    require_relative "../uri"
+    @uri = Gem::Uri.parse(repository)
     @name            = name
     @repository      = repository
-    @reference       = reference
+    @reference       = reference || "HEAD"
     @need_submodules = submodules
 
     @remote   = true
     @root_dir = Gem.dir
-    @git      = ENV['git'] || 'git'
+    @git      = ENV["git"] || "git"
   end
 
   def <=>(other)
@@ -78,10 +76,10 @@ class Gem::Source::Git < Gem::Source
   end
 
   def ==(other) # :nodoc:
-    super and
-      @name            == other.name and
-      @repository      == other.repository and
-      @reference       == other.reference and
+    super &&
+      @name            == other.name &&
+      @repository      == other.repository &&
+      @reference       == other.reference &&
       @need_submodules == other.need_submodules
   end
 
@@ -94,18 +92,21 @@ class Gem::Source::Git < Gem::Source
     return false unless File.exist? repo_cache_dir
 
     unless File.exist? install_dir
-      system @git, 'clone', '--quiet', '--no-checkout',
+      system @git, "clone", "--quiet", "--no-checkout",
              repo_cache_dir, install_dir
     end
 
     Dir.chdir install_dir do
-      system @git, 'fetch', '--quiet', '--force', '--tags', install_dir
+      system @git, "fetch", "--quiet", "--force", "--tags", install_dir
 
-      success = system @git, 'reset', '--quiet', '--hard', rev_parse
+      success = system @git, "reset", "--quiet", "--hard", rev_parse
 
-      success &&=
-        Gem::Util.silent_system @git, 'submodule', 'update',
-               '--quiet', '--init', '--recursive' if @need_submodules
+      if @need_submodules
+        require "open3"
+        _, status = Open3.capture2e(@git, "submodule", "update", "--quiet", "--init", "--recursive")
+
+        success &&= status.success?
+      end
 
       success
     end
@@ -119,11 +120,11 @@ class Gem::Source::Git < Gem::Source
 
     if File.exist? repo_cache_dir
       Dir.chdir repo_cache_dir do
-        system @git, 'fetch', '--quiet', '--force', '--tags',
-               @repository, 'refs/heads/*:refs/heads/*'
+        system @git, "fetch", "--quiet", "--force", "--tags",
+               @repository, "refs/heads/*:refs/heads/*"
       end
     else
-      system @git, 'clone', '--quiet', '--bare', '--no-hardlinks',
+      system @git, "clone", "--quiet", "--bare", "--no-hardlinks",
              @repository, repo_cache_dir
     end
   end
@@ -132,7 +133,7 @@ class Gem::Source::Git < Gem::Source
   # Directory where git gems get unpacked and so-forth.
 
   def base_dir # :nodoc:
-    File.join @root_dir, 'bundler'
+    File.join @root_dir, "bundler"
   end
 
   ##
@@ -154,11 +155,11 @@ class Gem::Source::Git < Gem::Source
   def install_dir # :nodoc:
     return unless File.exist? repo_cache_dir
 
-    File.join base_dir, 'gems', "#{@name}-#{dir_shortref}"
+    File.join base_dir, "gems", "#{@name}-#{dir_shortref}"
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[Git: ', ']' do
+    q.group 2, "[Git: ", "]" do
       q.breakable
       q.text @repository
 
@@ -171,7 +172,7 @@ class Gem::Source::Git < Gem::Source
   # The directory where the git gem's repository will be cached.
 
   def repo_cache_dir # :nodoc:
-    File.join @root_dir, 'cache', 'bundler', 'git', "#{@name}-#{uri_hash}"
+    File.join @root_dir, "cache", "bundler", "git", "#{@name}-#{uri_hash}"
   end
 
   ##
@@ -181,7 +182,7 @@ class Gem::Source::Git < Gem::Source
     hash = nil
 
     Dir.chdir repo_cache_dir do
-      hash = Gem::Util.popen(@git, 'rev-parse', @reference).strip
+      hash = Gem::Util.popen(@git, "rev-parse", @reference).strip
     end
 
     raise Gem::Exception,
@@ -200,7 +201,7 @@ class Gem::Source::Git < Gem::Source
     return [] unless install_dir
 
     Dir.chdir install_dir do
-      Dir['{,*,*/*}.gemspec'].map do |spec_file|
+      Dir["{,*,*/*}.gemspec"].map do |spec_file|
         directory = File.dirname spec_file
         file      = File.basename spec_file
 
@@ -210,7 +211,7 @@ class Gem::Source::Git < Gem::Source
             spec.base_dir = base_dir
 
             spec.extension_dir =
-              File.join base_dir, 'extensions', Gem::Platform.local.to_s,
+              File.join base_dir, "extensions", Gem::Platform.local.to_s,
                 Gem.extension_api_version, "#{name}-#{dir_shortref}"
 
             spec.full_gem_path = File.dirname spec.loaded_from if spec
@@ -225,17 +226,16 @@ class Gem::Source::Git < Gem::Source
   # A hash for the git gem based on the git repository URI.
 
   def uri_hash # :nodoc:
-    require 'digest' # required here to avoid deadlocking in Gem.activate_bin_path (because digest is a gem on 2.5+)
+    require_relative "../openssl"
 
     normalized =
-      if @repository =~ %r%^\w+://(\w+@)?%
-        uri = URI(@repository).normalize.to_s.sub %r%/$%,''
+      if @repository =~ %r{^\w+://(\w+@)?}
+        uri = URI(@repository).normalize.to_s.sub %r{/$},""
         uri.sub(/\A(\w+)/) { $1.downcase }
       else
         @repository
       end
 
-    Digest::SHA1.hexdigest normalized
+    OpenSSL::Digest::SHA1.hexdigest normalized
   end
-
 end

data/lib/rubygems/source/installed.rb

@@ -3,7 +3,6 @@
 # Represents an installed gem.  This is used for dependency resolution.
 
 class Gem::Source::Installed < Gem::Source
-
   def initialize # :nodoc:
     @uri = nil
   end
@@ -34,7 +33,6 @@ class Gem::Source::Installed < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.text '[Installed]'
+    q.text "[Installed]"
   end
-
 end

data/lib/rubygems/source/local.rb

@@ -4,7 +4,6 @@
 # dependencies.
 
 class Gem::Source::Local < Gem::Source
-
   def initialize # :nodoc:
     @specs   = nil
     @api_uri = nil
@@ -30,7 +29,7 @@ class Gem::Source::Local < Gem::Source
   end
 
   def inspect # :nodoc:
-    keys = @specs ? @specs.keys.sort : 'NOT LOADED'
+    keys = @specs ? @specs.keys.sort : "NOT LOADED"
     "#<%s specs: %p>" % [self.class, keys]
   end
 
@@ -61,7 +60,7 @@ class Gem::Source::Local < Gem::Source
           when :latest
             tup = pkg.spec.name_tuple
 
-            cur = names.find { |x| x.name == tup.name }
+            cur = names.find {|x| x.name == tup.name }
             if !cur
               names << tup
             elsif cur.version < tup.version
@@ -98,7 +97,7 @@ class Gem::Source::Local < Gem::Source
       end
     end
 
-    found.max_by { |s| s.version }
+    found.max_by {|s| s.version }
   end
 
   def fetch_spec(name) # :nodoc:
@@ -122,12 +121,11 @@ class Gem::Source::Local < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[Local gems:', ']' do
+    q.group 2, "[Local gems:", "]" do
       q.breakable
       q.seplist @specs.keys do |v|
         q.text v.full_name
       end
     end
   end
-
 end

data/lib/rubygems/source/lock.rb

@@ -5,7 +5,6 @@
 # dependency lock files.
 
 class Gem::Source::Lock < Gem::Source
-
   ##
   # The wrapped Gem::Source
 
@@ -48,5 +47,4 @@ class Gem::Source::Lock < Gem::Source
   def uri # :nodoc:
     @wrapped.uri
   end
-
 end

data/lib/rubygems/source/specific_file.rb

@@ -4,7 +4,6 @@
 # local gems.
 
 class Gem::Source::SpecificFile < Gem::Source
-
   ##
   # The path to the gem for this specific file.
 
@@ -43,7 +42,7 @@ class Gem::Source::SpecificFile < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[SpecificFile:', ']' do
+    q.group 2, "[SpecificFile:", "]" do
       q.breakable
       q.text @path
     end
@@ -69,5 +68,4 @@ class Gem::Source::SpecificFile < Gem::Source
       super
     end
   end
-
 end

data/lib/rubygems/source/vendor.rb

@@ -3,7 +3,6 @@
 # This represents a vendored source that is similar to an installed gem.
 
 class Gem::Source::Vendor < Gem::Source::Installed
-
   ##
   # Creates a new Vendor source for a gem that was unpacked at +path+.
 
@@ -23,5 +22,4 @@ class Gem::Source::Vendor < Gem::Source::Installed
       nil
     end
   end
-
 end