rubygems-update 3.4.17 → 3.4.19

data/lib/rubygems/gemcutter_utilities.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
+
 require_relative "remote_fetcher"
 require_relative "text"
-require_relative "webauthn_listener"
+require_relative "gemcutter_utilities/webauthn_listener"
+require_relative "gemcutter_utilities/webauthn_poller"
 
 ##
 # Utility methods for using the RubyGems API.
@@ -71,8 +73,7 @@ module Gem::GemcutterUtilities
     @host ||=
       begin
         env_rubygems_host = ENV["RUBYGEMS_HOST"]
-        env_rubygems_host = nil if
-          env_rubygems_host && env_rubygems_host.empty?
+        env_rubygems_host = nil if env_rubygems_host&.empty?
 
         env_rubygems_host || configured_host
       end
@@ -254,36 +255,39 @@ module Gem::GemcutterUtilities
 
   def fetch_otp(credentials)
     options[:otp] = if webauthn_url = webauthn_verification_url(credentials)
-      wait_for_otp(webauthn_url)
+      server = TCPServer.new 0
+      port = server.addr[1].to_s
+
+      url_with_port = "#{webauthn_url}?port=#{port}"
+      say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
+
+      threads = [WebauthnListener.listener_thread(host, server), WebauthnPoller.poll_thread(options, host, webauthn_url, credentials)]
+      otp_thread = wait_for_otp_thread(*threads)
+
+      threads.each(&:join)
+
+      if error = otp_thread[:error]
+        alert_error error.message
+        terminate_interaction(1)
+      end
+
+      say "You are verified with a security device. You may close the browser window."
+      otp_thread[:otp]
     else
       say "You have enabled multi-factor authentication. Please enter OTP code."
       ask "Code: "
     end
   end
 
-  def wait_for_otp(webauthn_url)
-    server = TCPServer.new 0
-    port = server.addr[1].to_s
-
-    thread = Thread.new do
-      Thread.current[:otp] = Gem::WebauthnListener.wait_for_otp_code(host, server)
-    rescue Gem::WebauthnVerificationError => e
-      Thread.current[:error] = e
-    end
-    thread.abort_on_exception = true
-    thread.report_on_exception = false
-
-    url_with_port = "#{webauthn_url}?port=#{port}"
-    say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
-
-    thread.join
-    if error = thread[:error]
-      alert_error error.message
-      terminate_interaction(1)
+  def wait_for_otp_thread(*threads)
+    loop do
+      threads.each do |otp_thread|
+        return otp_thread unless otp_thread.alive?
+      end
+      sleep 0.1
     end
-
-    say "You are verified with a security device. You may close the browser window."
-    thread[:otp]
+  ensure
+    threads.each(&:exit)
   end
 
   def webauthn_verification_url(credentials)

data/lib/rubygems/indexer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "package"
 require "tmpdir"

data/lib/rubygems/install_default_message.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "user_interaction"
 

data/lib/rubygems/install_message.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "user_interaction"
 

data/lib/rubygems/install_update_options.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/installer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/local_remote_options.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/mock_gem_ui.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "user_interaction"
 
 ##

data/lib/rubygems/name_tuple.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 #
 # Represents a gem of name +name+ at +version+ of +platform+. These

data/lib/rubygems/package/digest_io.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # IO wrapper that creates digests of contents written to the IO it wraps.
 

data/lib/rubygems/package/file_source.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The primary source of gems is a file on disk, including all usages
 # internal to rubygems.

data/lib/rubygems/package/io_source.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Supports reading and writing gems from/to a generic IO object.  This is
 # useful for other applications built on top of rubygems, such as

data/lib/rubygems/package/old.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/package/source.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
+
 class Gem::Package::Source # :nodoc:
 end

data/lib/rubygems/package/tar_header.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.

data/lib/rubygems/package/tar_reader/entry.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #++
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.

data/lib/rubygems/package/tar_reader.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.

data/lib/rubygems/package/tar_writer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.

data/lib/rubygems/package.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
@@ -616,8 +617,7 @@ EOM
 
     verify_checksums @digests, @checksums
 
-    @security_policy.verify_signatures @spec, @digests, @signatures if
-      @security_policy
+    @security_policy&.verify_signatures @spec, @digests, @signatures
 
     true
   rescue Gem::Security::Exception

data/lib/rubygems/package_task.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Copyright (c) 2003, 2004 Jim Weirich, 2009 Eric Hodel
 #
 # Permission is hereby granted, free of charge, to any person obtaining

data/lib/rubygems/path_support.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 #
 # Gem::PathSupport facilitates the GEM_HOME and GEM_PATH environment settings

data/lib/rubygems/platform.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "deprecate"
 
 ##

data/lib/rubygems/psych_tree.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Gem
   if defined? ::Psych::Visitors
     class NoAliasYAMLTree < Psych::Visitors::YAMLTree

data/lib/rubygems/rdoc.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 
 begin

data/lib/rubygems/remote_fetcher.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "request"
 require_relative "request/connection_pools"

data/lib/rubygems/request/http_pool.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A connection "pool" that only manages one connection for now.  Provides
 # thread safe `checkout` and `checkin` methods.  The pool consists of one

data/lib/rubygems/request/https_pool.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Gem::Request::HTTPSPool < Gem::Request::HTTPPool # :nodoc:
   private
 

data/lib/rubygems/request.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "net/http"
 require_relative "user_interaction"
 

data/lib/rubygems/request_set/gem_dependency_api.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A semi-compatible DSL for the Bundler Gemfile and Isolate gem dependencies
 # files.

data/lib/rubygems/request_set/lockfile/parser.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Gem::RequestSet::Lockfile::Parser
   ###
   # Parses lockfiles
@@ -331,7 +332,7 @@ class Gem::RequestSet::Lockfile::Parser
       set.find_all(requirement)
     end.compact.first
 
-    specification && specification.version
+    specification&.version
   end
 
   ##

data/lib/rubygems/request_set/lockfile/tokenizer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 #) frozen_string_literal: true
 require_relative "parser"
 

data/lib/rubygems/request_set/lockfile.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Parses a gem.deps.rb.lock file and constructs a LockSet containing the
 # dependencies found inside.  If the lock file is missing no LockSet is

data/lib/rubygems/request_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "tsort"
 
 ##

data/lib/rubygems/requirement.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "version"
 
 ##

data/lib/rubygems/resolver/activation_request.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Specifies a Specification object that should be activated.  Also contains a
 # dependency that was used to introduce this activation.

data/lib/rubygems/resolver/api_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The global rubygems pool, available via the rubygems.org API.
 # Returns instances of APISpecification.

data/lib/rubygems/resolver/api_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Represents a specification retrieved via the rubygems.org API.
 #

data/lib/rubygems/resolver/best_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The BestSet chooses the best available method to query a remote index.
 #

data/lib/rubygems/resolver/composed_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A ComposedSet allows multiple sets to be queried like a single set.
 #

data/lib/rubygems/resolver/conflict.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Used internally to indicate that a dependency conflicted
 # with a spec that would be activated.

data/lib/rubygems/resolver/current_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A set which represents the installed gems. Respects
 # all the normal settings that control where to look

data/lib/rubygems/resolver/dependency_request.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Used Internally. Wraps a Dependency object to also track which spec
 # contained the Dependency.

data/lib/rubygems/resolver/git_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A GitSet represents gems that are sourced from git repositories.
 #

data/lib/rubygems/resolver/git_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A GitSpecification represents a gem that is sourced from a git repository
 # and is being loaded through a gem dependencies file through the +git:+

data/lib/rubygems/resolver/index_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The global rubygems pool represented via the traditional
 # source index.

data/lib/rubygems/resolver/index_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Represents a possible Specification object returned from IndexSet.  Used to
 # delay needed to download full Specification objects when only the +name+

data/lib/rubygems/resolver/installed_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # An InstalledSpecification represents a gem that is already installed
 # locally.

data/lib/rubygems/resolver/installer_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A set of gems for installation sourced from remote sources and local .gem
 # files

data/lib/rubygems/resolver/local_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A LocalSpecification comes from a .gem file on the local filesystem.
 

data/lib/rubygems/resolver/lock_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A set of gems from a gem dependencies lockfile.
 

data/lib/rubygems/resolver/lock_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The LockSpecification comes from a lockfile (Gem::RequestSet::Lockfile).
 #

data/lib/rubygems/resolver/molinillo.rb

@@ -1,2 +1,3 @@
 # frozen_string_literal: true
+
 require_relative "molinillo/lib/molinillo"

data/lib/rubygems/resolver/requirement_list.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The RequirementList is used to hold the requirements being considered
 # while resolving a set of gems.

data/lib/rubygems/resolver/set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Resolver sets are used to look up specifications (and their
 # dependencies) used in resolution.  This set is abstract.

data/lib/rubygems/resolver/source_set.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 ##
 # The SourceSet chooses the best available method to query a remote index.
 #

data/lib/rubygems/resolver/spec_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The Resolver::SpecSpecification contains common functionality for
 # Resolver specifications that are backed by a Gem::Specification.

data/lib/rubygems/resolver/specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A Resolver::Specification contains a subset of the information
 # contained in a Gem::Specification.  Only the information necessary for

data/lib/rubygems/resolver/stats.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Gem::Resolver::Stats
   def initialize
     @max_depth = 0

data/lib/rubygems/resolver/vendor_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A VendorSet represents gems that have been unpacked into a specific
 # directory that contains a gemspec.

data/lib/rubygems/resolver/vendor_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A VendorSpecification represents a gem that has been unpacked into a project
 # and is being loaded through a gem dependencies file through the +path:+

data/lib/rubygems/resolver.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "dependency"
 require_relative "exceptions"
 require_relative "util/list"

data/lib/rubygems/s3_uri_signer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "openssl"
 
 ##
@@ -170,6 +172,6 @@ class Gem::S3URISigner
   end
 
   BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze
-  EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze
-  EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze
+  EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info"
+  EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
 end

data/lib/rubygems/safe_yaml.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Gem
 
   ###

data/lib/rubygems/security/policies.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Gem::Security
 
   ##

data/lib/rubygems/security/policy.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../user_interaction"
 
 ##

data/lib/rubygems/security/signer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Basic OpenSSL-based package signing class.
 

data/lib/rubygems/security/trust_dir.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The TrustDir manages the trusted certificates for gem signature
 # verification.

data/lib/rubygems/security.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/security_option.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/source/installed.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Represents an installed gem.  This is used for dependency resolution.
 

data/lib/rubygems/source/local.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The local source finds gems in the current directory for fulfilling
 # dependencies.

data/lib/rubygems/source/lock.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A Lock source wraps an installed gem's source and sorts before other sources
 # during dependency resolution.  This allows RubyGems to prefer gems from

data/lib/rubygems/source/specific_file.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A source representing a single .gem file.  This is used for installation of
 # local gems.

data/lib/rubygems/source/vendor.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # This represents a vendored source that is similar to an installed gem.
 

data/lib/rubygems/spec_fetcher.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "remote_fetcher"
 require_relative "user_interaction"
 require_relative "errors"