rubygems-update 3.3.18 → 3.6.2

data/lib/rubygems/security.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require_relative 'exceptions'
-require_relative 'openssl'
+require_relative "exceptions"
+require_relative "openssl"
 
 ##
 # = Signing gems
@@ -322,10 +323,9 @@ require_relative 'openssl'
 # == Original author
 #
 # Paul Duncan <pabs@pablotron.org>
-# http://pablotron.org/
+# https://pablotron.org/
 
 module Gem::Security
-
   ##
   # Gem::Security default exception type
 
@@ -334,7 +334,7 @@ module Gem::Security
   ##
   # Used internally to select the signing digest from all computed digests
 
-  DIGEST_NAME = 'SHA256' # :nodoc:
+  DIGEST_NAME = "SHA256" # :nodoc:
 
   ##
   # Length of keys created by RSA and DSA keys
@@ -344,23 +344,23 @@ module Gem::Security
   ##
   # Default algorithm to use when building a key pair
 
-  DEFAULT_KEY_ALGORITHM = 'RSA'
+  DEFAULT_KEY_ALGORITHM = "RSA"
 
   ##
   # Named curve used for Elliptic Curve
 
-  EC_NAME = 'secp384r1'
+  EC_NAME = "secp384r1"
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
   # Must be in the list returned by OpenSSL::Cipher.ciphers
 
-  KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
+  KEY_CIPHER = OpenSSL::Cipher.new("AES-256-CBC") if defined?(OpenSSL::Cipher)
 
   ##
   # One day in seconds
 
-  ONE_DAY = 86400
+  ONE_DAY = 86_400
 
   ##
   # One year in seconds
@@ -376,10 +376,10 @@ module Gem::Security
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
-    'basicConstraints'     => 'CA:FALSE',
-    'keyUsage'             =>
-      'keyEncipherment,dataEncipherment,digitalSignature',
-    'subjectKeyIdentifier' => 'hash',
+    "basicConstraints" => "CA:FALSE",
+    "keyUsage" =>
+      "keyEncipherment,dataEncipherment,digitalSignature",
+    "subjectKeyIdentifier" => "hash",
   }.freeze
 
   def self.alt_name_or_x509_entry(certificate, x509_entry)
@@ -398,8 +398,7 @@ module Gem::Security
   #
   # The +extensions+ restrict the key to the indicated uses.
 
-  def self.create_cert(subject, key, age = ONE_YEAR, extensions = EXTENSIONS,
-                       serial = 1)
+  def self.create_cert(subject, key, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     cert = OpenSSL::X509::Certificate.new
 
     cert.public_key = get_public_key(key)
@@ -433,13 +432,6 @@ module Gem::Security
     ec_key
   end
 
-  ##
-  # In Ruby 2.3 EC doesn't implement the private_key? but not the private? method
-
-  if defined?(OpenSSL::PKey::EC) && Gem::Version.new(String.new(RUBY_VERSION)) < Gem::Version.new("2.4.0")
-    OpenSSL::PKey::EC.send(:alias_method, :private?, :private_key?)
-  end
-
   ##
   # Creates a self-signed certificate with an issuer and subject from +email+,
   # a subject alternative name of +email+ and the given +extensions+ for the
@@ -457,8 +449,7 @@ module Gem::Security
   # Creates a self-signed certificate with an issuer and subject of +subject+
   # and the given +extensions+ for the +key+.
 
-  def self.create_cert_self_signed(subject, key, age = ONE_YEAR,
-                                   extensions = EXTENSIONS, serial = 1)
+  def self.create_cert_self_signed(subject, key, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     certificate = create_cert subject, key, age, extensions
 
     sign certificate, key, certificate, age, extensions, serial
@@ -468,16 +459,8 @@ module Gem::Security
   # Creates a new digest instance using the specified +algorithm+. The default
   # is SHA256.
 
-  if defined?(OpenSSL::Digest)
-    def self.create_digest(algorithm = DIGEST_NAME)
-      OpenSSL::Digest.new(algorithm)
-    end
-  else
-    require 'digest'
-
-    def self.create_digest(algorithm = DIGEST_NAME)
-      Digest.const_get(algorithm).new
-    end
+  def self.create_digest(algorithm = DIGEST_NAME)
+    OpenSSL::Digest.new(algorithm)
   end
 
   ##
@@ -487,18 +470,12 @@ module Gem::Security
   def self.create_key(algorithm)
     if defined?(OpenSSL::PKey)
       case algorithm.downcase
-      when 'dsa'
+      when "dsa"
         OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
-      when 'rsa'
+      when "rsa"
         OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
-      when 'ec'
-        if RUBY_VERSION >= "2.4.0"
-          OpenSSL::PKey::EC.generate(EC_NAME)
-        else
-          domain_key = OpenSSL::PKey::EC.new(EC_NAME)
-          domain_key.generate_key
-          domain_key
-        end
+      when "ec"
+        OpenSSL::PKey::EC.generate(EC_NAME)
       else
         raise Gem::Security::Exception,
         "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
@@ -510,11 +487,11 @@ module Gem::Security
   # Turns +email_address+ into an OpenSSL::X509::Name
 
   def self.email_to_name(email_address)
-    email_address = email_address.gsub(/[^\w@.-]+/i, '_')
+    email_address = email_address.gsub(/[^\w@.-]+/i, "_")
 
-    cn, dcs = email_address.split '@'
+    cn, dcs = email_address.split "@"
 
-    dcs = dcs.split '.'
+    dcs = dcs.split "."
 
     OpenSSL::X509::Name.new([
       ["CN", cn],
@@ -528,11 +505,10 @@ module Gem::Security
   #--
   # TODO increment serial
 
-  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR,
-                   extensions = EXTENSIONS)
+  def self.re_sign(expired_certificate, private_key, age = ONE_YEAR, extensions = EXTENSIONS)
     raise Gem::Security::Exception,
           "incorrect signing key for re-signing " +
-          "#{expired_certificate.subject}" unless
+          expired_certificate.subject.to_s unless
       expired_certificate.check_private_key(private_key)
 
     unless expired_certificate.subject.to_s ==
@@ -541,7 +517,7 @@ module Gem::Security
       issuer  = alt_name_or_x509_entry expired_certificate, :issuer
 
       raise Gem::Security::Exception,
-            "#{subject} is not self-signed, contact #{issuer} " +
+            "#{subject} is not self-signed, contact #{issuer} " \
             "to obtain a valid certificate"
     end
 
@@ -565,23 +541,22 @@ module Gem::Security
   #
   # Returns the newly signed certificate.
 
-  def self.sign(certificate, signing_key, signing_cert,
-                age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
+  def self.sign(certificate, signing_key, signing_cert, age = ONE_YEAR, extensions = EXTENSIONS, serial = 1)
     signee_subject = certificate.subject
     signee_key     = certificate.public_key
 
     alt_name = certificate.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'subjectAltName' => alt_name.value if
+    extensions = extensions.merge "subjectAltName" => alt_name.value if
       alt_name
 
     issuer_alt_name = signing_cert.extensions.find do |extension|
-      extension.oid == 'subjectAltName'
+      extension.oid == "subjectAltName"
     end
 
-    extensions = extensions.merge 'issuerAltName' => issuer_alt_name.value if
+    extensions = extensions.merge "issuerAltName" => issuer_alt_name.value if
       issuer_alt_name
 
     signed = create_cert signee_subject, signee_key, age, extensions, serial
@@ -597,7 +572,7 @@ module Gem::Security
   def self.trust_dir
     return @trust_dir if @trust_dir
 
-    dir = File.join Gem.user_home, '.gem', 'trust'
+    dir = File.join Gem.user_home, ".gem", "trust"
 
     @trust_dir ||= Gem::Security::TrustDir.new dir
   end
@@ -614,11 +589,11 @@ module Gem::Security
   # +permissions+. If passed +cipher+ and +passphrase+ those arguments will be
   # passed to +to_pem+.
 
-  def self.write(pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER)
+  def self.write(pemmable, path, permissions = 0o600, passphrase = nil, cipher = KEY_CIPHER)
     path = File.expand_path path
 
-    File.open path, 'wb', permissions do |io|
-      if passphrase and cipher
+    File.open path, "wb", permissions do |io|
+      if passphrase && cipher
         io.write pemmable.to_pem cipher, passphrase
       else
         io.write pemmable.to_pem
@@ -629,13 +604,12 @@ module Gem::Security
   end
 
   reset
-
 end
 
 if Gem::HAVE_OPENSSL
-  require_relative 'security/policy'
-  require_relative 'security/policies'
-  require_relative 'security/trust_dir'
+  require_relative "security/policy"
+  require_relative "security/policies"
+  require_relative "security/trust_dir"
 end
 
-require_relative 'security/signer'
+require_relative "security/signer"

data/lib/rubygems/security_option.rb

@@ -1,11 +1,12 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require_relative '../rubygems'
+require_relative "../rubygems"
 
 # forward-declare
 
@@ -20,22 +21,22 @@ end
 module Gem::SecurityOption
   def add_security_option
     Gem::OptionParser.accept Gem::Security::Policy do |value|
-      require_relative 'security'
+      require_relative "security"
 
-      raise Gem::OptionParser::InvalidArgument, 'OpenSSL not installed' unless
+      raise Gem::OptionParser::InvalidArgument, "OpenSSL not installed" unless
         defined?(Gem::Security::HighSecurity)
 
       policy = Gem::Security::Policies[value]
       unless policy
         valid = Gem::Security::Policies.keys.sort
-        raise Gem::OptionParser::InvalidArgument, "#{value} (#{valid.join ', '} are valid)"
+        raise Gem::OptionParser::InvalidArgument, "#{value} (#{valid.join ", "} are valid)"
       end
       policy
     end
 
-    add_option(:"Install/Update", '-P', '--trust-policy POLICY',
+    add_option(:"Install/Update", "-P", "--trust-policy POLICY",
                Gem::Security::Policy,
-               'Specify gem trust policy') do |value, options|
+               "Specify gem trust policy") do |value, options|
       options[:security_policy] = value
     end
   end

data/lib/rubygems/shellwords.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+autoload :Shellwords, "shellwords"

data/lib/rubygems/source/git.rb

@@ -53,12 +53,11 @@ class Gem::Source::Git < Gem::Source
     @uri = Gem::Uri.parse(repository)
     @name            = name
     @repository      = repository
-    @reference       = reference
+    @reference       = reference || "HEAD"
     @need_submodules = submodules
 
     @remote   = true
     @root_dir = Gem.dir
-    @git      = ENV['git'] || 'git'
   end
 
   def <=>(other)
@@ -70,19 +69,21 @@ class Gem::Source::Git < Gem::Source
       -1
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
   def ==(other) # :nodoc:
-    super and
-      @name            == other.name and
-      @repository      == other.repository and
-      @reference       == other.reference and
+    super &&
+      @name            == other.name &&
+      @repository      == other.repository &&
+      @reference       == other.reference &&
       @need_submodules == other.need_submodules
   end
 
+  def git_command
+    ENV.fetch("git", "git")
+  end
+
   ##
   # Checks out the files for the repository into the install_dir.
 
@@ -92,18 +93,18 @@ class Gem::Source::Git < Gem::Source
     return false unless File.exist? repo_cache_dir
 
     unless File.exist? install_dir
-      system @git, 'clone', '--quiet', '--no-checkout',
+      system git_command, "clone", "--quiet", "--no-checkout",
              repo_cache_dir, install_dir
     end
 
     Dir.chdir install_dir do
-      system @git, 'fetch', '--quiet', '--force', '--tags', install_dir
+      system git_command, "fetch", "--quiet", "--force", "--tags", install_dir
 
-      success = system @git, 'reset', '--quiet', '--hard', rev_parse
+      success = system git_command, "reset", "--quiet", "--hard", rev_parse
 
       if @need_submodules
         require "open3"
-        _, status = Open3.capture2e(@git, 'submodule', 'update', '--quiet', '--init', '--recursive')
+        _, status = Open3.capture2e(git_command, "submodule", "update", "--quiet", "--init", "--recursive")
 
         success &&= status.success?
       end
@@ -120,11 +121,11 @@ class Gem::Source::Git < Gem::Source
 
     if File.exist? repo_cache_dir
       Dir.chdir repo_cache_dir do
-        system @git, 'fetch', '--quiet', '--force', '--tags',
-               @repository, 'refs/heads/*:refs/heads/*'
+        system git_command, "fetch", "--quiet", "--force", "--tags",
+               @repository, "refs/heads/*:refs/heads/*"
       end
     else
-      system @git, 'clone', '--quiet', '--bare', '--no-hardlinks',
+      system git_command, "clone", "--quiet", "--bare", "--no-hardlinks",
              @repository, repo_cache_dir
     end
   end
@@ -133,7 +134,7 @@ class Gem::Source::Git < Gem::Source
   # Directory where git gems get unpacked and so-forth.
 
