rubygems-update 3.4.17 → 3.4.18

data/test/rubygems/test_gem_resolver_lock_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/installer"
 require "rubygems/resolver"

data/test/rubygems/test_gem_resolver_requirement_list.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemResolverRequirementList < Gem::TestCase

data/test/rubygems/test_gem_resolver_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemResolverSpecification < Gem::TestCase

data/test/rubygems/test_gem_resolver_vendor_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemResolverVendorSet < Gem::TestCase

data/test/rubygems/test_gem_resolver_vendor_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemResolverVendorSpecification < Gem::TestCase

data/test/rubygems/test_gem_security.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/security"
 

data/test/rubygems/test_gem_security_signer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 unless Gem::HAVE_OPENSSL

data/test/rubygems/test_gem_security_trust_dir.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 unless Gem::HAVE_OPENSSL

data/test/rubygems/test_gem_silent_ui.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/user_interaction"
 require "timeout"

data/test/rubygems/test_gem_source.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 require "rubygems/indexer"

data/test/rubygems/test_gem_source_fetch_problem.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemSourceFetchProblem < Gem::TestCase

data/test/rubygems/test_gem_source_git.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_source_installed.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_source_list.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "rubygems"
 require "rubygems/source_list"
 require_relative "helper"

data/test/rubygems/test_gem_source_local.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_source_lock.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemSourceLock < Gem::TestCase

data/test/rubygems/test_gem_source_specific_file.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_source_subpath_problem.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_source_vendor.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/source"
 

data/test/rubygems/test_gem_spec_fetcher.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/spec_fetcher"
 

data/test/rubygems/test_gem_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "benchmark"
 require_relative "helper"
 require "date"
@@ -1068,19 +1069,27 @@ dependencies: []
   end
 
   def test_handles_private_null_type
+    yaml_defined = Object.const_defined?("YAML")
+
     path = File.expand_path "data/pry-0.4.7.gemspec.rz", __dir__
 
     data = Marshal.load Gem::Util.inflate(Gem.read_binary(path))
 
     assert_instance_of Gem::Specification, data
+
+    assert_equal(yaml_defined, Object.const_defined?("YAML"))
   end
 
   def test_handles_dependencies_with_syck_requirements_bug
+    yaml_defined = Object.const_defined?("YAML")
+
     path = File.expand_path "data/excon-0.7.7.gemspec.rz", __dir__
 
     data = Marshal.load Gem::Util.inflate(Gem.read_binary(path))
 
     assert_instance_of Gem::Specification, data
+
+    assert_equal(yaml_defined, Object.const_defined?("YAML"))
   end
 
   def test_initialize

data/test/rubygems/test_gem_stream_ui.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/user_interaction"
 require "timeout"
 
 class TestGemStreamUI < Gem::TestCase
-  # increase timeout with MJIT for --jit-wait testing
-  mjit_enabled = defined?(RubyVM::MJIT) && RubyVM::MJIT.enabled?
-  SHORT_TIMEOUT = (RUBY_ENGINE == "ruby" && !mjit_enabled) ? 0.1 : 1.0
+  # increase timeout with RJIT for --jit-wait testing
+  rjit_enabled = defined?(RubyVM::RJIT) && RubyVM::RJIT.enabled?
+  SHORT_TIMEOUT = (RUBY_ENGINE == "ruby" && !rjit_enabled) ? 0.1 : 1.0
 
   module IsTty
     attr_accessor :tty
@@ -113,6 +114,36 @@ class TestGemStreamUI < Gem::TestCase
     assert_equal "which one?\n 1. foo\n 2. bar\n> ", @out.string
   end
 
+  def test_choose_from_list_0
+    @in.puts "0"
+    @in.rewind
+
+    result = @sui.choose_from_list "which one?", %w[foo bar]
+
+    assert_equal [nil, nil], result
+    assert_equal "which one?\n 1. foo\n 2. bar\n> ", @out.string
+  end
+
+  def test_choose_from_list_over
+    @in.puts "3"
+    @in.rewind
+
+    result = @sui.choose_from_list "which one?", %w[foo bar]
+
+    assert_equal [nil, nil], result
+    assert_equal "which one?\n 1. foo\n 2. bar\n> ", @out.string
+  end
+
+  def test_choose_from_list_negative
+    @in.puts "-1"
+    @in.rewind
+
+    result = @sui.choose_from_list "which one?", %w[foo bar]
+
+    assert_equal [nil, nil], result
+    assert_equal "which one?\n 1. foo\n 2. bar\n> ", @out.string
+  end
+
   def test_progress_reporter_silent_nil
     @cfg.verbose = nil
     reporter = @sui.progress_reporter 10, "hi"

data/test/rubygems/test_gem_stub_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/stub_specification"
 

data/test/rubygems/test_gem_text.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/text"
 

data/test/rubygems/test_gem_uninstaller.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "installer_test_case"
 require "rubygems/uninstaller"
 

data/test/rubygems/test_gem_unsatisfiable_dependency_error.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemUnsatisfiableDependencyError < Gem::TestCase

data/test/rubygems/test_gem_update_suggestion.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/command"
 require "rubygems/update_suggestion"

data/test/rubygems/test_gem_uri.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/uri"
 

data/test/rubygems/test_gem_uri_formatter.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/uri_formatter"
 

data/test/rubygems/test_gem_util.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/util"
 

data/test/rubygems/test_gem_version.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/version"
 

data/test/rubygems/test_gem_version_option.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/command"
 require "rubygems/version_option"

data/test/rubygems/test_kernel.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemKernel < Gem::TestCase

data/test/rubygems/test_remote_fetch_error.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
 class TestGemRemoteFetchError < Gem::TestCase

data/test/rubygems/test_require.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems"
 

data/test/rubygems/test_rubygems.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "helper"
 
 class GemTest < Gem::TestCase

data/test/rubygems/test_webauthn_listener.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "helper"
-require "rubygems/webauthn_listener"
+require "rubygems/gemcutter_utilities/webauthn_listener"
+require "rubygems/gemcutter_utilities"
 
 class WebauthnListenerTest < Gem::TestCase
   def setup
@@ -10,6 +11,28 @@ class WebauthnListenerTest < Gem::TestCase
     @port = @server.addr[1].to_s
   end
 
+  def teardown
+    @thread.kill.join if @thread
+    @server&.close
+    super
+  end
+
+  def test_listener_thread_retreives_otp_code
+    thread = Gem::GemcutterUtilities::WebauthnListener.listener_thread(Gem.host, @server)
+    Gem::MockBrowser.get URI("http://localhost:#{@port}?code=xyz")
+
+    thread.join
+    assert_equal "xyz", thread[:otp]
+  end
+
+  def test_listener_thread_sets_error
+    thread = Gem::GemcutterUtilities::WebauthnListener.listener_thread(Gem.host, @server)
+    Gem::MockBrowser.post URI("http://localhost:#{@port}?code=xyz")
+
+    thread.join
+    assert_equal "Security device verification failed: Invalid HTTP method POST received.", thread[:error].message
+  end
+
   def test_wait_for_otp_code_get_follows_options
     wait_for_otp_code
     assert Gem::MockBrowser.options(URI("http://localhost:#{@port}?code=xyz")).is_a? Net::HTTPNoContent
@@ -32,7 +55,7 @@ class WebauthnListenerTest < Gem::TestCase
     response = Gem::MockBrowser.get URI("http://localhost:#{@port}?code=xyz")
 
     assert response.is_a? Net::HTTPOK
-    assert_equal "text/plain", response["Content-Type"]
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
     assert_equal "7", response["Content-Length"]
     assert_equal Gem.host, response["access-control-allow-origin"]
     assert_equal "POST", response["access-control-allow-methods"]
@@ -73,7 +96,7 @@ class WebauthnListenerTest < Gem::TestCase
     response = Gem::MockBrowser.get URI("http://localhost:#{@port}")
 
     assert response.is_a? Net::HTTPBadRequest
-    assert_equal "text/plain", response["Content-Type"]
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
     assert_equal "22", response["Content-Length"]
     assert_equal "close", response["Connection"]
     assert_equal "missing code parameter", response.body
@@ -87,7 +110,7 @@ class WebauthnListenerTest < Gem::TestCase
     response = Gem::MockBrowser.get URI("http://localhost:#{@port}?param=xyz")
 
     assert response.is_a? Net::HTTPBadRequest
-    assert_equal "text/plain", response["Content-Type"]
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
     assert_equal "22", response["Content-Length"]
     assert_equal "close", response["Connection"]
     assert_equal "missing code parameter", response.body
@@ -100,7 +123,7 @@ class WebauthnListenerTest < Gem::TestCase
 
   def wait_for_otp_code
     @thread = Thread.new do
-      Thread.current[:otp] = Gem::WebauthnListener.wait_for_otp_code(Gem.host, @server)
+      Thread.current[:otp] = Gem::GemcutterUtilities::WebauthnListener.new(Gem.host).wait_for_otp_code(@server)
     end
     @thread.abort_on_exception = true
     @thread.report_on_exception = false
@@ -109,7 +132,7 @@ class WebauthnListenerTest < Gem::TestCase
   def wait_for_otp_code_expect_error_with_message(message)
     @thread = Thread.new do
       error = assert_raise Gem::WebauthnVerificationError do
-        Thread.current[:otp] = Gem::WebauthnListener.wait_for_otp_code(Gem.host, @server)
+        Thread.current[:otp] = Gem::GemcutterUtilities::WebauthnListener.new(Gem.host).wait_for_otp_code(@server)
       end
 
       assert_equal message, error.message

data/test/rubygems/test_webauthn_listener_response.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "helper"
-require "rubygems/webauthn_listener/response"
+require "rubygems/gemcutter_utilities/webauthn_listener/response"
 
 class WebauthnListenerResponseTest < Gem::TestCase
   def setup
@@ -10,7 +10,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
   end
 
   def test_ok_response_to_s
-    to_s = Gem::WebauthnListener::OkResponse.new(@host).to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::OkResponse.new(@host).to_s
 
     expected_to_s = <<~RESPONSE
       HTTP/1.1 200 OK\r
@@ -18,7 +18,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
       access-control-allow-origin: rubygems.example\r
       access-control-allow-methods: POST\r
       access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
-      content-type: text/plain\r
+      content-type: text/plain; charset=utf-8\r
       content-length: 7\r
       \r
       success
@@ -28,7 +28,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
   end
 
   def test_no_to_s_response_to_s
-    to_s = Gem::WebauthnListener::NoContentResponse.new(@host).to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::NoContentResponse.new(@host).to_s
 
     expected_to_s = <<~RESPONSE
       HTTP/1.1 204 No Content\r
@@ -43,7 +43,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
   end
 
   def test_method_not_allowed_response_to_s
-    to_s = Gem::WebauthnListener::MethodNotAllowedResponse.new(@host).to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::MethodNotAllowedResponse.new(@host).to_s
 
     expected_to_s = <<~RESPONSE
       HTTP/1.1 405 Method Not Allowed\r
@@ -59,7 +59,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
   end
 
   def test_method_not_found_response_to_s
-    to_s = Gem::WebauthnListener::NotFoundResponse.new(@host).to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::NotFoundResponse.new(@host).to_s
 
     expected_to_s = <<~RESPONSE
       HTTP/1.1 404 Not Found\r
@@ -74,7 +74,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
   end
 
   def test_bad_request_response_to_s
-    to_s = Gem::WebauthnListener::BadRequestResponse.new(@host).to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::BadRequestResponse.new(@host).to_s
 
     expected_to_s = <<~RESPONSE
       HTTP/1.1 400 Bad Request\r
@@ -82,7 +82,7 @@ class WebauthnListenerResponseTest < Gem::TestCase
       access-control-allow-origin: rubygems.example\r
       access-control-allow-methods: POST\r
       access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
-      content-type: text/plain\r
+      content-type: text/plain; charset=utf-8\r
       content-length: 22\r
       \r
       missing code parameter

data/test/rubygems/test_webauthn_poller.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require_relative "helper"
+require "rubygems/gemcutter_utilities/webauthn_poller"
+require "rubygems/gemcutter_utilities"
+
+class WebauthnPollerTest < Gem::TestCase
+  def setup
+    super
+
+    @host = Gem.host
+    @webauthn_url = "#{@host}/api/v1/webauthn_verification/odow34b93t6aPCdY"
+    @fetcher = Gem::FakeFetcher.new
+    Gem::RemoteFetcher.fetcher = @fetcher
+    @credentials = {
+      email: "email@example.com",
+      password: "password",
+    }
+  end
+
+  def test_poll_thread_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"success\",\"code\":\"Uvh6T57tkWuUnWYo\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+    thread.join
+
+    assert_equal thread[:otp], "Uvh6T57tkWuUnWYo"
+  end
+
+  def test_poll_thread_webauthn_verification_error
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "HTTP Basic: Access denied.",
+      code: 401,
+      msg: "Unauthorized"
+    )
+
+    thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+    thread.join
+
+    assert_equal thread[:error].message, "Security device verification failed: Unauthorized"
+  end
+
+  def test_poll_thread_timeout_error
+    raise_error = ->(*_args) { raise Timeout::Error, "execution expired" }
+    Timeout.stub(:timeout, raise_error) do
+      thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+      thread.join
+      assert_equal thread[:error].message, "execution expired"
+    end
+  end
+
+  def test_poll_for_otp_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"success\",\"code\":\"Uvh6T57tkWuUnWYo\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    otp = Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+
+    assert_equal otp, "Uvh6T57tkWuUnWYo"
+  end
+
+  def test_poll_for_otp_pending_sleeps
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"pending\",\"message\":\"Security device authentication is still pending.\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    assert_raise Timeout::Error do
+      Timeout.timeout(0.1) do
+        Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+      end
+    end
+  end
+
+  def test_poll_for_otp_not_http_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "HTTP Basic: Access denied.",
+      code: 401,
+      msg: "Unauthorized"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message, "Security device verification failed: Unauthorized"
+  end
+
+  def test_poll_for_otp_invalid_format
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{}",
+      code: 200,
+      msg: "OK"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message, "Security device verification failed: Invalid response from server"
+  end
+
+  def test_poll_for_otp_invalid_status
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"expired\",\"message\":\"The token in the link you used has either expired or been used already.\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message,
+      "Security device verification failed: The token in the link you used has either expired or been used already."
+  end
+end

data/test/rubygems/utilities.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "tempfile"
 require "rubygems"
 require "rubygems/remote_fetcher"

data/test/test_changelog_generator.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../util/changelog"
+require_relative "../tool/changelog"
 require "rubygems/commands/setup_command"
 require_relative "rubygems/helper"