rubygems-update 4.0.21 → 4.1.0.beta1

data/lib/rubygems/cooldown.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+
+require_relative "cooldown_settings"
+require_relative "user_interaction"
+
+##
+# Applies a cooldown period to remote gem versions as a supply chain attack
+# mitigation.  When a cooldown of N days is configured, gem versions
+# published within the last N days are not considered for installation or
+# update.  Versions whose publish time is unknown are never excluded, so
+# sources that do not provide publish times keep working.
+#
+# The cooldown period comes from the <tt>--cooldown DAYS</tt> option when
+# given, and 0 there disables the cooldown.  Without the option the
+# <tt>:cooldown:</tt> setting in the gemrc file and Bundler's own cooldown
+# setting both apply and the longer of the two wins, so a 0 in either of them
+# disables nothing while the other names a period.
+
+class Gem::Cooldown
+  ##
+  # The cooldown period in days.
+
+  attr_reader :days
+
+  ##
+  # Creates a Cooldown from the command line +options+.  The --cooldown
+  # option wins outright, so <tt>--cooldown 0</tt> bypasses the cooldown
+  # however the two tools are configured.  Without it the :cooldown: gemrc
+  # setting and Bundler's cooldown setting are both read and the longer of
+  # the two applies, so a cooldown configured for only one of them still
+  # covers gem commands.
+
+  def self.from_options(options)
+    days = options[:cooldown]
+    return new(days) unless days.nil?
+
+    require_relative "bundler_settings"
+
+    new Gem::CooldownSettings.combine(warn_unless_valid(Gem.configuration.cooldown, "the gemrc file"),
+                                      warn_unless_valid(Gem::BundlerSettings["cooldown"], "Bundler's configuration"))
+  end
+
+  def initialize(days, now: Time.now)
+    invalid = Gem::CooldownSettings.invalid?(days)
+
+    @days = Gem::CooldownSettings.days(days) || 0
+    @now = now
+
+    Gem::Cooldown.warn_invalid_days(days, "the cooldown setting") if invalid
+  end
+
+  ##
+  # True when a cooldown period is configured.
+
+  def active?
+    @days > 0
+  end
+
+  ##
+  # True when a gem version published at +created_at+ must not be
+  # considered.  Versions with an unknown publish time (+nil+) are kept.
+
+  def skip?(created_at)
+    return false unless active?
+    return false unless created_at
+
+    (@now - created_at) < @days * 86_400
+  end
+
+  ##
+  # Number of days until a gem version published at +created_at+ leaves
+  # the cooldown period, rounded up and at least 1.
+
+  def remaining_days(created_at)
+    remaining = @days * 86_400 - (@now - created_at)
+
+    [(remaining / 86_400.0).ceil, 1].max
+  end
+
+  ##
+  # Reports, per gem, the newest version the cooldown kept out of a
+  # completed installation or update.  +entries+ are hashes with :name,
+  # :version, :resolved and :available_in_days keys; when several entries
+  # name the same gem only the newest version is shown.
+
+  def self.output_skipped_summary(entries)
+    return if entries.nil? || entries.empty?
+
+    newest = {}
+    entries.each do |entry|
+      current = newest[entry[:name]]
+      newest[entry[:name]] = entry if current.nil? || entry[:version] > current[:version]
+    end
+
+    ui = Gem::DefaultUserInteraction.ui
+    ui.say "The following gem versions were skipped by the cooldown setting:"
+    newest.values.sort_by {|entry| entry[:name] }.each do |entry|
+      days = entry[:available_in_days]
+      ui.say "  * #{entry[:name]} #{entry[:version]} (available in #{days} #{days == 1 ? "day" : "days"}), resolved #{entry[:resolved]} instead"
+    end
+  end
+
+  # Matches an ISO 8601 time zone designator at the end of a timestamp.
+  TIME_ZONE_SUFFIX = /(?:Z|z|[+-]\d{2}(?::?\d{2})?)\z/ # :nodoc:
+  private_constant :TIME_ZONE_SUFFIX
+
+  # Matches the four-digit year an ISO 8601 timestamp starts with.
+  # Time.iso8601 also accepts a year of any length, and one far enough
+  # away overflows the Float arithmetic behind #remaining_days.
+  FOUR_DIGIT_YEAR = /\A\d{4}-/ # :nodoc:
+  private_constant :FOUR_DIGIT_YEAR
+
+  ##
+  # Parses a +created_at+ timestamp from the compact index.  A timestamp
+  # without a time zone offset is read as UTC, because reading it as local
+  # time would shift the cooldown window by the environment's offset.
+  # Returns nil for anything unparsable, including a year outside four
+  # digits, so the cooldown fails open.
+
+  def self.parse_created_at(value)
+    return unless value.is_a?(String) && value.match?(FOUR_DIGIT_YEAR)
+
+    require "time"
+    begin
+      Time.iso8601(value.match?(TIME_ZONE_SUFFIX) ? value : "#{value}Z")
+    rescue ArgumentError
+      nil
+    end
+  end
+
+  ##
+  # Warns once per process that +source+ did not provide publish times, so
+  # the cooldown cannot be applied to gems from it.
+
+  def self.warn_missing_created_at(source)
+    return if @warned
+    @warned = true
+
+    Gem::DefaultUserInteraction.ui.alert_warning \
+      "#{source.uri} does not provide gem publish times, the cooldown period does not apply to gems from this source"
+  end
+
+  def self.reset_warned_missing_created_at # :nodoc:
+    @warned = nil
+  end
+
+  # Returns +value+, warning first when it is configured but cannot be read
+  # as a number of days.
+
+  def self.warn_unless_valid(value, source) # :nodoc:
+    warn_invalid_days(value, source) if Gem::CooldownSettings.invalid?(value)
+
+    value
+  end
+
+  # Warns that a configured cooldown value cannot be read as a non-negative
+  # integer, so it does not apply.  The --cooldown option is validated by the
+  # option parser; this catches the config file paths.  Both the gemrc and
+  # Bundler settings feed one resolution, so each source gets its own warning
+  # rather than the first one silencing the other.
+
+  def self.warn_invalid_days(value, source) # :nodoc:
+    @warned_invalid_days ||= []
+    return if @warned_invalid_days.include?(source)
+    @warned_invalid_days << source
+
+    Gem::DefaultUserInteraction.ui.alert_warning Gem::CooldownSettings.invalid_message(value, source)
+  end
+
+  def self.reset_warned_invalid_days # :nodoc:
+    @warned_invalid_days = nil
+  end
+end

data/lib/rubygems/cooldown_option.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "cooldown"
+
+##
+# Mixin methods for the cooldown option for Gem::Commands.
+
+module Gem::CooldownOption
+  ##
+  # Add the --cooldown option to the option parser.
+
+  def add_cooldown_option(group = nil)
+    args = [group, "--cooldown DAYS", Integer,
+            "Do not use gem versions published within",
+            "the last DAYS days (0 disables the cooldown,",
+            "overriding the gemrc and Bundler settings)"].compact
+
+    add_option(*args) do |value, options|
+      if value.negative?
+        raise Gem::OptionParser::InvalidArgument,
+              "#{value} (expected a non-negative integer number of days; use 0 to disable the cooldown)"
+      end
+
+      options[:cooldown] = value
+    end
+  end
+end

data/lib/rubygems/cooldown_settings.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+# Skip reloading when an identical copy (e.g. the one shipped inside the Bundler
+# gem) was already required from a different path, to avoid redefinition warnings.
+return if defined?(Gem::CooldownSettings)
+
+##
+# The rules RubyGems and Bundler share for reading a configured cooldown
+# period.  Bundler ships a copy of this file, so it deliberately has no
+# requires: none of the rest of RubyGems is guaranteed to be around it.
+
+module Gem::CooldownSettings
+  ##
+  # +value+ read as a number of days, or nil when it is absent or cannot be
+  # read as a non-negative integer.  A gemrc entry and a Bundler config entry
+  # are both arbitrary YAML, so either can be any type at all.
+
+  def self.days(value)
+    return if value.nil?
+
+    # Base 10 explicitly: a leading zero is how a user writes a small number
+    # of days, not a request for octal.
+    days = Integer(value.to_s, 10, exception: false)
+
+    days if days && !days.negative?
+  end
+
+  ##
+  # True when +value+ is configured but cannot be read as a number of days.
+
+  def self.invalid?(value)
+    !value.nil? && days(value).nil?
+  end
+
+  ##
+  # The cooldown that applies when RubyGems and Bundler are configured
+  # separately: the longest of +values+, so a cooldown configured for only
+  # one of the two tools protects both.  Returns nil when none of them is
+  # usable.