   def base_dir # :nodoc:
-    File.join @root_dir, 'bundler'
+    File.join @root_dir, "bundler"
   end
 
   ##
@@ -155,16 +156,18 @@ class Gem::Source::Git < Gem::Source
   def install_dir # :nodoc:
     return unless File.exist? repo_cache_dir
 
-    File.join base_dir, 'gems', "#{@name}-#{dir_shortref}"
+    File.join base_dir, "gems", "#{@name}-#{dir_shortref}"
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[Git: ', ']' do
-      q.breakable
-      q.text @repository
+    q.object_group(self) do
+      q.group 2, "[Git: ", "]" do
+        q.breakable
+        q.text @repository
 
-      q.breakable
-      q.text @reference
+        q.breakable
+        q.text @reference
+      end
     end
   end
 
@@ -172,7 +175,7 @@ class Gem::Source::Git < Gem::Source
   # The directory where the git gem's repository will be cached.
 
   def repo_cache_dir # :nodoc:
-    File.join @root_dir, 'cache', 'bundler', 'git', "#{@name}-#{uri_hash}"
+    File.join @root_dir, "cache", "bundler", "git", "#{@name}-#{uri_hash}"
   end
 
   ##
@@ -182,7 +185,7 @@ class Gem::Source::Git < Gem::Source
     hash = nil
 
     Dir.chdir repo_cache_dir do
-      hash = Gem::Util.popen(@git, 'rev-parse', @reference).strip
+      hash = Gem::Util.popen(git_command, "rev-parse", @reference).strip
     end
 
     raise Gem::Exception,
@@ -201,7 +204,7 @@ class Gem::Source::Git < Gem::Source
     return [] unless install_dir
 
     Dir.chdir install_dir do
-      Dir['{,*,*/*}.gemspec'].map do |spec_file|
+      Dir["{,*,*/*}.gemspec"].filter_map do |spec_file|
         directory = File.dirname spec_file
         file      = File.basename spec_file
 
@@ -211,26 +214,26 @@ class Gem::Source::Git < Gem::Source
             spec.base_dir = base_dir
 
             spec.extension_dir =
-              File.join base_dir, 'extensions', Gem::Platform.local.to_s,
+              File.join base_dir, "extensions", Gem::Platform.local.to_s,
                 Gem.extension_api_version, "#{name}-#{dir_shortref}"
 
             spec.full_gem_path = File.dirname spec.loaded_from if spec
           end
           spec
         end
-      end.compact
+      end
     end
   end
 
   ##
-  # A hash for the git gem based on the git repository URI.
+  # A hash for the git gem based on the git repository Gem::URI.
 
   def uri_hash # :nodoc:
-    require_relative '../openssl'
+    require_relative "../openssl"
 
     normalized =
-      if @repository =~ %r{^\w+://(\w+@)?}
-        uri = URI(@repository).normalize.to_s.sub %r{/$},''
+      if @repository.match?(%r{^\w+://(\w+@)?})
+        uri = Gem::URI(@repository).normalize.to_s.sub %r{/$},""
         uri.sub(/\A(\w+)/) { $1.downcase }
       else
         @repository

data/lib/rubygems/source/installed.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Represents an installed gem.  This is used for dependency resolution.
 
