rubygems-update 3.3.18 → 3.4.19

data/lib/rubygems/security/policies.rb

@@ -1,17 +1,18 @@
 # frozen_string_literal: true
+
 module Gem::Security
 
   ##
   # No security policy: all package signature checks are disabled.
 
   NoSecurity = Policy.new(
-    'No Security',
-    :verify_data      => false,
-    :verify_signer    => false,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "No Security",
+    :verify_data => false,
+    :verify_signer => false,
+    :verify_chain => false,
+    :verify_root => false,
+    :only_trusted => false,
+    :only_signed => false
   )
 
   ##
@@ -23,13 +24,13 @@ module Gem::Security
   # easily spoofed, and is not recommended.
 
   AlmostNoSecurity = Policy.new(
-    'Almost No Security',
-    :verify_data      => true,
-    :verify_signer    => false,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Almost No Security",
+    :verify_data => true,
+    :verify_signer => false,
+    :verify_chain => false,
+    :verify_root => false,
+    :only_trusted => false,
+    :only_signed => false
   )
 
   ##
@@ -40,13 +41,13 @@ module Gem::Security
   # is not recommended.
 
   LowSecurity = Policy.new(
-    'Low Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Low Security",
+    :verify_data => true,
+    :verify_signer => true,
+    :verify_chain => false,
+    :verify_root => false,
+    :only_trusted => false,
+    :only_signed => false
   )
 
   ##
@@ -59,13 +60,13 @@ module Gem::Security
   # gem off as unsigned.
 
   MediumSecurity = Policy.new(
-    'Medium Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => true,
-    :only_signed      => false
+    "Medium Security",
+    :verify_data => true,
+    :verify_signer => true,
+    :verify_chain => true,
+    :verify_root => true,
+    :only_trusted => true,
+    :only_signed => false
   )
 
   ##
@@ -78,37 +79,37 @@ module Gem::Security
   # a reasonable guarantee that the contents of the gem have not been altered.
 
   HighSecurity = Policy.new(
-    'High Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => true,
-    :only_signed      => true
+    "High Security",
+    :verify_data => true,
+    :verify_signer => true,
+    :verify_chain => true,
+    :verify_root => true,
+    :only_trusted => true,
+    :only_signed => true
   )
 
   ##
   # Policy used to verify a certificate and key when signing a gem
 
   SigningPolicy = Policy.new(
-    'Signing Policy',
-    :verify_data      => false,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Signing Policy",
+    :verify_data => false,
+    :verify_signer => true,
+    :verify_chain => true,
+    :verify_root => true,
+    :only_trusted => false,
+    :only_signed => false
   )
 
   ##
   # Hash of configured security policies
 
   Policies = {
-    'NoSecurity'       => NoSecurity,
-    'AlmostNoSecurity' => AlmostNoSecurity,
-    'LowSecurity'      => LowSecurity,
-    'MediumSecurity'   => MediumSecurity,
-    'HighSecurity'     => HighSecurity,
+    "NoSecurity" => NoSecurity,
+    "AlmostNoSecurity" => AlmostNoSecurity,
+    "LowSecurity" => LowSecurity,
+    "MediumSecurity" => MediumSecurity,
+    "HighSecurity" => HighSecurity,
     # SigningPolicy is not intended for use by `gem -P` so do not list it
   }.freeze
 

data/lib/rubygems/security/policy.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
-require_relative '../user_interaction'
+
+require_relative "../user_interaction"
 
 ##
 # A Gem::Security::Policy object encapsulates the settings for verifying
@@ -53,8 +54,8 @@ class Gem::Security::Policy
   # and is valid for the given +time+.
 
   def check_chain(chain, time)
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
-    raise Gem::Security::Exception, 'empty signing chain' if chain.empty?
+    raise Gem::Security::Exception, "missing signing chain" unless chain
+    raise Gem::Security::Exception, "empty signing chain" if chain.empty?
 
     begin
       chain.each_cons 2 do |issuer, cert|
@@ -83,21 +84,21 @@ class Gem::Security::Policy
   # If the +issuer+ is +nil+ no verification is performed.
 
   def check_cert(signer, issuer, time)
-    raise Gem::Security::Exception, 'missing signing certificate' unless
+    raise Gem::Security::Exception, "missing signing certificate" unless
       signer
 
     message = "certificate #{signer.subject}"
 
-    if not_before = signer.not_before and not_before > time
+    if (not_before = signer.not_before) && not_before > time
       raise Gem::Security::Exception,
             "#{message} not valid before #{not_before}"
     end
 
