saml-kit 1.4.0 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf6c86073d43c4c6b2f55aa091d71e1fb9e58d823e1e25936ba598c9db8c2304
-  data.tar.gz: 1896cf94e32bd938a3b4c3ae96c5e5b88a1433c8988866fa6d12e64a035812d5
+  metadata.gz: 6758626dbf26ac6ea50535978aead6d9046a6dd31662cff9eb962154a682380e
+  data.tar.gz: 8fd7df975fa700f8d969f77c2fff0f59e9829ef3bde7ab6f41a6b5a94cb208d7
 SHA512:
-  metadata.gz: 1287fa37a0daaf27d591dcdfd03241897ef7b8773c4d1e9a4cab96c9940b5b475e54691062e76916e44e030c494aa34f32fa5a3496d295366f8a16b01e5333c2
-  data.tar.gz: 10b7edcc0ed623d9a84fbe03926306e0d224eb20fde850ca2900086882f518b77029952f2f35ca33a33b80412513c0669c6a1296d72eaecb12f9bef38afe9e80
+  metadata.gz: 1e80fc106bbc6e06e167c0e5b6ce7b7f09d3bf7e471558533ec2a061089dc0367d60da5a393436a9feb3e8f5b12745193d7652c29f5d9cc9dae9ecd151a42a19
+  data.tar.gz: a3a39fcbff995f9ac1dceca502412efd165690fdd66b91d093f423d8cc1573486c95655b1f958746f98c682c48eba69357a8b058fef53d216e770c7e5b9d8620

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 1.4.0
+Version 1.5.0
 
 # Changelog
 All notable changes to this project will be documented in this file.
@@ -8,6 +8,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-08-17
+### Security
+- Reject a `Response` or `Assertion` that carries no signature. A registered
+  issuer was previously enough to make an unsigned document valid, so anyone
+  who could reach the assertion consumer service could forge an assertion for
+  any user. (GHSA-hx7c-98jm-7r55)
+- Require an xml signature to reference the element it is attached to. A
+  signature was verified without checking which element it covered, so a valid
+  signature could be copied onto a forged element with the element it really
+  covered hidden in `saml:Advice` or `ds:Object`. (GHSA-q726-45rx-qvrw)
+
+### Changed
+This release rejects documents that 1.4.1 accepted. Each case below was
+exploitable or is a side effect of closing one that was.
+
+- An unsigned `Response` or `Assertion` is now invalid, even when its issuer is
+  registered. Set `configuration.signature_required = false` to restore the old
+  behaviour while an identity provider is being fixed; doing so accepts forged
+  assertions. Signing only the `Assertion` is still accepted, as is an unsigned
+  `AuthnRequest`, `LogoutRequest` or `LogoutResponse`.
+- `Response.build` on a `Configuration` with no signing key pair emits an
+  unsigned document, which now fails `valid?`. Call
+  `generate_key_pair_for(use: :signing)` or `add_key_pair`.
+- `Assertion.new` with an unsigned assertion as a `String` is now invalid,
+  because a bare assertion is the whole document and nothing else vouches for
+  it. Passing the same assertion as a node nested in a `Response` is unchanged.
+- A signature whose `ds:Reference` does not resolve to the element it hangs
+  off, or resolves to more than one element, adds an error on `:reference`.
+
+### Added
+- `Saml::Kit::Configuration#signature_required`, defaulting to `true`.
+
+## [1.4.1] - 2026-08-14
+### Changed
+- fix: decode encoded signature
+
 ## [1.4.0] - 2025-03-26
 ### Added
 - Add support for converting `Assertion` xml to `Saml::Document`
@@ -106,7 +142,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Removed
 - Removed optional SessionNotOnOrAfter attribute from AuthnStatement.
 
-[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.4.0...HEAD
+[Unreleased]: https://github.com/xlgmokha/saml-kit/compare/v1.5.0...HEAD
+[1.5.0]: https://github.com/xlgmokha/saml-kit/compare/v1.4.1...v1.5.0
+[1.4.1]: https://github.com/xlgmokha/saml-kit/compare/v1.4.0...v1.4.1
 [1.4.0]: https://github.com/xlgmokha/saml-kit/compare/v1.3.0...v1.4.0
 [1.3.0]: https://github.com/xlgmokha/saml-kit/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/xlgmokha/saml-kit/compare/v1.1.0...v1.2.0

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    saml-kit (1.4.0)
+    saml-kit (1.5.0)
       activemodel (>= 5.1)
       base64 (~> 0.1)
       cgi (~> 0.1)
@@ -16,66 +16,84 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (7.2.2.1)
-      activesupport (= 7.2.2.1)
-    activesupport (7.2.2.1)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activesupport (8.1.3.1)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
       minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+      uri (>= 0.13.1)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
-    base64 (0.2.0)
-    benchmark (0.4.0)
+    base64 (0.3.0)
     benchmark-malloc (0.2.0)
     benchmark-perf (0.6.0)
     benchmark-trend (0.4.0)
-    bigdecimal (3.1.9)
+    bigdecimal (4.1.2)
     builder (3.3.0)
     bundler-audit (0.9.2)
       bundler (>= 1.2.0, < 3)
       thor (~> 1.0)
-    cgi (0.4.2)
-    concurrent-ruby (1.3.5)
-    connection_pool (2.5.0)
+    cgi (0.5.2)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
     crack (1.0.0)
       bigdecimal
       rexml
     date (3.4.1)
     diff-lcs (1.6.1)
     docile (1.4.1)
-    drb (2.2.1)
-    erb (4.0.4)
+    drb (2.2.3)
+    erb (4.0.4.1)
       cgi (>= 0.3.3)
     ffaker (2.24.0)
     forwardable (1.3.3)
     hashdiff (1.1.2)
-    i18n (1.14.7)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     io-console (0.8.0)
     irb (1.15.1)
       pp (>= 0.6.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.10.2)
+    json (2.21.2)
     language_server-protocol (3.17.0.4)
     lint_roller (1.1.0)
-    logger (1.6.6)
-    mini_portile2 (2.8.8)
-    minitest (5.25.5)
+    logger (1.7.0)
+    mini_portile2 (2.8.9)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     net-hippie (1.2.0)
       logger (~> 1.0)
-    nokogiri (1.18.6)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
     parallel (1.26.3)
     parser (3.3.7.3)
       ast (~> 2.4.1)
@@ -83,11 +101,11 @@ GEM
     pp (0.6.2)
       prettyprint
     prettyprint (0.2.0)
-    prism (1.4.0)
+    prism (1.9.0)
     psych (5.2.3)
       date
       stringio
-    public_suffix (6.0.1)
+    public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.2.1)
@@ -96,7 +114,7 @@ GEM
     regexp_parser (2.10.0)
     reline (0.6.0)
       io-console (~> 0.5)
-    rexml (3.4.1)
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -141,15 +159,15 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.1)
     simplecov_json_formatter (0.1.4)
-    stringio (3.1.6)
+    stringio (3.2.0)
     thor (1.3.2)
     tilt (2.6.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
-    uri (1.0.3)
+    unicode-emoji (4.2.0)
+    uri (1.1.1)
     webmock (3.25.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
@@ -164,7 +182,15 @@ GEM
       nokogiri (>= 1.6.8, < 2.0.0)
 
 PLATFORMS
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
   ruby
+  x86_64-darwin
+  x86_64-linux-gnu
+  x86_64-linux-musl
 
 DEPENDENCIES
   bundler (~> 2.0)

data/lib/saml/kit/assertion.rb

@@ -89,9 +89,7 @@ module Saml
       end
 
       def decryptable?
-        return true unless encrypted?
-
-        !@cannot_decrypt
+        !encrypted? || !@cannot_decrypt
       end
 
       def to_s
@@ -100,6 +98,12 @@ module Saml
 
       private
 
+      # A nested Assertion is covered by the enclosing Response's policy; a
+      # bare one is the whole document and has nothing else vouching for it.
+      def signature_required_by_type?
+        to_nokogiri == to_nokogiri.document.root
+      end
+
       def decrypt(decryptor)
         encrypted_assertion = at_xpath('./xmlenc:EncryptedData')
         @encrypted = encrypted_assertion.present?

data/lib/saml/kit/bindings/http_redirect.rb

@@ -49,13 +49,24 @@ module Saml
 
           return document.signature_verified! if provider.verify(
             algorithm_for(params[:SigAlg]),
-            decode(signature),
+            decode(signature_from(signature)),
             canonicalize(params)
           )
 
           raise ArgumentError, 'Invalid Signature'
         end
 
+        # The signature arrives percent encoded from any conformant peer, but
+        # versions of this library before 1.4.1 emitted it raw. A percent sign
+        # is not in the base64 alphabet, so its presence distinguishes the two
+        # without a guess. Unescaping unconditionally would corrupt a raw
+        # signature, because CGI.unescape turns + into a space.
+        #
+        # @param signature [String] the Signature query parameter.
+        def signature_from(signature)
+          signature.include?('%') ? unescape(signature) : signature
+        end
+
         def canonicalize(params)
           %i[SAMLRequest SAMLResponse RelayState SigAlg].map do |key|
             value = params[key]

data/lib/saml/kit/bindings/url_builder.rb

@@ -21,7 +21,7 @@ module Saml
           destination = document.destination
           if configuration.sign?
             payload = canonicalize(document, relay_state)
-            "#{destination}?#{payload}&Signature=#{signature_for(payload)}"
+            "#{destination}?#{payload}&Signature=#{escape(signature_for(payload))}"
           else
             "#{destination}?" + to_query_string(
               document.query_string_parameter => serialize(document.to_xml),

data/lib/saml/kit/concerns/trustable.rb

@@ -11,9 +11,15 @@ module Saml
       included do
         validate :must_have_valid_signature, unless: :signature_verified
         validate :must_be_registered
+        validate :must_be_signed, if: :signature_required?
         validate :must_be_trusted
       end
 
+      # Returns true when this document must carry a signature to be valid.
+      def signature_required?
+        configuration.signature_required && signature_required_by_type?
+      end
+
       # Returns true when the document has an embedded XML Signature or has
       # been verified externally.
       def signed?
@@ -65,9 +71,40 @@ module Saml
         errors.add(:provider, error_message(:unregistered))
       end
 
+      # Whether a document of this type is worthless unless signed.
+      #
+      # A request may legitimately arrive unsigned, which is what
+      # `WantAuthnRequestsSigned="false"` means, so the default is false. A
+      # document that asserts an identity carries no authenticity guarantee at
+      # all when unsigned, so Response and Assertion override this.
+      def signature_required_by_type?
+        false
+      end
+
+      def must_be_signed
+        return unless expected_type?
+        return if signature_covers_document?
+
+        errors.add(:base, error_message(:unsigned))
+      end
+
+      # Whether a signature exists over the content this document asserts.
+      # Response overrides this, because a signature on either the Response or
+      # the Assertion covers the identity being asserted.
+      def signature_covers_document?
+        signed?
+      end
+
+      # The trust counterpart of `signature_covers_document?`. Kept separate
+      # from the public `trusted?`, which answers the narrower question of
+      # whether *this* element's own signature is trusted.
+      def signature_trusted?
+        trusted?
+      end
+
       def must_be_trusted
-        return if trusted?
-        return if provider.present? && !signed?
+        return if signature_trusted?
+        return if !signature_required? && provider.present? && !signed?
 
         errors.add(:fingerprint, error_message(:invalid_fingerprint))
       end

data/lib/saml/kit/configuration.rb

@@ -46,6 +46,13 @@ module Saml
       attr_accessor :logger
       # The total allowable clock drift for session timeout validation.
       attr_accessor :clock_drift
+      # Whether a document that asserts an identity must carry a signature.
+      #
+      # An unsigned Response or Assertion proves nothing about who issued it,
+      # so this defaults to true and should stay that way. Set it to false only
+      # to keep an identity provider that signs nothing working while it is
+      # being fixed, and understand that doing so accepts forged assertions.
+      attr_accessor :signature_required
 
       def initialize
         @clock_drift = 30.seconds
@@ -55,6 +62,7 @@ module Saml
         @registry = DefaultRegistry.new
         @session_timeout = 3.hours
         @signature_method = :SHA256
+        @signature_required = true
         yield self if block_given?
       end
 

data/lib/saml/kit/locales/en.yml

@@ -11,6 +11,7 @@ en:
         must_contain_single_assertion: "must contain single Assertion."
         must_match_issuer: "must match entityId."
         unregistered: "is unregistered."
+        unsigned: "must be signed."
       AuthnRequest:
         invalid: "must contain AuthnRequest."
         invalid_fingerprint: "is not registered."
@@ -34,10 +35,12 @@ en:
         invalid_version: "must be 2.0."
         unregistered: "must originate from registered identity provider."
         must_contain_single_assertion: "must contain a single Assertion."
+        unsigned: "must be signed."
       Signature:
         certificate: "Not valid before %{not_before}. Not valid after %{not_after}."
         digest_value: "is invalid."
         empty: "is missing."
+        reference: "must reference the element it is attached to."
         signature: "is invalid."
       SPSSODescriptor:
         invalid: "must contain SPSSODescriptor."

data/lib/saml/kit/response.rb

@@ -41,10 +41,26 @@ module Saml
 
       private
 
+      def signature_required_by_type?
+        true
+      end
+
+      # `signed?` and `trusted?` deliberately report only this element's own
+      # signature, but signing only the Assertion is a common identity provider
+      # configuration, and that signature covers the identity being asserted.
+      def signature_covers_document?
+        signed? || assertion.signed?
+      end
+
+      def signature_trusted?
+        super || (assertion.signed? && assertion.trusted?)
+      end
+
       def must_be_valid_assertion
         assertion.valid?
         assertion.each_error do |attribute, error|
-          errors.add(attribute == :base ? :assertion : attribute, error)
+          attribute = :assertion if attribute == :base
+          errors.add(attribute, error) unless errors.added?(attribute, error)
         end
       end
 

data/lib/saml/kit/signature.rb

@@ -11,6 +11,7 @@ module Saml
 
       validate :validate_signature
       validate :validate_certificate
+      validate :validate_reference
 
       attr_reader :name
 
@@ -20,18 +21,24 @@ module Saml
       end
 
       # Returns the embedded X509 Certificate
+      #
+      # Memoized with a `defined?` guard rather than `||=` because a signature
+      # without KeyInfo legitimately has no certificate, and callers depend on
+      # the nil.
       def certificate
-        xpath = './ds:KeyInfo/ds:X509Data/ds:X509Certificate'
-        value = at_xpath(xpath).try(:text)
-        return if value.nil?
+        return @certificate if defined?(@certificate)
 
-        ::Xml::Kit::Certificate.new(value, use: :signing)
+        value = at_xpath('./ds:KeyInfo/ds:X509Data/ds:X509Certificate').try(:text)
+        @certificate =
+          value.nil? ? nil : ::Xml::Kit::Certificate.new(value, use: :signing)
       end
 
       # Returns true when the fingerprint of the certificate matches one of
       # the certificates registered in the metadata.
       def trusted?(metadata)
         return false if metadata.nil?
+        return false if certificate.nil?
+        return false unless reference.bound?
 
         metadata.matches?(certificate.fingerprint, use: :signing).present?
       end
@@ -66,15 +73,9 @@ module Saml
       end
 
       def transforms
-        xpath = xpath_for([
-          '.',
-          'ds:SignedInfo',
-          'ds:Reference',
-          'ds:Transforms',
-          'ds:Transform',
-          '@Algorithm',
-        ])
-        node.search(xpath, Saml::Kit::Document::NAMESPACES).try(:map, &:value)
+        xpath = './ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform'
+        node.search("#{xpath}/@Algorithm", Saml::Kit::Document::NAMESPACES)
+          .try(:map, &:value)
       end
 
       # Returns the XML Hash.
@@ -109,6 +110,17 @@ module Saml
         errors.add(:base, error.message)
       end
 
+      def validate_reference
+        return unless present?
+        return if reference.bound?
+
+        errors.add(:reference, error_message(:reference))
+      end
+
+      def reference
+        @reference ||= SignatureReference.new(node)
+      end
+
       def validate_certificate(now = Time.now.utc)
         return unless certificate.present?
         return if certificate.active?(now)
@@ -128,11 +140,7 @@ module Saml
       end
 
       def dsignature
-        @dsignature ||= Xmldsig::Signature.new(node, 'ID=$uri or @Id')
-      end
-
-      def xpath_for(segments)
-        segments.join('/')
+        @dsignature ||= Xmldsig::Signature.new(node, SignatureReference::ID_ATTR)
       end
     end
   end

data/lib/saml/kit/signature_reference.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Saml
+  module Kit
+    # This class is responsible for deciding whether an xml digital signature
+    # actually covers the element it is attached to.
+    #
+    # A cryptographically intact signature only proves that *some* element in
+    # the document is unmodified. xmldsig resolves a Reference by searching the
+    # whole document for a matching ID, so without this check an attacker can
+    # copy a valid signature onto a forged element and hide the element it
+    # really covers somewhere the schema still permits, e.g. saml:Advice or
+    # ds:Object.
+    class SignatureReference
+      # The id_attr handed to Xmldsig::Signature, which expands it into
+      # "//*[@ID=$uri or @Id=$uri]". Both resolvers must agree on this or the
+      # element we check is not the element that was digested.
+      ID_ATTR = 'ID=$uri or @Id'
+      XPATH = './ds:SignedInfo/ds:Reference'
+
+      def initialize(node)
+        @node = node
+      end
+
+      # Returns true when some Reference resolves to the element the signature
+      # hangs off, and resolves to nothing else.
+      #
+      # Every Reference lives inside ds:SignedInfo, which ds:SignatureValue
+      # covers, so an attacker replaying a signature cannot add a Reference or
+      # retarget an existing one. Finding our element among them is therefore
+      # enough. SAML 2.0 core 5.4.2 permits only one, but documents carrying
+      # more exist, and each extra Reference only widens what the signature
+      # already commits to.
+      def bound?
+        return @bound if defined?(@bound)
+
+        @bound = binds_parent_element?
+      end
+
+      private
+
+      attr_reader :node
+
+      def binds_parent_element?
+        return false if node.nil? || signed.nil?
+
+        references.any? { |reference| covers_signed_element?(reference) }
+      end
+
+      def covers_signed_element?(reference)
+        uri = reference.attribute('URI').try(:value).to_s
+        # An empty URI digests the whole document, so it covers every element in
+        # it and leaves nowhere to hide an original.
+        return true if uri.empty?
+
+        id.present? && uri == "##{id}" && resolves_to_signed_element?
+      end
+
+      # `bound?` memoizes the one answer this class exists to give, so only the
+      # XPath search below is worth caching; the rest are O(1) node lookups.
+      def signed
+        node.parent
+      end
+
+      def references
+        @references ||= node.search(XPATH, Saml::Kit::Document::NAMESPACES)
+      end
+
+      def id
+        signed.attribute('ID').try(:value) || signed.attribute('Id').try(:value)
+      end
+
+      # Duplicate IDs are only rejected when schema validation runs, and an
+      # XPath lookup silently returns the first match, so require exactly one.
+      def resolves_to_signed_element?
+        matches = node.document.xpath(
+          "//*[@#{ID_ATTR}=$uri]",
+          Saml::Kit::Document::NAMESPACES,
+          'uri' => id
+        )
+        matches.count == 1 && matches.first == signed
+      end
+    end
+  end
+end

data/lib/saml/kit/version.rb

@@ -2,6 +2,6 @@
 
 module Saml
   module Kit
-    VERSION = '1.4.0'
+    VERSION = '1.5.0'
   end
 end

data/lib/saml/kit.rb

@@ -44,6 +44,7 @@ require 'saml/kit/logout_request'
 require 'saml/kit/metadata'
 require 'saml/kit/deprecated/metadata'
 require 'saml/kit/null_assertion'
+require 'saml/kit/signature_reference'
 require 'saml/kit/organization'
 require 'saml/kit/parser'
 require 'saml/kit/composite_metadata'

data/saml-kit.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'A simple toolkit for working with SAML.'
   spec.homepage      = 'https://github.com/xlgmokha/saml-kit'
   spec.license       = 'MIT'
-  spec.required_ruby_version = '>= 3.1.0'
+  spec.required_ruby_version = '>= 3.2.0'
 
   spec.files = `git ls-files -z`.split("\x0").reject do |f|
     (

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: saml-kit
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 1.5.0
 platform: ruby
 authors:
 - mo khan
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-03-26 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -414,6 +413,7 @@ files:
 - lib/saml/kit/rspec/have_xpath.rb
 - lib/saml/kit/service_provider_metadata.rb
 - lib/saml/kit/signature.rb
+- lib/saml/kit/signature_reference.rb
 - lib/saml/kit/version.rb
 - lib/saml/kit/xsd/MetadataExchange.xsd
 - lib/saml/kit/xsd/oasis-200401-wss-wssecurity-secext-1.0.xsd
@@ -448,7 +448,6 @@ licenses:
 - MIT
 metadata:
   yard.run: yri
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -456,15 +455,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.27
-signing_key:
+rubygems_version: 4.0.18
 specification_version: 4
 summary: A simple toolkit for working with SAML.
 test_files: []