@@ -20,8 +21,6 @@ class Gem::Source::Installed < Gem::Source
       0
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
@@ -33,6 +32,8 @@ class Gem::Source::Installed < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.text '[Installed]'
+    q.object_group(self) do
+      q.text "[Installed]"
+    end
   end
 end

data/lib/rubygems/source/local.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The local source finds gems in the current directory for fulfilling
 # dependencies.
@@ -23,14 +24,12 @@ class Gem::Source::Local < Gem::Source
       0
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
   def inspect # :nodoc:
-    keys = @specs ? @specs.keys.sort : 'NOT LOADED'
-    "#<%s specs: %p>" % [self.class, keys]
+    keys = @specs ? @specs.keys.sort : "NOT LOADED"
+    format("#<%s specs: %p>", self.class, keys)
   end
 
   def load_specs(type) # :nodoc:
@@ -40,36 +39,35 @@ class Gem::Source::Local < Gem::Source
       @specs = {}
 
       Dir["*.gem"].each do |file|
-        begin
-          pkg = Gem::Package.new(file)
-        rescue SystemCallError, Gem::Package::FormatError
-          # ignore
-        else
-          tup = pkg.spec.name_tuple
-          @specs[tup] = [File.expand_path(file), pkg]
-
-          case type
-          when :released
-            unless pkg.spec.version.prerelease?
-              names << pkg.spec.name_tuple
-            end
-          when :prerelease
-            if pkg.spec.version.prerelease?
-              names << pkg.spec.name_tuple
-            end
-          when :latest
-            tup = pkg.spec.name_tuple
-
-            cur = names.find {|x| x.name == tup.name }
-            if !cur
-              names << tup
-            elsif cur.version < tup.version
-              names.delete cur
-              names << tup
-            end
-          else
+        pkg = Gem::Package.new(file)
+        spec = pkg.spec
+      rescue SystemCallError, Gem::Package::FormatError
+        # ignore
+      else
+        tup = spec.name_tuple
+        @specs[tup] = [File.expand_path(file), pkg]
+
+        case type
+        when :released
+          unless pkg.spec.version.prerelease?
             names << pkg.spec.name_tuple
           end
+        when :prerelease
+          if pkg.spec.version.prerelease?
+            names << pkg.spec.name_tuple
+          end
+        when :latest
+          tup = pkg.spec.name_tuple
+
+          cur = names.find {|x| x.name == tup.name }
+          if !cur
+            names << tup
+          elsif cur.version < tup.version
+            names.delete cur
+            names << tup
+          end
+        else
+          names << pkg.spec.name_tuple
         end
       end
 
@@ -77,27 +75,25 @@ class Gem::Source::Local < Gem::Source
     end
   end
 
-  def find_gem(gem_name, version = Gem::Requirement.default, # :nodoc:
-               prerelease = false)
+  def find_gem(gem_name, version = Gem::Requirement.default, prerelease = false) # :nodoc:
     load_specs :complete
 
     found = []
 
     @specs.each do |n, data|
-      if n.name == gem_name
-        s = data[1].spec
-
-        if version.satisfied_by?(s.version)
-          if prerelease
-            found << s
-          elsif !s.version.prerelease? || version.prerelease?
-            found << s
-          end
+      next unless n.name == gem_name
+      s = data[1].spec
+
+      if version.satisfied_by?(s.version)
+        if prerelease
+          found << s
+        elsif !s.version.prerelease? || version.prerelease?
+          found << s
         end
       end
     end
 
-    found.max_by {|s| s.version }
+    found.max_by(&:version)
   end
 
   def fetch_spec(name) # :nodoc:
@@ -113,7 +109,7 @@ class Gem::Source::Local < Gem::Source
   def download(spec, cache_dir = nil) # :nodoc:
     load_specs :complete
 
-    @specs.each do |name, data|
+    @specs.each do |_name, data|
       return data[0] if data[1].spec == spec
     end
 
@@ -121,10 +117,14 @@ class Gem::Source::Local < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[Local gems:', ']' do
-      q.breakable
-      q.seplist @specs.keys do |v|
-        q.text v.full_name
+    q.object_group(self) do
+      q.group 2, "[Local gems:", "]" do
+        q.breakable
+        if @specs
+          q.seplist @specs.keys do |v|
+            q.text v.full_name
+          end
+        end
       end
     end
   end

data/lib/rubygems/source/lock.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A Lock source wraps an installed gem's source and sorts before other sources
 # during dependency resolution.  This allows RubyGems to prefer gems from
@@ -24,13 +25,11 @@ class Gem::Source::Lock < Gem::Source
       @wrapped <=> other.wrapped
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
   def ==(other) # :nodoc:
-    0 == (self <=> other)
+    (self <=> other) == 0
   end
 
   def hash # :nodoc: