security 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c157bfbd48ec870177f4a269569efc87edad32606bc9a7332b4d26644a13edf9
-  data.tar.gz: 275fbb21545cde55939d4512cec08d3c52bcff6a96d5300cb746941813685bed
+  metadata.gz: 9c1d9c484b22dfdf437dbd6af09ccb5b1c197c94c1d396496cd93b35c93ae9fc
+  data.tar.gz: 72f35ca3c02f14e83e75aed6b10048bf85f78b4f95176302a34af671a3807567
 SHA512:
-  metadata.gz: 0f8a12a0decc2ab2e277816af45860be94894bf2b01dc307e5f4d3b88251d8a6676dbf5c0469af862c19a73679a8d444eb1b8502345756ac3595c35d7e38e9fb
-  data.tar.gz: e2b77b3d17ec02afb5c99d1a69d638633ab83026777fbb7c883fe4c8ae4b6896f269f38df28208508e15af937ea549eb7a9f95ecd82a32472956b3334605b13c
+  metadata.gz: 40675d74911733f6316286730b6fe68dd4e28905f3dc00f7d260645de0707b905c0be386e42062601d8226b1e1240179c6607660dc349c92d08d982c83007f7a
+  data.tar.gz: 98ef0545f2155fc4c5e55d4969c62b2ed1ddb63634b633f7fec30cadb1726159be3cd7823a0ee0fa11cdc0b75210c7deb2df78bd24fa9a3a4d2b8f95ac1fcbbd

data/Gemfile

@@ -4,8 +4,7 @@ source 'https://rubygems.org'
 
 gem 'rake', '~> 13.4'
 gem 'rspec', '~> 3.13'
-gem 'rubocop', '~> 1.90'
-# simplecov 1.x requires Ruby >= 3.2; hold at 0.x while Ruby 3.1 is supported
-gem 'simplecov', '~> 0.22'
+gem 'rubocop', '~> 1.92'
+gem 'simplecov', '~> 1.2'
 
 gemspec

data/Gemfile.lock

@@ -1,18 +1,17 @@
 PATH
   remote: .
   specs:
-    security (0.3.0)
+    security (0.4.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.3)
     diff-lcs (1.6.2)
-    docile (1.4.1)
-    json (3.0.2)
+    json (3.1.0)
     language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
-    parallel (2.2.0)
+    parallel (1.28.0)
     parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
@@ -20,7 +19,7 @@ GEM
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    regexp_parser (2.12.0)
+    regexp_parser (2.13.1)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -34,14 +33,14 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
-    rubocop (1.91.0)
+    rubocop (1.92.0)
       json (>= 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
       parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
+      regexp_parser (>= 2.11.3, < 3.0)
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
@@ -49,26 +48,20 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.2)
-    simplecov_json_formatter (0.1.4)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
+    simplecov (1.2.0)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
 
 PLATFORMS
   ruby
-  x86_64-linux
 
 DEPENDENCIES
   rake (~> 13.4)
   rspec (~> 3.13)
-  rubocop (~> 1.90)
+  rubocop (~> 1.92)
   security!
-  simplecov (~> 0.22)
+  simplecov (~> 1.2)
 
 BUNDLED WITH
-   2.6.9
+   2.7.2

data/README.md

@@ -34,6 +34,25 @@ Security::InternetPassword.find(server: "example.com", keychain: keychain)
 Security::InternetPassword.delete(server: "example.com", keychain: keychain)
 ```
 
+Keychains themselves:
+
+```ruby
+keychain = Security::Keychain.create("/path/to/build.keychain-db", "p4ssw0rd")
+keychain.update_settings(timeout: 3600, lock_when_sleeping: true)
+keychain.set_key_partition_list("p4ssw0rd")
+
+Security::Keychain.set_search_list(Security::Keychain.list + [keychain])
+Security::Keychain.set_default_keychain(keychain)
+```
+
+## Certificates and identities
+
+```ruby
+Security::Certificate.import("/path/to/identity.p12", keychain: keychain, password: "p12 password")
+Security::Certificate.find(name: "Developer ID Installer", keychain: keychain).map(&:sha1)
+Security::Identity.find(keychain: keychain).map(&:name) #=> ["Apple Development: Jane Appleseed (TEAMID)"]
+```
+
 ## Errors
 
 The `security` command line tool reports failures through its exit status, and
@@ -55,12 +74,20 @@ rescue Security::Error => e
 end
 ```
 
