rubygems-update 4.0.21 → 4.1.0.beta1

data/lib/rubygems/safe_marshal.rb

@@ -51,9 +51,10 @@ module Gem
         @name @requirement @prerelease @version_requirement @version_requirements @type
         @force_ruby_platform
       ],
-      "Gem::NameTuple" => %w[@name @version @platform],
+      "Gem::NameTuple" => %w[@name @version @platform @content_address @ruby_abi],
       "Gem::Platform" => %w[@os @cpu @version],
       "Psych::PrivateType" => %w[@value @type_id],
+      "YAML::PrivateType" => %w[@value @type_id],
     }.freeze
     private_constant :PERMITTED_IVARS
 

data/lib/rubygems/safe_yaml.rb

@@ -35,11 +35,28 @@ module Gem
     end
 
     def self.safe_load(input)
-      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
+      # Psych rejects legacy metadata bytes, so preserve them with the internal parser.
+      if Gem.use_psych? && valid_encoding?(input)
+        ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES,
+                                 permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
+      else
+        Gem::YAMLSerializer.load(
+          input,
+          permitted_classes: PERMITTED_CLASSES,
+          permitted_symbols: PERMITTED_SYMBOLS,
+          aliases: aliases_enabled?
+        )
+      end
     end
 
-    def self.load(input)
-      ::Psych.safe_load(input, permitted_classes: [::Symbol])
+    class << self
+      alias_method :load, :safe_load
+    end
+
+    private_class_method def self.valid_encoding?(input)
+      return true unless input.is_a?(String)
+
+      input.dup.force_encoding(Encoding::UTF_8).valid_encoding?
     end
   end
 end

data/lib/rubygems/security/policy.rb

@@ -73,8 +73,10 @@ class Gem::Security::Policy
   # the +digest+ algorithm.
 
   def check_data(public_key, digest, signature, data)
+    filtered_digest = digest if Gem::Security.digest_required?(public_key)
+
     raise Gem::Security::Exception, "invalid signature" unless
-      public_key.verify digest, signature, data.digest
+      public_key.verify filtered_digest, signature, data.digest
 
     true
   end
@@ -165,9 +167,9 @@ class Gem::Security::Policy
     end
 
     save_cert = OpenSSL::X509::Certificate.new File.read path
-    save_dgst = digester.digest save_cert.public_key.to_pem
+    save_dgst = digester.digest save_cert.public_key.public_to_pem
 
-    pkey_str = root.public_key.to_pem
+    pkey_str = root.public_key.public_to_pem
     cert_dgst = digester.digest pkey_str
 
     raise Gem::Security::Exception,
@@ -268,6 +270,12 @@ class Gem::Security::Policy
     end
 
     true
+  # NotImplementedError: JRuby's Ruby OpenSSL raises it for ML-DSA.
+  rescue OpenSSL::X509::CertificateError, NotImplementedError
+    raise Gem::Security::Exception,
+      "certificate verification failed: The certificate may use an algorithm "\
+      "such as ML-DSA that the installed OpenSSL does not support. ML-DSA "\
+      "requires OpenSSL >= 3.5 or an SSL library supporting ML-DSA."
   end
 
   ##

data/lib/rubygems/security/signer.rb

@@ -47,7 +47,7 @@ class Gem::Security::Signer
     expired_cert_file = "#{File.basename(expired_cert_path)}.expired.#{expiry}"
     new_expired_cert_path = File.join(Gem.user_home, ".gem", expired_cert_file)
 
-    Gem::Security.write(expired_cert, new_expired_cert_path)
+    Gem::Security.write_certificate(expired_cert, new_expired_cert_path)
 
     re_signed_cert = Gem::Security.re_sign(
       expired_cert,
@@ -55,7 +55,7 @@ class Gem::Security::Signer
       Gem::Security::ONE_DAY * Gem.configuration.cert_expiration_length_days
     )
 
-    Gem::Security.write(re_signed_cert, expired_cert_path)
+    Gem::Security.write_certificate(re_signed_cert, expired_cert_path)
 
     yield(expired_cert_path, new_expired_cert_path) if block_given?
   end
@@ -85,7 +85,14 @@ class Gem::Security::Signer
     @digest_algorithm = Gem::Security.create_digest(@digest_name)
 
     if @key && !@key.is_a?(OpenSSL::PKey::PKey)
-      @key = OpenSSL::PKey.read(File.read(@key), @passphrase)
+      begin
+        @key = OpenSSL::PKey.read(File.read(@key), @passphrase)
+      rescue OpenSSL::PKey::PKeyError
+        raise Gem::Security::Exception,
+          "private key could not be loaded: The key may use an algorithm "\
+          "such as ML-DSA that the installed OpenSSL does not support. "\
+          "ML-DSA requires OpenSSL >= 3.5 or an SSL library supporting ML-DSA."
+      end
     end
 
     if @cert_chain
@@ -152,7 +159,8 @@ class Gem::Security::Signer
 
     Gem::Security::SigningPolicy.verify @cert_chain, @key, {}, {}, full_name
 
-    @key.sign @digest_algorithm.new, data
+    digest = @digest_algorithm.new if Gem::Security.digest_required?(@key)
+    @key.sign digest, data
   end
 
   ##
@@ -188,17 +196,17 @@ class Gem::Security::Signer
 
     return unless disk_key
 
-    if disk_key.to_pem == @key.to_pem && disk_cert == old_cert.to_pem
+    if disk_key.private_to_pem == @key.private_to_pem && disk_cert == old_cert.to_pem
       expiry = old_cert.not_after.strftime("%Y%m%d%H%M%S")
       old_cert_file = "gem-public_cert.pem.expired.#{expiry}"
       old_cert_path = File.join(Gem.user_home, ".gem", old_cert_file)
 
       unless File.exist?(old_cert_path)
-        Gem::Security.write(old_cert, old_cert_path)
+        Gem::Security.write_certificate(old_cert, old_cert_path)
 
         cert = Gem::Security.re_sign(old_cert, @key, expiration_length)
 
-        Gem::Security.write(cert, disk_cert_path)
+        Gem::Security.write_certificate(cert, disk_cert_path)
 
         alert("Your cert: #{disk_cert_path} has been auto re-signed with the key: #{disk_key_path}")
         alert("Your expired cert will be located at: #{old_cert_path}")

data/lib/rubygems/security.rb

@@ -153,7 +153,9 @@ require_relative "openssl"
 #                                      certificate for EMAIL_ADDR
 #     -C, --certificate CERT           Signing certificate for --sign
 #     -K, --private-key KEY            Key for --sign or --build
-#     -A, --key-algorithm ALGORITHM    Select key algorithm for --build from RSA, DSA, or EC. Defaults to RSA.
+#     -A, --key-algorithm ALGORITHM    Select key algorithm for --build from
+#                                      RSA, DSA, EC, ML-DSA-44, ML-DSA-65,
+#                                      or ML-DSA-87. Defaults to RSA.
 #     -s, --sign CERT                  Signs CERT with the key from -K
 #                                      and the certificate from -C
 #     -d, --days NUMBER_OF_DAYS        Days before the certificate expires
@@ -351,6 +353,23 @@ module Gem::Security
 
   EC_NAME = "secp384r1"
 
+  ##
+  # ML-DSA algorithm names to use when building a key pair.
+  # ML-DSA-44: NIST security strength category 2, signature size 2420 bytes
+  # ML-DSA-65: NIST security strength category 3, signature size 3309 bytes
+  # ML-DSA-87: NIST security strength category 5, signature size 4627 bytes
+  # See NIST FIPS 204 Section 4 (Parameter Sets).
+  # https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf
+  # See Security (Evaluation Criteria) - 4.A.5 Security Strength Categories.
+  # https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria)
+
+  ML_DSA_44_NAME = "ML-DSA-44"
+  ML_DSA_65_NAME = "ML-DSA-65"
+  ML_DSA_87_NAME = "ML-DSA-87"
+
+  ML_DSA_NAMES = [ML_DSA_44_NAME, ML_DSA_65_NAME, ML_DSA_87_NAME].freeze
+  private_constant :ML_DSA_NAMES
+
   ##
   # Cipher used to encrypt the key pair used to sign gems.
   # Must be in the list returned by OpenSSL::Cipher.ciphers
@@ -371,14 +390,12 @@ module Gem::Security
   # The default set of extensions are:
   #
   # * The certificate is not a certificate authority
-  # * The key for the certificate may be used for key and data encipherment
-  #   and digital signatures
+  # * The key for the certificate may be used for digital signatures
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
     "basicConstraints" => "CA:FALSE",
-    "keyUsage" =>
-      "keyEncipherment,dataEncipherment,digitalSignature",
+    "keyUsage" => "digitalSignature",
     "subjectKeyIdentifier" => "hash",
   }.freeze
 
@@ -464,25 +481,77 @@ module Gem::Security
   end
 
   ##
-  # Creates a new key pair of the specified +algorithm+. RSA, DSA, and EC
-  # are supported.
+  # Creates a new key pair of the specified +algorithm+. RSA, DSA, EC,
+  # ML-DSA-44, ML-DSA-65, and ML-DSA-87 are supported.
 
   def self.create_key(algorithm)
     if defined?(OpenSSL::PKey)
       case algorithm.downcase
-      when "dsa"
-        OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
       when "rsa"
         OpenSSL::PKey::RSA.new(RSA_DSA_KEY_LENGTH)
+      when "dsa"
+        OpenSSL::PKey::DSA.new(RSA_DSA_KEY_LENGTH)
       when "ec"
         OpenSSL::PKey::EC.generate(EC_NAME)
+      when "ml-dsa-44"
+        create_ml_dsa_key(ML_DSA_44_NAME)
+      when "ml-dsa-65"
+        create_ml_dsa_key(ML_DSA_65_NAME)
+      when "ml-dsa-87"
+        create_ml_dsa_key(ML_DSA_87_NAME)
       else
         raise Gem::Security::Exception,
-        "#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
+          "#{algorithm} algorithm not found. RSA, DSA, EC, ML-DSA-44, "\
+          "ML-DSA-65, and ML-DSA-87 algorithms are supported."
       end
     end
   end
 
+  ##
+  # Creates an ML-DSA key pair of the +algorithm+ such as ML-DSA-65. ML-DSA
+  # requires OpenSSL >= 3.5 or an SSL library supporting ML-DSA.
+
+  def self.create_ml_dsa_key(algorithm)
+    OpenSSL::PKey.generate_key(algorithm)
+  rescue OpenSSL::PKey::PKeyError
+    raise Gem::Security::Exception,
+      "#{algorithm} key generation failed: #{algorithm} requires "\
+      "OpenSSL >= 3.5 or an SSL library supporting ML-DSA."
+  end
+  private_class_method :create_ml_dsa_key
+
+  ##
+  # Returns whether +key+ uses ML-DSA. OpenSSL::PKey::PKey#oid raises for the
+  # provider-backed keys ML-DSA uses, so the algorithm is read from the
+  # SubjectPublicKeyInfo instead.
+
+  def self.ml_dsa_key?(key)
+    algorithm = OpenSSL::ASN1.decode(key.public_to_der).value.first.value.first
+    ML_DSA_NAMES.include?(algorithm.ln)
+  rescue OpenSSL::ASN1::ASN1Error, OpenSSL::PKey::PKeyError, NoMethodError
+    false
+  end
+  private_class_method :ml_dsa_key?
+
+  ##
+  # Returns whether the +key+ requires an explicit digest algorithm for signing
+  # and verification. ML-DSA has a built-in digest and does not accept one.
+  # Any other algorithm raises, since a gem carries no record of how its
+  # signature was produced and RubyGems must not guess.
+
+  def self.digest_required?(key)
+    case key
+    when OpenSSL::PKey::RSA, OpenSSL::PKey::DSA, OpenSSL::PKey::EC
+      true
+    else
+      return false if ml_dsa_key?(key)
+
+      raise Gem::Security::Exception,
+        "unsupported key algorithm. RSA, DSA, EC, ML-DSA-44, ML-DSA-65, and "\
+        "ML-DSA-87 keys are supported."
+    end
+  end
+
   ##
   # Turns +email_address+ into an OpenSSL::X509::Name
 
@@ -562,7 +631,20 @@ module Gem::Security
     signed = create_cert signee_subject, signee_key, age, extensions, serial
     signed.issuer = signing_cert.subject
 
-    signed.sign signing_key, Gem::Security::DIGEST_NAME
+    digest_name = Gem::Security::DIGEST_NAME if digest_required?(signing_key)
+
+    begin
+      signed.sign signing_key, digest_name
+    rescue OpenSSL::PKey::PKeyError, ArgumentError
+      raise Gem::Security::Exception,
+        "incorrect signing key for signing"
+    # Ruby OpenSSL only accepts the nil digest ML-DSA needs from 3.3 on.
+    rescue TypeError
+      raise if digest_name
+
+      raise Gem::Security::Exception,
+        "certificate signing failed: ML-DSA requires Ruby OpenSSL >= 3.3."
+    end
   end
 
   ##
@@ -585,24 +667,36 @@ module Gem::Security
   end
 
   ##
-  # Writes +pemmable+, which must respond to +to_pem+ to +path+ with the given
-  # +permissions+. If passed +cipher+ and +passphrase+ those arguments will be
-  # passed to +to_pem+.
+  # Writes the private +key+ to +path+ with the given +permissions+.
+  # If passed +passphrase+ and +cipher+, the key is encrypted.
 
-  def self.write(pemmable, path, permissions = 0o600, passphrase = nil, cipher = KEY_CIPHER)
+  def self.write_private_key(key, path, permissions = 0o600, passphrase = nil, cipher = KEY_CIPHER)
     path = File.expand_path path
 
     File.open path, "wb", permissions do |io|
       if passphrase && cipher
-        io.write pemmable.to_pem cipher, passphrase
+        io.write key.private_to_pem cipher, passphrase
       else
-        io.write pemmable.to_pem
+        io.write key.private_to_pem
       end
     end
 
     path
   end
 
+  ##
+  # Writes the +certificate+ to +path+ with the given +permissions+.
+
+  def self.write_certificate(certificate, path, permissions = 0o600)
+    path = File.expand_path path
+
+    File.open path, "wb", permissions do |io|
+      io.write certificate.to_pem
+    end
+
+    path
+  end
+
   reset
 end
 

data/lib/rubygems/source/local.rb

@@ -41,7 +41,8 @@ class Gem::Source::Local < Gem::Source
       Dir["*.gem"].each do |file|
         pkg = Gem::Package.new(file)
         spec = pkg.spec
-      rescue SystemCallError, Gem::Package::FormatError
+        spec.content_address = pkg.content_address
+      rescue SystemCallError, Gem::Package::FormatError, Gem::InstallError
         # ignore
       else
         tup = spec.name_tuple
@@ -76,6 +77,10 @@ class Gem::Source::Local < Gem::Source
   end
 
   def find_gem(gem_name, version = Gem::Requirement.default, prerelease = false) # :nodoc:
+    find_all_gems(gem_name, version, prerelease).max_by(&:version)
+  end
+
+  def find_all_gems(gem_name, version = Gem::Requirement.default, prerelease = false) # :nodoc:
     load_specs :complete
 
     found = []
@@ -93,7 +98,7 @@ class Gem::Source::Local < Gem::Source
       end
     end
 
-    found.max_by(&:version)
+    found
   end
 
   def fetch_spec(name) # :nodoc: