rubygems-update 3.4.17 → 3.4.18

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 3.4.17
+  version: 3.4.18
 platform: ruby
 authors:
 - Jim Weirich
@@ -14,9 +14,9 @@ authors:
 - Evan Phoenix
 - Hiroshi SHIBATA
 autorequire:
-bindir: bin
+bindir: exe
 cert_chain: []
-date: 2023-07-14 00:00:00.000000000 Z
+date: 2023-08-02 00:00:00.000000000 Z
 dependencies: []
 description: |-
   A package (also known as a library) contains a set of functionality
@@ -64,8 +64,6 @@ files:
 - POLICIES.md
 - README.md
 - UPGRADING.md
-- bin/gem
-- bin/update_rubygems
 - bundler/CHANGELOG.md
 - bundler/LICENSE.md
 - bundler/README.md
@@ -391,6 +389,8 @@ files:
 - bundler/lib/bundler/vlad.rb
 - bundler/lib/bundler/worker.rb
 - bundler/lib/bundler/yaml_serializer.rb
+- exe/gem
+- exe/update_rubygems
 - hide_lib_for_update/note.txt
 - lib/rubygems.rb
 - lib/rubygems/available_set.rb
@@ -459,6 +459,9 @@ files:
 - lib/rubygems/ext/rake_builder.rb
 - lib/rubygems/gem_runner.rb
 - lib/rubygems/gemcutter_utilities.rb
+- lib/rubygems/gemcutter_utilities/webauthn_listener.rb
+- lib/rubygems/gemcutter_utilities/webauthn_listener/response.rb
+- lib/rubygems/gemcutter_utilities/webauthn_poller.rb
 - lib/rubygems/indexer.rb
 - lib/rubygems/install_default_message.rb
 - lib/rubygems/install_message.rb
@@ -598,8 +601,6 @@ files:
 - lib/rubygems/validator.rb
 - lib/rubygems/version.rb
 - lib/rubygems/version_option.rb
-- lib/rubygems/webauthn_listener.rb
-- lib/rubygems/webauthn_listener/response.rb
 - rubygems-update.gemspec
 - setup.rb
 - test/rubygems/alternate_cert.pem
@@ -639,6 +640,7 @@ files:
 - test/rubygems/invalidchild_cert.pem
 - test/rubygems/invalidchild_cert_32.pem
 - test/rubygems/invalidchild_key.pem
+- test/rubygems/multifactor_auth_utilities.rb
 - test/rubygems/package/tar_test_case.rb
 - test/rubygems/packages/Bluebie-legs-0.6.2.gem
 - test/rubygems/packages/ascii_binder-0.1.10.1.gem
@@ -815,6 +817,7 @@ files:
 - test/rubygems/test_rubygems.rb
 - test/rubygems/test_webauthn_listener.rb
 - test/rubygems/test_webauthn_listener_response.rb
+- test/rubygems/test_webauthn_poller.rb
 - test/rubygems/utilities.rb
 - test/rubygems/wrong_key_cert.pem
 - test/rubygems/wrong_key_cert_32.pem
@@ -843,7 +846,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.17
+rubygems_version: 3.4.18
 signing_key:
 specification_version: 4
 summary: RubyGems is a package management framework for Ruby. This gem is downloaded

data/lib/rubygems/webauthn_listener/response.rb

@@ -1,161 +0,0 @@
-# frozen_string_literal: true
-
-##
-# The WebauthnListener Response class is used by the WebauthnListener to create
-# responses to be sent to the Gem host. It creates a Net::HTTPResponse instance
-# when initialized and can be converted to the appropriate format to be sent by a socket using `to_s`.
-# Net::HTTPResponse instances cannot be directly sent over a socket.
-#
-# Types of response classes:
-#   - OkResponse
-#   - NoContentResponse
-#   - BadRequestResponse
-#   - NotFoundResponse
-#   - MethodNotAllowedResponse
-#
-# Example usage:
-#
-#   server = TCPServer.new(0)
-#   socket = server.accept
-#
-#   response = OkResponse.for("https://rubygems.example")
-#   socket.print response.to_s
-#   socket.close
-#
-
-class Gem::WebauthnListener
-  class Response
-    attr_reader :http_response
-
-    def self.for(host)
-      new(host)
-    end
-
-    def initialize(host)
-      @host = host
-
-      build_http_response
-    end
-
-    def to_s
-      status_line = "HTTP/#{@http_response.http_version} #{@http_response.code} #{@http_response.message}\r\n"
-      headers = @http_response.to_hash.map {|header, value| "#{header}: #{value.join(", ")}\r\n" }.join + "\r\n"
-      body = @http_response.body ? "#{@http_response.body}\n" : ""
-
-      status_line + headers + body
-    end
-
-    private
-
-    # Must be implemented in subclasses
-    def code
-      raise NotImplementedError
-    end
-
-    def reason_phrase
-      raise NotImplementedError
-    end
-
-    def body; end
-
-    def build_http_response
-      response_class = Net::HTTPResponse::CODE_TO_OBJ[code.to_s]
-      @http_response = response_class.new("1.1", code, reason_phrase)
-      @http_response.instance_variable_set(:@read, true)
-
-      add_connection_header
-      add_access_control_headers
-      add_body
-    end
-
-    def add_connection_header
-      @http_response["connection"] = "close"
-    end
-
-    def add_access_control_headers
-      @http_response["access-control-allow-origin"] = @host
-      @http_response["access-control-allow-methods"] = "POST"
-      @http_response["access-control-allow-headers"] = %w[Content-Type Authorization x-csrf-token]
-    end
-
-    def add_body
-      return unless body
-      @http_response["content-type"] = "text/plain"
-      @http_response["content-length"] = body.bytesize
-      @http_response.instance_variable_set(:@body, body)
-    end
-  end
-
-  class OkResponse < Response
-    private
-
-    def code
-      200
-    end
-
-    def reason_phrase
-      "OK"
-    end
-
-    def body
-      "success"
-    end
-  end
-
-  class NoContentResponse < Response
-    private
-
-    def code
-      204
-    end
-
-    def reason_phrase
-      "No Content"
-    end
-  end
-
-  class BadRequestResponse < Response
-    private
-
-    def code
-      400
-    end
-
-    def reason_phrase
-      "Bad Request"
-    end
-
-    def body
-      "missing code parameter"
-    end
-  end
-
-  class NotFoundResponse < Response
-    private
-
-    def code
-      404
-    end
-
-    def reason_phrase
-      "Not Found"
-    end
-  end
-
-  class MethodNotAllowedResponse < Response
-    private
-
-    def code
-      405
-    end
-
-    def reason_phrase
-      "Method Not Allowed"
-    end
-
-    def add_access_control_headers
-      super
-      @http_response["allow"] = %w[GET OPTIONS]
-    end
-  end
-end

data/lib/rubygems/webauthn_listener.rb

@@ -1,92 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "webauthn_listener/response"
-
-##
-# The WebauthnListener class retrieves an OTP after a user successfully WebAuthns with the Gem host.
-# An instance opens a socket using the TCPServer instance given and listens for a request from the Gem host.
-# The request should be a GET request to the root path and contains the OTP code in the form
-# of a query parameter `code`. The listener will return the code which will be used as the OTP for
-# API requests.
-#
-# Types of responses sent by the listener after receiving a request:
-#   - 200 OK: OTP code was successfully retrieved
-#   - 204 No Content: If the request was an OPTIONS request
-#   - 400 Bad Request: If the request did not contain a query parameter `code`
-#   - 404 Not Found: The request was not to the root path
-#   - 405 Method Not Allowed: OTP code was not retrieved because the request was not a GET/OPTIONS request
-#
-# Example usage:
-#
-#   server = TCPServer.new(0)
-#   otp = Gem::WebauthnListener.wait_for_otp_code("https://rubygems.example", server)
-#
-
-class Gem::WebauthnListener
-  attr_reader :host
-
-  def initialize(host)
-    @host = host
-  end
-
-  def self.wait_for_otp_code(host, server)
-    new(host).fetch_otp_from_connection(server)
-  end
-
-  def fetch_otp_from_connection(server)
-    loop do
-      socket = server.accept
-      request_line = socket.gets
-
-      method, req_uri, _protocol = request_line.split(" ")
-      req_uri = URI.parse(req_uri)
-
-      responder = SocketResponder.new(socket)
-
-      unless root_path?(req_uri)
-        responder.send(NotFoundResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Page at #{req_uri.path} not found."
-      end
-
-      case method.upcase
-      when "OPTIONS"
-        responder.send(NoContentResponse.for(host))
-        next # will be GET
-      when "GET"
-        if otp = parse_otp_from_uri(req_uri)
-          responder.send(OkResponse.for(host))
-          return otp
-        end
-        responder.send(BadRequestResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Did not receive OTP from #{host}."
-      else
-        responder.send(MethodNotAllowedResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
-      end
-    end
-  end
-
-  private
-
-  def root_path?(uri)
-    uri.path == "/"
-  end
-
-  def parse_otp_from_uri(uri)
-    require "cgi"
-
-    return if uri.query.nil?
-    CGI.parse(uri.query).dig("code", 0)
-  end
-
-  class SocketResponder
-    def initialize(socket)
-      @socket = socket
-    end
-
-    def send(response)
-      @socket.print response.to_s
-      @socket.close
-    end
-  end
-end