-`Keychain.list`, `Keychain.default_keychain` and `Keychain.login_keychain`
-raise `Security::Error` on failure in the same way.
+`Keychain.list`, `Keychain.default_keychain`, `Keychain.login_keychain`,
+`Keychain.create`, `Certificate.find` and `Identity.find` raise `Security::Error`
+on failure in the same way. `Certificate.find` and `Identity.find` return an
+empty array when nothing matched.
+
+The methods that change the keychain — `add`, `delete` and the `Keychain`
+setters — return `true` or `false` and print what the tool reported, the way
+`Kernel#system` does. Two raise instead, because the caller needs to know why
+they failed:
 
-The methods that change the keychain — `add`, `delete`, and the `Keychain`
-instance methods — return `true` or `false` and print what the tool reported,
-the way `Kernel#system` does.
+- `Certificate.import` raises `Security::DuplicateItemError` when the keychain
+  already holds the item, and `Security::Error` for any other failure.
+- `Keychain#set_key_partition_list` raises `Security::Error`, most often for a
+  wrong keychain password.
 
 ## License
 

data/UPGRADE.md

@@ -1,5 +1,23 @@
 # Upgrade Guide
 
+## Upgrading from 0.3 to 0.4
+
+Ruby 3.2 is now the minimum.
+
+`Security::Command.run` and `Security::Command.relay` no longer go through a shell. They take the program and its arguments separately, so nothing needs escaping:
+
+```ruby
+# 0.3
+Security::Command.run("security show-keychain-info #{path.shellescape}")
+
+# 0.4
+Security::Command.run("security", "show-keychain-info", path)
+```
+
+A single string is now the name of the program to run, so a 0.3 command line fails as a missing command, with exit status 127.
+
+Passwords no longer appear in the arguments of the `security` process, where any local user could read them with `ps`: the commands that take one (adding a password, creating, unlocking or setting the partition list of a keychain, importing with a passphrase) are sent to `security -i` on stdin. A password or other argument containing a line break now raises `ArgumentError`, and so does a command longer than `security -i` reads (4096 bytes, 32 arguments).
+
 ## Upgrading from 0.2 to 0.3
 
 In previous versions, `find` attempted to detect failures by searching for a `security: ` prefix in the output. This approach was unreliable: certain errors (like ACL issues) produced no output, while others (like malformed requests) returned a usage banner. These cases would incorrectly result in a `Password` object with `nil` attributes, making it impossible for callers to distinguish a failed request from a successful one. Additionally, failures that *did* have the prefix returned `nil`, which was indistinguishable from a missing item.

data/lib/security/certificate.rb

@@ -1,10 +1,40 @@
 # frozen_string_literal: true
 
+require 'openssl'
+
 module Security
   # :nodoc:
   class Certificate
+    # The tools allowed to use an imported item without asking the user. A
+    # keychain prompt in the middle of a build is a hang rather than a failure,
+    # which is why these are named rather than left to the default.
+    DEFAULT_TRUSTED_APPLICATIONS = [
+      '/usr/bin/codesign',
+      '/usr/bin/security',
+      '/usr/bin/productbuild',
+      '/usr/bin/productsign'
+    ].freeze
+
+    # What `security import` reports for an item the keychain already holds.
+    ALREADY_EXISTS = 'The specified item already exists in the keychain'
+
+    PEM = /-----BEGIN CERTIFICATE-----\n.*?-----END CERTIFICATE-----\n/m
+
+    attr_reader :sha1, :sha256, :pem
+
     private_class_method :new
 
+    def initialize(sha1:, sha256:, pem:)
+      @sha1 = sha1
+      @sha256 = sha256
+      @pem = pem
+    end
+
+    # The subject's common name, which is what the keychain shows as its name.
+    def name
+      OpenSSL::X509::Certificate.new(pem).subject.to_a.find { |key, _value, _type| key == 'CN' }&.at(1)
+    end
+
     def delete!
       raise NotImplementedError
     end
@@ -14,8 +44,46 @@ module Security
     end
 