-    if not_after = signer.not_after and not_after < time
+    if (not_after = signer.not_after) && not_after < time
       raise Gem::Security::Exception, "#{message} not valid after #{not_after}"
     end
 
-    if issuer and not signer.verify issuer.public_key
+    if issuer && !signer.verify(issuer.public_key)
       raise Gem::Security::Exception,
             "#{message} was not issued by #{issuer.subject}"
     end
@@ -109,10 +110,10 @@ class Gem::Security::Policy
   # Ensures the public key of +key+ matches the public key in +signer+
 
   def check_key(signer, key)
-    unless signer and key
+    unless signer && key
       return true unless @only_signed
 
-      raise Gem::Security::Exception, 'missing key or signature'
+      raise Gem::Security::Exception, "missing key or signature"
     end
 
     raise Gem::Security::Exception,
@@ -127,11 +128,11 @@ class Gem::Security::Policy
   # +time+.
 
   def check_root(chain, time)
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
+    raise Gem::Security::Exception, "missing signing chain" unless chain
 
     root = chain.first
 
-    raise Gem::Security::Exception, 'missing root certificate' unless root
+    raise Gem::Security::Exception, "missing root certificate" unless root
 
     raise Gem::Security::Exception,
           "root certificate #{root.subject} is not self-signed " +
@@ -146,11 +147,11 @@ class Gem::Security::Policy
   # the digests of the two certificates match according to +digester+
 
   def check_trust(chain, digester, trust_dir)
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
+    raise Gem::Security::Exception, "missing signing chain" unless chain
 
     root = chain.first
 
-    raise Gem::Security::Exception, 'missing root certificate' unless root
+    raise Gem::Security::Exception, "missing root certificate" unless root
 
     path = Gem::Security.trust_dir.cert_path root
 
@@ -182,7 +183,7 @@ class Gem::Security::Policy
 
   def subject(certificate) # :nodoc:
     certificate.extensions.each do |extension|
-      next unless extension.oid == 'subjectAltName'
+      next unless extension.oid == "subjectAltName"
 
       return extension.value
     end
@@ -206,7 +207,7 @@ class Gem::Security::Policy
   # If +key+ is given it is used to validate the signing certificate.
 
   def verify(chain, key = nil, digests = {}, signatures = {},
-             full_name = '(unknown)')
+             full_name = "(unknown)")
     if signatures.empty?
       if @only_signed
         raise Gem::Security::Exception,
@@ -230,8 +231,8 @@ class Gem::Security::Policy
     end
 
     if @verify_data
-      raise Gem::Security::Exception, 'no digests provided (probable bug)' if
-        signer_digests.nil? or signer_digests.empty?
+      raise Gem::Security::Exception, "no digests provided (probable bug)" if
+        signer_digests.nil? || signer_digests.empty?
     else
       signer_digests = {}
     end
@@ -248,7 +249,7 @@ class Gem::Security::Policy
 
     if @only_trusted
       check_trust chain, digester, trust_dir
-    elsif signatures.empty? and digests.empty?
+    elsif signatures.empty? && digests.empty?
       # trust is irrelevant if there's no signatures to verify
     else
       alert_warning "#{subject signer} is not trusted for #{full_name}"

data/lib/rubygems/security/signer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Basic OpenSSL-based package signing class.
 
@@ -42,7 +43,7 @@ class Gem::Security::Signer
   def self.re_sign_cert(expired_cert, expired_cert_path, private_key)
     return unless expired_cert.not_after < Time.now
 
-    expiry = expired_cert.not_after.strftime('%Y%m%d%H%M%S')
+    expiry = expired_cert.not_after.strftime("%Y%m%d%H%M%S")
     expired_cert_file = "#{File.basename(expired_cert_path)}.expired.#{expiry}"
     new_expired_cert_path = File.join(Gem.user_home, ".gem", expired_cert_file)
 
@@ -105,7 +106,7 @@ class Gem::Security::Signer
   # this value is preferred, otherwise the subject is used.
 
   def extract_name(cert) # :nodoc:
-    subject_alt_name = cert.extensions.find {|e| 'subjectAltName' == e.oid }
+    subject_alt_name = cert.extensions.find {|e| "subjectAltName" == e.oid }
 
     if subject_alt_name
       /\Aemail:/ =~ subject_alt_name.value # rubocop:disable Performance/StartWith
@@ -139,9 +140,9 @@ class Gem::Security::Signer
   def sign(data)
     return unless @key
 
-    raise Gem::Security::Exception, 'no certs provided' if @cert_chain.empty?
+    raise Gem::Security::Exception, "no certs provided" if @cert_chain.empty?
 
-    if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now
+    if @cert_chain.length == 1 && @cert_chain.last.not_after < Time.now
       alert("Your certificate has expired, trying to re-sign it...")
 
       re_sign_key(
@@ -182,7 +183,7 @@ class Gem::Security::Signer
     return unless disk_key
 
     if disk_key.to_pem == @key.to_pem && disk_cert == old_cert.to_pem
-      expiry = old_cert.not_after.strftime('%Y%m%d%H%M%S')
+      expiry = old_cert.not_after.strftime("%Y%m%d%H%M%S")
       old_cert_file = "gem-public_cert.pem.expired.#{expiry}"
       old_cert_path = File.join(Gem.user_home, ".gem", old_cert_file)
 

data/lib/rubygems/security/trust_dir.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The TrustDir manages the trusted certificates for gem signature
 # verification.
@@ -8,7 +9,7 @@ class Gem::Security::TrustDir
   # Default permissions for the trust directory and its contents
 
   DEFAULT_PERMISSIONS = {
-    :trust_dir    => 0700,
+    :trust_dir => 0700,
     :trusted_cert => 0600,
   }.freeze
 
@@ -41,7 +42,7 @@ class Gem::Security::TrustDir
   def each_certificate
     return enum_for __method__ unless block_given?
 
-    glob = File.join @dir, '*.pem'
+    glob = File.join @dir, "*.pem"
 
     Dir[glob].each do |certificate_file|
       begin
@@ -92,7 +93,7 @@ class Gem::Security::TrustDir
 
     destination = cert_path certificate
 
-    File.open destination, 'wb', 0600 do |io|
+    File.open destination, "wb", 0600 do |io|
       io.write certificate.to_pem
       io.chmod(@permissions[:trusted_cert])
     end
@@ -104,7 +105,7 @@ class Gem::Security::TrustDir
   # permissions.
 
   def verify
-    require 'fileutils'
+    require "fileutils"
     if File.exist? @dir
       raise Gem::Security::Exception,
         "trust directory #{@dir} is not a directory" unless

data/lib/rubygems/security.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require_relative 'exceptions'
-require_relative 'openssl'
+require_relative "exceptions"
+require_relative "openssl"
 
 ##
 # = Signing gems
@@ -334,7 +335,7 @@ module Gem::Security
   ##
   # Used internally to select the signing digest from all computed digests
 
-  DIGEST_NAME = 'SHA256' # :nodoc:
+  DIGEST_NAME = "SHA256" # :nodoc:
 
   ##
   # Length of keys created by RSA and DSA keys
@@ -344,18 +345,18 @@ module Gem::Security
   ##
   # Default algorithm to use when building a key pair
 
-  DEFAULT_KEY_ALGORITHM = 'RSA'
+  DEFAULT_KEY_ALGORITHM = "RSA"
 
   ##
   # Named curve used for Elliptic Curve
 
-  EC_NAME = 'secp384r1'
+  EC_NAME = "secp384r1"
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
   # Must be in the list returned by OpenSSL::Cipher.ciphers
 
-  KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
+  KEY_CIPHER = OpenSSL::Cipher.new("AES-256-CBC") if defined?(OpenSSL::Cipher)
 
   ##
   # One day in seconds
@@ -376,10 +377,10 @@ module Gem::Security
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
-    'basicConstraints'     => 'CA:FALSE',
-    'keyUsage'             =>
-      'keyEncipherment,dataEncipherment,digitalSignature',
-    'subjectKeyIdentifier' => 'hash',
+    "basicConstraints" => "CA:FALSE",
+    "keyUsage" =>
+      "keyEncipherment,dataEncipherment,digitalSignature",
+    "subjectKeyIdentifier" => "hash",
   }.freeze
 
   def self.alt_name_or_x509_entry(certificate, x509_entry)
@@ -433,13 +434,6 @@ module Gem::Security
     ec_key
   end
 
-  ##
-  # In Ruby 2.3 EC doesn't implement the private_key? but not the private? method
-
-  if defined?(OpenSSL::PKey::EC) && Gem::Version.new(String.new(RUBY_VERSION)) < Gem::Version.new("2.4.0")
-    OpenSSL::PKey::EC.send(:alias_method, :private?, :private_key?)
-  end
-
   ##
   # Creates a self-signed certificate with an issuer and subject from +email+,
   # a subject alternative name of +email+ and the given +extensions+ for the
@@ -473,7 +467,7 @@ module Gem::Security
       OpenSSL::Digest.new(algorithm)
     end
   else
-    require 'digest'
+    require "digest"
 
     def self.create_digest(algorithm = DIGEST_NAME)
       Digest.const_get(algorithm).new
@@ -487,18 +481,12 @@ module Gem::Security
   def self.create_key(algorithm)
     if defined?(OpenSSL::PKey)
       case algorithm.downcase
-      when 'dsa'
+      when "dsa"
         OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
-      when 'rsa'
+      when "rsa"
         OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
-      when 'ec'
-        if RUBY_VERSION >= "2.4.0"
-          OpenSSL::PKey::EC.generate(EC_NAME)
-        else
-          domain_key = OpenSSL::PKey::EC.new(EC_NAME)
-          domain_key.generate_key
-          domain_key
-        end
+      when "ec"
+        OpenSSL::PKey::EC.generate(EC_NAME)
       else
         raise Gem::Security::Exception,
         "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
@@ -510,11 +498,11 @@ module Gem::Security
   # Turns +email_address+ into an OpenSSL::X509::Name
 
   def self.email_to_name(email_address)
-    email_address = email_address.gsub(/[^\w@.-]+/i, '_')
+    email_address = email_address.gsub(/[^\w@.-]+/i, "_")
 
-    cn, dcs = email_address.split '@'
+    cn, dcs = email_address.split "@"
 
-    dcs = dcs.split '.'
+    dcs = dcs.split "."
 
     OpenSSL::X509::Name.new([
       ["CN", cn],
@@ -571,17 +559,17 @@ module Gem::Security
     signee_key     = certificate.public_key
 
     alt_name = certificate.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'subjectAltName' => alt_name.value if
+    extensions = extensions.merge "subjectAltName" => alt_name.value if
       alt_name
 
     issuer_alt_name = signing_cert.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'issuerAltName' => issuer_alt_name.value if
+    extensions = extensions.merge "issuerAltName" => issuer_alt_name.value if
       issuer_alt_name
 
     signed = create_cert signee_subject, signee_key, age, extensions, serial
@@ -597,7 +585,7 @@ module Gem::Security
   def self.trust_dir
     return @trust_dir if @trust_dir
 
-    dir = File.join Gem.user_home, '.gem', 'trust'
+    dir = File.join Gem.user_home, ".gem", "trust"
 
     @trust_dir ||= Gem::Security::TrustDir.new dir
   end
@@ -617,8 +605,8 @@ module Gem::Security
   def self.write(pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER)
     path = File.expand_path path
 
-    File.open path, 'wb', permissions do |io|
-      if passphrase and cipher
+    File.open path, "wb", permissions do |io|
+      if passphrase && cipher
         io.write pemmable.to_pem cipher, passphrase
       else
         io.write pemmable.to_pem
@@ -633,9 +621,9 @@ module Gem::Security
 end
 
 if Gem::HAVE_OPENSSL
-  require_relative 'security/policy'
-  require_relative 'security/policies'
-  require_relative 'security/trust_dir'
+  require_relative "security/policy"
+  require_relative "security/policies"
+  require_relative "security/trust_dir"
 end
 
-require_relative 'security/signer'
+require_relative "security/signer"

data/lib/rubygems/security_option.rb

@@ -1,11 +1,12 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require_relative '../rubygems'
+require_relative "../rubygems"
 
 # forward-declare
 
@@ -20,9 +21,9 @@ end
 module Gem::SecurityOption
   def add_security_option
     Gem::OptionParser.accept Gem::Security::Policy do |value|
-      require_relative 'security'
+      require_relative "security"
 
-      raise Gem::OptionParser::InvalidArgument, 'OpenSSL not installed' unless
+      raise Gem::OptionParser::InvalidArgument, "OpenSSL not installed" unless
         defined?(Gem::Security::HighSecurity)
 
       policy = Gem::Security::Policies[value]
@@ -33,9 +34,9 @@ module Gem::SecurityOption
       policy
     end
 
-    add_option(:"Install/Update", '-P', '--trust-policy POLICY',
+    add_option(:"Install/Update", "-P", "--trust-policy POLICY",
                Gem::Security::Policy,
-               'Specify gem trust policy') do |value, options|
+               "Specify gem trust policy") do |value, options|
       options[:security_policy] = value
     end
   end

data/lib/rubygems/shellwords.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+autoload :Shellwords, "shellwords"