+  #
+  # A configured 0 takes part like any other value rather than switching the
+  # cooldown off, which leaves <tt>--cooldown 0</tt> as the way to bypass a
+  # cooldown that the other tool configures.
+
+  def self.combine(*values)
+    values.filter_map {|value| days(value) }.max
+  end
+
+  # +source+ names where the value came from, since RubyGems and Bundler now
+  # each read the other's setting and the same complaint from either of them
+  # is otherwise impossible to trace back to a file.
+
+  def self.invalid_message(value, source) # :nodoc:
+    "Invalid cooldown value #{value.inspect} in #{source}, so it is ignored. " \
+      "Expected a non-negative integer number of days."
+  end
+end

data/lib/rubygems/credential_store/native/linux.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "open3"
+
+class Gem::CredentialStore; end unless defined?(Gem::CredentialStore)
+
+##
+# Stores credentials in the Secret Service API (GNOME Keyring, KWallet,
+# ...) via the +secret-tool+ command line tool from libsecret.
+
+class Gem::CredentialStore::LinuxBackend
+  # secret-tool prints an item's attributes to stderr, one per line.
+  ACCOUNT_ATTRIBUTE = /^attribute\.account = (.*)$/
+  def self.available?
+    return @available if defined?(@available)
+
+    @available = ENV["PATH"].to_s.split(File::PATH_SEPARATOR).any? do |dir|
+      File.executable?(File.join(dir, "secret-tool"))
+    end
+  end
+
+  ##
+  # Clears the memoized #available? result. Intended for tests only.
+
+  def self.reset!
+    remove_instance_variable(:@available) if defined?(@available)
+  end
+
+  def self.get(service, account)
+    out, err, status = Open3.capture3(
+      "secret-tool", "lookup", "service", service, "account", account
+    )
+    # secret-tool exits 1 with nothing on stderr when the entry is simply
+    # absent. Anything else is a real failure.
+    unless status.success?
+      return nil if status.exitstatus == 1 && err.to_s.strip.empty?
+
+      raise "secret-tool exited with #{status.exitstatus}: #{err.strip}"
+    end
+
+    secret = out.chomp
+    secret.empty? ? nil : secret
+  end
+
+  def self.set(service, account, secret)
+    _out, status = Open3.capture2(
+      "secret-tool", "store", "--label=RubyGems", "service", service, "account", account,
+      stdin_data: secret
+    )
+    status.success?
+  end
+
+  # secret-tool writes attributes to stderr and secrets to stdout, so accounts
+  # are read from stderr. Discarding stdout also keeps a secret containing a
+  # newline from being mistaken for an attribute line.
+  def self.list(service)
+    _out, err, status = Open3.capture3(
+      "secret-tool", "search", "--all", "service", service
+    )
+    return [] unless status.success?
+
+    err.scan(ACCOUNT_ATTRIBUTE).flatten.uniq
+  end
+
+  def self.delete(service, account)
+    _out, err, status = Open3.capture3(
+      "secret-tool", "clear", "service", service, "account", account
+    )
+    return cleared?(service, account) if status.success?
+
+    # secret-tool clear exits 1 with no stderr when nothing matched.
+    status.exitstatus == 1 && err.to_s.strip.empty?
+  end
+
+  def self.delete_all(service)
+    _out, err, status = Open3.capture3(
+      "secret-tool", "clear", "service", service
+    )
+    return cleared?(service) if status.success?
+
+    status.exitstatus == 1 && err.to_s.strip.empty?
+  end
+
+  # libsecret clears only unlocked items and reports no error for the ones it
+  # skipped, so a locked keyring answers a clear with success while keeping
+  # every secret. search exits zero either way, so its output is the answer.
+  def self.cleared?(service, account = nil)
+    _out, err, status = Open3.capture3(
+      "secret-tool", "search", "--all", "service", service
+    )
+    return false unless status.success?
+
+    remaining = err.scan(ACCOUNT_ATTRIBUTE).flatten
+    account ? !remaining.include?(account) : remaining.empty?
+  end
+  private_class_method :cleared?
+end

data/lib/rubygems/credential_store/native/macos.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "open3"
+
+class Gem::CredentialStore; end unless defined?(Gem::CredentialStore)
+
+##
+# Stores credentials in the macOS Keychain via the +security+ command line
+# tool. +security+ has no way to read a password from stdin as raw bytes
+# for +add-generic-password+, so #set uses +security -i+ (batch/interactive
+# mode, one tokenized command per stdin line) to keep the secret off argv
+# and out of +ps+ output.
+#
+# A newline would start a second command in the +security -i+ batch, and
+# +security find-generic-password -w+ prints any non-printable byte back as a
+# hex string rather than the original value, so a non-ASCII secret would
+# round-trip corrupted. Those are the limits Gem::CredentialStore#set enforces
+# for every backend, so the caller falls back to file storage rather than
+# storing something that cannot be read back.
+
+class Gem::CredentialStore::MacOSBackend
+  NOT_FOUND_STATUS = 44
+
+  def self.get(service, account)
+    out, err, status = Open3.capture3(
+      "security", "find-generic-password", "-a", account, "-s", service, "-w"
+    )
+    # A locked keychain and an absent entry both yield no secret, but only the
+    # second one is ordinary.
+    unless status.success?
+      return nil if status.exitstatus == NOT_FOUND_STATUS
+
+      raise "security exited with #{status.exitstatus}: #{err.strip}"
+    end
+
+    secret = out.chomp
+    secret.empty? ? nil : secret
+  end
+
+  def self.set(service, account, secret)
+    command = "add-generic-password -U -a #{quote(account)} -s #{quote(service)} -w #{quote(secret)}\n"
+    _out, err, status = Open3.capture3("security", "-i", stdin_data: command)
+    return true if status.success?
+
+    # Raise rather than return false so the reason reaches the user. The
+    # wrapper turns it back into false after reporting it.
+    raise "security exited with #{status.exitstatus}: #{err.strip}"
+  end
+
+  # security has no "list by service" subcommand, so this reads the dump, which
+  # never reports the secrets.
+  def self.list(service)
+    out, status = Open3.capture2("security", "dump-keychain", err: File::NULL)
+    return [] unless status.success?
+
+    out.split(/^keychain: /).filter_map do |entry|
+      next unless entry[/^\s*"svce"<blob>="(.*)"$/, 1] == service
+
+      entry[/^\s*"acct"<blob>="(.*)"$/, 1]
+    end.uniq
+  end
+
+  def self.delete(service, account)
+    _out, status = Open3.capture2(
+      "security", "delete-generic-password", "-a", account, "-s", service,
+      err: File::NULL
+    )
+    status.success? || status.exitstatus == NOT_FOUND_STATUS
+  end
+
+  # security deletes one entry per call, so keep going until it reports there
+  # is nothing left (exit 44). Other services are untouched.
+  def self.delete_all(service)
+    loop do
+      _out, status = Open3.capture2(
+        "security", "delete-generic-password", "-s", service,
+        err: File::NULL
+      )
+      return true if status.exitstatus == NOT_FOUND_STATUS
+      return false unless status.success?
+    end
+  end
+
+  def self.quote(value)
+    %("#{value.gsub("\\", "\\\\\\\\").gsub('"', '\\"')}")
+  end
+  private_class_method :quote
+end

data/lib/rubygems/credential_store/native/windows.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "open3"
+
+class Gem::CredentialStore; end unless defined?(Gem::CredentialStore)
+
+##
+# Stores credentials in the Windows Credential Manager via the
+# +Windows.Security.Credentials.PasswordVault+ WinRT API, driven from
+# PowerShell. Account/service/secret values are passed as environment
+# variables rather than interpolated into the script text, so no quoting
+# scheme is needed and values cannot break out of the script.
+#
+# Windows PowerShell is used rather than PowerShell 7 (+pwsh+) because the
+# WinRT projection used here is not reliably available under pwsh. It is
+# spawned as +powershell+ rather than +powershell.exe+, the way this codebase
+# spawns +git+, so PATHEXT resolves it. That also lets the tests put a shim
+# ahead of it on Windows, where a file with a shebang is not executable.
+
+class Gem::CredentialStore::WindowsBackend
+  LOAD_VAULT_TYPE = <<~POWERSHELL
+    $ErrorActionPreference = 'Stop'
+    [void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
+  POWERSHELL
+  private_constant :LOAD_VAULT_TYPE
+
+  def self.get(service, account)
+    script = <<~POWERSHELL
+      #{LOAD_VAULT_TYPE}
+      $vault = New-Object Windows.Security.Credentials.PasswordVault
+      $credential = $vault.Retrieve($env:RUBYGEMS_CRED_SERVICE, $env:RUBYGEMS_CRED_ACCOUNT)
+      # Emitting into the pipeline would send the string through PowerShell's
+      # formatter, which wraps at the host width and would corrupt a secret.
+      [Console]::Out.Write($credential.Password)
+    POWERSHELL
+
+    out, err, status = run(script, service, account)
+    # An absent credential is ordinary. Any other failure is not, so raise and
+    # let the wrapper report why rather than authenticating without one.
+    unless status.success?
+      return nil if missing_credential?(err)
+
+      raise "powershell exited with #{status.exitstatus}: #{err.strip}"
+    end
+
+    secret = out.chomp
+    secret.empty? ? nil : secret
+  end
+
+  def self.set(service, account, secret)
+    script = <<~POWERSHELL
+      #{LOAD_VAULT_TYPE}
+      $vault = New-Object Windows.Security.Credentials.PasswordVault
+      try {
+        $existing = $vault.Retrieve($env:RUBYGEMS_CRED_SERVICE, $env:RUBYGEMS_CRED_ACCOUNT)
+        $vault.Remove($existing)
+      } catch {}
+      $credential = New-Object Windows.Security.Credentials.PasswordCredential($env:RUBYGEMS_CRED_SERVICE, $env:RUBYGEMS_CRED_ACCOUNT, $env:RUBYGEMS_CRED_SECRET)
+      $vault.Add($credential)
+    POWERSHELL
+
+    _out, err, status = run(script, service, account, secret)
+    return true if status.success?
+
+    # Raise so the reason reaches the user; see MacOSBackend.set.
+    raise "powershell exited with #{status.exitstatus}: #{err.strip}"
+  end
+
+  def self.delete(service, account)
+    script = <<~POWERSHELL
+      #{LOAD_VAULT_TYPE}
+      $vault = New-Object Windows.Security.Credentials.PasswordVault
+      $credential = $vault.Retrieve($env:RUBYGEMS_CRED_SERVICE, $env:RUBYGEMS_CRED_ACCOUNT)
+      $vault.Remove($credential)
+    POWERSHELL
+
+    _out, err, status = run(script, service, account)
+    status.success? || missing_credential?(err)
+  end
+
+  # FindAllByResource raises when the resource has no entries, which is an
+  # empty list rather than an error.
+  def self.list(service)
+    script = <<~POWERSHELL
+      #{LOAD_VAULT_TYPE}
+      $vault = New-Object Windows.Security.Credentials.PasswordVault
+      try {
+        $vault.FindAllByResource($env:RUBYGEMS_CRED_SERVICE) | ForEach-Object {
+          [Console]::Out.WriteLine($_.UserName)
+        }
+      } catch {
+        if (-not ($_.Exception.Message -match 'not found|0x80070490')) { throw }
+      }
+    POWERSHELL
+
+    out, _err, status = run(script, service, nil)
+    return [] unless status.success?
+
+    out.split("\n").map(&:chomp).reject(&:empty?).uniq
+  end
+
+  def self.delete_all(service)
+    script = <<~POWERSHELL
+      #{LOAD_VAULT_TYPE}
+      $vault = New-Object Windows.Security.Credentials.PasswordVault
+      try {
+        $vault.FindAllByResource($env:RUBYGEMS_CRED_SERVICE) | ForEach-Object { $vault.Remove($_) }
+      } catch {
+        if (-not ($_.Exception.Message -match 'not found|0x80070490')) { throw }
+      }
+    POWERSHELL
+
+    _out, err, status = run(script, service, nil)
+    status.success? || missing_credential?(err)
+  end
+
+  def self.run(script, service, account, secret = nil)
+    env = { "RUBYGEMS_CRED_SERVICE" => service, "RUBYGEMS_CRED_ACCOUNT" => account }
+    env["RUBYGEMS_CRED_SECRET"] = secret if secret
+
+    Open3.capture3(env, "powershell", "-NoProfile", "-NonInteractive", "-Command", "-", stdin_data: script)
+  end
+  private_class_method :run
+
+  def self.missing_credential?(message)
+    text = message.to_s.downcase
+    text.include?("element not found") || text.include?("0x80070490") || text.include?("could not be found")
+  end
+  private_class_method :missing_credential?
+end