     class << self
-      def find
-        raise NotImplementedError
+      # Every certificate whose name contains `name`. Finding none is not a
+      # failure: `security` prints nothing and exits 0.
+      def find(name:, keychain: nil)
+        command = ['security', 'find-certificate', '-a', '-c', name.to_s, '-Z', '-p']
+        command << filename_for(keychain) if keychain
+
+        result = Command.run(*command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        certificates_from_output(result.stdout)
+      end
+
+      # Imports a certificate or identity file into `keychain`. `password` is
+      # the one protecting the file, not the keychain's. Raises
+      # DuplicateItemError when the keychain already holds it.
+      def import(path, keychain:, password: nil, format: nil,
+                 trusted_applications: DEFAULT_TRUSTED_APPLICATIONS)
+        command = ['security', 'import', path.to_s, '-k', filename_for(keychain)]
+        command += ['-P', password.to_s] if password
+        command += ['-f', format.to_s] if format
+        trusted_applications.each { |application| command += ['-T', application] }
+
+        result = password ? Command.run_interactive(*command.drop(1)) : Command.run(*command)
+        return true if result.success?
+
+        # Every failure exits 1, so only the message tells a duplicate apart.
+        error = result.stderr.include?(ALREADY_EXISTS) ? DuplicateItemError : Error
+        raise error.new(result.exitstatus, result.stderr)
+      end
+
+      private
+
+      def certificates_from_output(output)
+        output.scan(/^SHA-256 hash: (\h+)\nSHA-1 hash: (\h+)\n(#{PEM})/m).map do |sha256, sha1, pem|
+          new(sha1: sha1, sha256: sha256, pem: pem)
+        end
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
       end
     end
   end

data/lib/security/command.rb

@@ -24,14 +24,27 @@ module Security
       end
     end
 
+    # What `security -i` reads at most: bytes per line, and arguments per command.
+    INTERACTIVE_LINE_LENGTH = 4096
+    INTERACTIVE_ARGUMENTS = 32
+
     module_function
 
     # Runs a `security` subcommand and captures what it produced. A missing
     # `security` is a failed result rather than an exception: the tool is only
     # present on macOS, and callers elsewhere should see the same failure they
     # would get from a keychain that could not answer.
-    def run(command)
-      Result.new(*Open3.capture3(command))
+    #
+    # Never through a shell, so a path containing a space or a quote needs no
+    # escaping:
+    #
+    #   run("security", "show-keychain-info", path)
+    def run(program, *, stdin: nil)
+      # [program, program] rather than program: Ruby hands a lone string with
+      # shell metacharacters to a shell.
+      # stdin_data only when there is some, so a command without a password is
+      # run, and can be stubbed, exactly as before.
+      Result.new(*Open3.capture3([program, program], *, **(stdin ? { stdin_data: stdin } : {})))
     rescue Errno::ENOENT => e
       # Nothing ran, but the child Ruby forked exited 127 before exec, which is
       # what a shell reports for a missing command, and what this library
@@ -42,8 +55,50 @@ module Security
     # Runs a `security` subcommand and lets the caller see what it said. The
     # tool reports on stderr whether or not it succeeded: show-keychain-info
     # prints its result there on exit 0.
-    def relay(command)
-      result = run(command)
+    def relay(*command)
+      relayed(run(*command))
+    end
+
+    # Runs a `security` subcommand that takes a password: through `security -i`,
+    # which reads the command from stdin, so the password never shows in the
+    # arguments, which any local user can read with `ps`. Without -p (or -P),
+    # the tool would instead read it from the terminal when there is one, or
+    # import would ask through a dialog.
+    #
+    #   run_interactive("unlock-keychain", "-p", password, path)
+    def run_interactive(subcommand, *)
+      result = run('security', '-i', stdin: interactive_input(subcommand, *))
+      # -i adds a line naming the command and its status after any error.
+      result.stderr = result.stderr.sub(/^#{Regexp.escape(subcommand)}: returned -?\d+\n\z/, '')
+      result
+    end
+
+    def relay_interactive(*command)
+      relayed(run_interactive(*command))
+    end
+
+    # One command line for `security -i`: every argument double quoted, with
+    # backslashes and double quotes escaped. A line break would end the command,
+    # and a longer line or more arguments than the tool reads would be cut.
+    def interactive_input(*command)
+      if command.size > INTERACTIVE_ARGUMENTS
+        raise ArgumentError, "security -i takes at most #{INTERACTIVE_ARGUMENTS} arguments"
+      end
+
+      line = command.map do |argument|
+        argument = argument.to_s
+        raise ArgumentError, 'An argument for security -i cannot contain a line break' if argument.match?(/[\r\n]/)
+
+        %("#{argument.gsub(/[\\"]/) { |character| "\\#{character}" }}")
+      end.join(' ')
+      if line.bytesize >= INTERACTIVE_LINE_LENGTH - 1
+        raise ArgumentError, "A command for security -i must be shorter than #{INTERACTIVE_LINE_LENGTH} bytes"
+      end
+
+      "#{line}\n"
+    end
+
+    def relayed(result)
       warn result.stderr.chomp unless result.stderr.empty?
 
