rubygems-update 3.0.6 → 3.2.14

data/lib/rubygems/security/signer.rb

@@ -5,7 +5,6 @@
 require "rubygems/user_interaction"
 
 class Gem::Security::Signer
-
   include Gem::UserInteraction
 
   ##
@@ -35,11 +34,11 @@ class Gem::Security::Signer
   attr_reader :options
 
   DEFAULT_OPTIONS = {
-    expiration_length_days: 365
+    expiration_length_days: 365,
   }.freeze
 
   ##
-  # Attemps to re-sign an expired cert with a given private key
+  # Attempts to re-sign an expired cert with a given private key
   def self.re_sign_cert(expired_cert, expired_cert_path, private_key)
     return unless expired_cert.not_after < Time.now
 
@@ -72,7 +71,7 @@ class Gem::Security::Signer
     @options = DEFAULT_OPTIONS.merge(options)
 
     unless @key
-      default_key  = File.join Gem.default_key_path
+      default_key = File.join Gem.default_key_path
       @key = default_key if File.exist? default_key
     end
 
@@ -81,11 +80,10 @@ class Gem::Security::Signer
       @cert_chain = [default_cert] if File.exist? default_cert
     end
 
-    @digest_algorithm = Gem::Security::DIGEST_ALGORITHM
     @digest_name      = Gem::Security::DIGEST_NAME
+    @digest_algorithm = Gem::Security.create_digest(@digest_name)
 
     if @key && !@key.is_a?(OpenSSL::PKey::RSA)
-      @passphrase ||= ask_for_password("Enter PEM pass phrase:")
       @key = OpenSSL::PKey::RSA.new(File.read(@key), @passphrase)
     end
 
@@ -107,10 +105,10 @@ class Gem::Security::Signer
   # this value is preferred, otherwise the subject is used.
 
   def extract_name(cert) # :nodoc:
-    subject_alt_name = cert.extensions.find { |e| 'subjectAltName' == e.oid }
+    subject_alt_name = cert.extensions.find {|e| 'subjectAltName' == e.oid }
 
     if subject_alt_name
-      /\Aemail:/ =~ subject_alt_name.value
+      /\Aemail:/ =~ subject_alt_name.value # rubocop:disable Performance/StartWith
 
       $' || subject_alt_name.value
     else
@@ -144,6 +142,8 @@ class Gem::Security::Signer
     raise Gem::Security::Exception, 'no certs provided' if @cert_chain.empty?
 
     if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now
+      alert("Your certificate has expired, trying to re-sign it...")
+
       re_sign_key(
         expiration_length: (Gem::Security::ONE_DAY * options[:expiration_length_days])
       )
@@ -201,5 +201,4 @@ class Gem::Security::Signer
       end
     end
   end
-
 end

data/lib/rubygems/security/trust_dir.rb

@@ -4,7 +4,6 @@
 # verification.
 
 class Gem::Security::TrustDir
-
   ##
   # Default permissions for the trust directory and its contents
 
@@ -26,7 +25,7 @@ class Gem::Security::TrustDir
     @dir = dir
     @permissions = permissions
 
-    @digester = Gem::Security::DIGEST_ALGORITHM
+    @digester = Gem::Security.create_digest
   end
 
   ##
@@ -115,5 +114,4 @@ class Gem::Security::TrustDir
       FileUtils.mkdir_p @dir, :mode => @permissions[:trust_dir]
     end
   end
-
 end

data/lib/rubygems/server.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'webrick'
 require 'zlib'
 require 'erb'
 require 'uri'
@@ -29,7 +28,6 @@ require 'rubygems/rdoc'
 # TODO Refactor into a real WEBrick servlet to remove code duplication.
 
 class Gem::Server
-
   attr_reader :spec_dirs
 
   include ERB::Util
@@ -430,6 +428,12 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
   end
 
   def initialize(gem_dirs, port, daemon, launch = nil, addresses = nil)
+    begin
+      require 'webrick'
+    rescue LoadError
+      abort "webrick is not found. You may need to `gem install webrick` to install webrick."
+    end
+
     Gem::RDoc.load_rdoc
     Socket.do_not_reverse_lookup = true
 
@@ -442,8 +446,8 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     logger  = WEBrick::Log.new nil, WEBrick::BasicLog::FATAL
     @server = WEBrick::HTTPServer.new :DoNotListen => true, :Logger => logger
 
-    @spec_dirs = @gem_dirs.map { |gem_dir| File.join gem_dir, 'specifications' }
-    @spec_dirs.reject! { |spec_dir| !File.directory? spec_dir }
+    @spec_dirs = @gem_dirs.map {|gem_dir| File.join gem_dir, 'specifications' }
+    @spec_dirs.reject! {|spec_dir| !File.directory? spec_dir }
 
     reset_gems
 
@@ -458,7 +462,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
   def uri_encode(str)
     str.gsub(URI::UNSAFE) do |match|
-      match.each_byte.map { |c| sprintf('%%%02X', c.ord) }.join
+      match.each_byte.map {|c| sprintf('%%%02X', c.ord) }.join
     end
   end
 
@@ -573,7 +577,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     add_date res
 
     case req.request_uri.path
-    when %r|^/quick/(Marshal.#{Regexp.escape Gem.marshal_version}/)?(.*?)\.gemspec\.rz$| then
+    when %r{^/quick/(Marshal.#{Regexp.escape Gem.marshal_version}/)?(.*?)\.gemspec\.rz$} then
       marshal_format, full_name = $1, $2
       specs = Gem::Specification.find_all_by_full_name(full_name)
 
@@ -607,19 +611,19 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
 
     Gem::Specification.each do |spec|
       total_file_count += spec.files.size
-      deps = spec.dependencies.map { |dep|
+      deps = spec.dependencies.map do |dep|
         {
           "name"    => dep.name,
           "type"    => dep.type,
           "version" => dep.requirement.to_s,
         }
-      }
+      end
 
-      deps = deps.sort_by { |dep| [dep["name"].downcase, dep["version"]] }
+      deps = deps.sort_by {|dep| [dep["name"].downcase, dep["version"]] }
       deps.last["is_last"] = true unless deps.empty?
 
       # executables
-      executables = spec.executables.sort.collect { |exec| {"executable" => exec} }
+      executables = spec.executables.sort.collect {|exec| {"executable" => exec} }
       executables = nil if executables.empty?
       executables.last["is_last"] = true if executables
 
@@ -661,14 +665,14 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
       "only_one_executable" => true,
       "full_name" => "rubygems-#{Gem::VERSION}",
       "has_deps" => false,
-      "homepage" => "http://guides.rubygems.org/",
+      "homepage" => "https://guides.rubygems.org/",
       "name" => 'rubygems',
       "ri_installed" => true,
       "summary" => "RubyGems itself",
       "version" => Gem::VERSION,
     }
 
-    specs = specs.sort_by { |spec| [spec["name"].downcase, spec["version"]] }
+    specs = specs.sort_by {|spec| [spec["name"].downcase, spec["version"]] }
     specs.last["is_last"] = true
 
     # tag all specs with first_name_entry
@@ -754,9 +758,9 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
   # documentation - just put it underneath the main doc folder.
 
   def show_rdoc_for_pattern(pattern, res)
-    found_gems = Dir.glob("{#{@gem_dirs.join ','}}/doc/#{pattern}").select {|path|
+    found_gems = Dir.glob("{#{@gem_dirs.join ','}}/doc/#{pattern}").select do |path|
       File.exist? File.join(path, 'rdoc/index.html')
-    }
+    end
     case found_gems.length
     when 0
       return false
@@ -772,7 +776,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
         doc_items << {
           :name    => base_name,
           :url     => doc_root(new_path),
-          :summary => ''
+          :summary => '',
         }
       end
 
@@ -869,7 +873,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     listeners = @server.listeners.map{|l| l.addr[2] }
 
     # TODO: 0.0.0.0 == any, not localhost.
-    host = listeners.any?{|l| l == '0.0.0.0'} ? 'localhost' : listeners.first
+    host = listeners.any?{|l| l == '0.0.0.0' } ? 'localhost' : listeners.first
 
     say "Launching browser to http://#{host}:#{@port}"
 

data/lib/rubygems/source.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
-autoload :FileUtils, 'fileutils'
-autoload :URI, 'uri'
 
+require "rubygems/text"
 ##
 # A Source knows how to list and fetch gems from a RubyGems marshal index.
 #
@@ -9,8 +8,8 @@ autoload :URI, 'uri'
 # bundler dependency API and so-forth.
 
 class Gem::Source
-
   include Comparable
+  include Gem::Text
 
   FILES = { # :nodoc:
     :released   => 'specs',
@@ -80,7 +79,15 @@ class Gem::Source
   def dependency_resolver_set # :nodoc:
     return Gem::Resolver::IndexSet.new self if 'file' == uri.scheme
 
-    bundler_api_uri = uri + './api/v1/dependencies'
+    fetch_uri = if uri.host == "rubygems.org"
+                  index_uri = uri.dup
+                  index_uri.host = "index.rubygems.org"
+                  index_uri
+                else
+                  uri
+                end
+
+    bundler_api_uri = enforce_trailing_slash(fetch_uri)
 
     begin
       fetcher = Gem::RemoteFetcher.fetcher
@@ -88,11 +95,7 @@ class Gem::Source
     rescue Gem::RemoteFetcher::FetchError
       Gem::Resolver::IndexSet.new self
     else
-      if response.respond_to? :uri
-        Gem::Resolver::APISet.new response.uri
-      else
-        Gem::Resolver::APISet.new bundler_api_uri
-      end
+      Gem::Resolver::APISet.new response.uri + "./info/"
     end
   end
 
@@ -106,7 +109,7 @@ class Gem::Source
   def cache_dir(uri)
     # Correct for windows paths
     escaped_path = uri.path.sub(/^\/([a-z]):\//i, '/\\1-/')
-    escaped_path.untaint
+    escaped_path.tap(&Gem::UNTAINT)
 
     File.join Gem.spec_cache_dir, "#{uri.host}%#{uri.port}", File.dirname(escaped_path)
   end
@@ -131,7 +134,7 @@ class Gem::Source
 
     spec_file_name = name_tuple.spec_name
 
-    source_uri = uri + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
+    source_uri = enforce_trailing_slash(uri) + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
 
     cache_dir = cache_dir source_uri
 
@@ -149,6 +152,7 @@ class Gem::Source
     spec = Gem::Util.inflate spec
 
     if update_cache?
+      require "fileutils"
       FileUtils.mkdir_p cache_dir
 
       File.open local_spec, 'wb' do |io|
@@ -175,12 +179,15 @@ class Gem::Source
     file       = FILES[type]
     fetcher    = Gem::RemoteFetcher.fetcher
     file_name  = "#{file}.#{Gem.marshal_version}"
-    spec_path  = uri + "#{file_name}.gz"
+    spec_path  = enforce_trailing_slash(uri) + "#{file_name}.gz"
     cache_dir  = cache_dir spec_path
     local_file = File.join(cache_dir, file_name)
     retried    = false
 
-    FileUtils.mkdir_p cache_dir if update_cache?
+    if update_cache?
+      require "fileutils"
+      FileUtils.mkdir_p cache_dir
+    end
 
     spec_dump = fetcher.cache_update_path spec_path, local_file, update_cache?
 
@@ -219,6 +226,16 @@ class Gem::Source
     end
   end
 
+  def typo_squatting?(host, distance_threshold=4)
+    return if @uri.host.nil?
+    levenshtein_distance(@uri.host, host).between? 1, distance_threshold
+  end
+
+  private
+
+  def enforce_trailing_slash(uri)
+    uri.merge(uri.path.gsub(/\/+$/, '') + '/')
+  end
 end
 
 require 'rubygems/source/git'

data/lib/rubygems/source/git.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'rubygems/util'
 
 ##
 # A git gem for use in a gem dependencies file.
@@ -12,7 +11,6 @@ require 'rubygems/util'
 #   source.specs
 
 class Gem::Source::Git < Gem::Source
-
   ##
   # The name of the gem created by this git gem.
 
@@ -103,9 +101,11 @@ class Gem::Source::Git < Gem::Source
 
       success = system @git, 'reset', '--quiet', '--hard', rev_parse
 
-      success &&=
-        Gem::Util.silent_system @git, 'submodule', 'update',
-               '--quiet', '--init', '--recursive' if @need_submodules
+      if @need_submodules
+        _, status = Open3.capture2e(@git, 'submodule', 'update', '--quiet', '--init', '--recursive')
+
+        success &&= status.success?
+      end
 
       success
     end
@@ -228,8 +228,8 @@ class Gem::Source::Git < Gem::Source
     require 'digest' # required here to avoid deadlocking in Gem.activate_bin_path (because digest is a gem on 2.5+)
 
     normalized =
-      if @repository =~ %r%^\w+://(\w+@)?%
-        uri = URI(@repository).normalize.to_s.sub %r%/$%,''
+      if @repository =~ %r{^\w+://(\w+@)?}
+        uri = URI(@repository).normalize.to_s.sub %r{/$},''
         uri.sub(/\A(\w+)/) { $1.downcase }
       else
         @repository
@@ -237,5 +237,4 @@ class Gem::Source::Git < Gem::Source
 
     Digest::SHA1.hexdigest normalized
   end
-
 end

data/lib/rubygems/source/installed.rb

@@ -3,7 +3,6 @@
 # Represents an installed gem.  This is used for dependency resolution.
 
 class Gem::Source::Installed < Gem::Source
-
   def initialize # :nodoc:
     @uri = nil
   end
@@ -36,5 +35,4 @@ class Gem::Source::Installed < Gem::Source
   def pretty_print(q) # :nodoc:
     q.text '[Installed]'
   end
-
 end

data/lib/rubygems/source/local.rb

@@ -4,7 +4,6 @@
 # dependencies.
 
 class Gem::Source::Local < Gem::Source
-
   def initialize # :nodoc:
     @specs   = nil
     @api_uri = nil
@@ -61,7 +60,7 @@ class Gem::Source::Local < Gem::Source
           when :latest
             tup = pkg.spec.name_tuple
 
-            cur = names.find { |x| x.name == tup.name }
+            cur = names.find {|x| x.name == tup.name }
             if !cur
               names << tup
             elsif cur.version < tup.version
@@ -98,7 +97,7 @@ class Gem::Source::Local < Gem::Source
       end
     end
 
-    found.max_by { |s| s.version }
+    found.max_by {|s| s.version }
   end
 
   def fetch_spec(name) # :nodoc:
@@ -129,5 +128,4 @@ class Gem::Source::Local < Gem::Source
       end
     end
   end
-
 end

data/lib/rubygems/source/lock.rb

@@ -5,7 +5,6 @@
 # dependency lock files.
 
 class Gem::Source::Lock < Gem::Source
-
   ##
   # The wrapped Gem::Source
 
@@ -48,5 +47,4 @@ class Gem::Source::Lock < Gem::Source
   def uri # :nodoc:
     @wrapped.uri
   end
-
 end

data/lib/rubygems/source/specific_file.rb

@@ -4,7 +4,6 @@
 # local gems.
 
 class Gem::Source::SpecificFile < Gem::Source
-
   ##
   # The path to the gem for this specific file.
 
@@ -69,5 +68,4 @@ class Gem::Source::SpecificFile < Gem::Source
       super
     end
   end
-
 end

data/lib/rubygems/source/vendor.rb

@@ -3,7 +3,6 @@
 # This represents a vendored source that is similar to an installed gem.
 
 class Gem::Source::Vendor < Gem::Source::Installed
-
   ##
   # Creates a new Vendor source for a gem that was unpacked at +path+.
 
@@ -23,5 +22,4 @@ class Gem::Source::Vendor < Gem::Source::Installed
       nil
     end
   end
-
 end