       result

data/lib/security/error.rb

@@ -13,4 +13,7 @@ module Security
       super(details.empty? ? "`security` exited with status #{status}" : "#{details} (status #{status})")
     end
   end
+
+  # Raised when the keychain already holds the item being added.
+  class DuplicateItemError < Error; end
 end

data/lib/security/identity.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Security
+  # :nodoc:
+  class Identity
+    attr_reader :sha1, :name, :status
+
+    private_class_method :new
+
+    # `status` is what `security` prints after the name for an identity it
+    # considers invalid, such as CSSMERR_TP_CERT_REVOKED, or nil.
+    def initialize(sha1, name, status = nil)
+      @sha1 = sha1
+      @name = name
+      @status = status
+    end
+
+    class << self
+      # The identities `security` can see, newest tool output shaped like:
+      #
+      #   1) A1B2... "Apple Development: someone (TEAM)"
+      #      1 valid identities found
+      #
+      # `valid_only` drops the ones the tool marks unusable. `keychain` limits
+      # the search to one; without it `security` searches the user's default,
+      # which is what `find-identity` does and why callers that do not name a
+      # keychain get whatever happens to be in the login one.
+      def find(policy: 'codesigning', valid_only: true, keychain: nil)
+        command = %w[security find-identity]
+        command << '-v' if valid_only
+        command += ['-p', policy.to_s] if policy
+        command << filename_for(keychain) if keychain
+
+        result = Command.run(*command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        identities_from_output(result.stdout)
+      end
+
+      private
+
+      # Finding none is not a failure: `security` prints "0 valid identities
+      # found" and exits 0.
+      def identities_from_output(output)
+        output.scan(/^\s*\d+\)\s+(\h+)\s+"(.*)"(?:\s+\(([^()]*)\))?\s*$/).map do |sha1, name, status|
+          new(sha1, name, status)
+        end
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
+      end
+    end
+  end
+end

data/lib/security/keychain.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module Security
   # :nodoc:
   class Keychain
     DOMAINS = %i[user system common dynamic].freeze
 
+    # The partition IDs that let Apple's signing tools use an imported key
+    # without a keychain prompt.
+    DEFAULT_PARTITION_IDS = %w[apple-tool: apple: codesign:].freeze
+
     attr_reader :filename
 
     def initialize(filename)
@@ -14,52 +16,97 @@ module Security
     end
 
     def info
-      Command.relay(%(security show-keychain-info #{@filename.shellescape})).success?
+      Command.relay('security', 'show-keychain-info', @filename).success?
     end
 
     def lock
-      Command.relay(%(security lock-keychain #{@filename.shellescape})).success?
+      Command.relay('security', 'lock-keychain', @filename).success?
     end
 
     def unlock(password)
-      Command.relay(%(security unlock-keychain -p #{password.shellescape} #{@filename.shellescape})).success?
+      Command.relay_interactive('unlock-keychain', '-p', password.to_s, @filename).success?
     end
 
     def delete
-      Command.relay(%(security delete-keychain #{@filename.shellescape})).success?
+      Command.relay('security', 'delete-keychain', @filename).success?
+    end
+
+    # With no options the keychain never locks on its own.
+    def update_settings(timeout: nil, lock_when_sleeping: false, lock_after_timeout: false)
+      command = %w[security set-keychain-settings]
+      command += ['-t', timeout.to_s] if timeout
+      command << '-l' if lock_when_sleeping
+      command << '-u' if lock_after_timeout
+
+      Command.relay(*command, @filename).success?
+    end
+
+    # Raises rather than returning false: a wrong keychain password is the usual
+    # failure, and the caller needs the output to tell it from the others.
+    def set_key_partition_list(password, partition_ids: DEFAULT_PARTITION_IDS)
+      result = Command.run_interactive('set-key-partition-list', '-S', partition_ids.join(','), '-s',
+                                       '-k', password.to_s, @filename)
+      raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+      true
     end
 
     class << self
+      # Raises on failure, like the other class methods that answer with a keychain.
       def create(filename, password)
-        raise NotImplementedError
+        result = Command.run_interactive('create-keychain', '-p', password.to_s, filename.to_s)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        new(filename.to_s)
       end
 
       def list(domain = :user)
-        raise ArgumentError, "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
+        keychains_from_command('security', 'list-keychains', '-d', domain_name(domain))
+      end
 
-        keychains_from_command("security list-keychains -d #{domain}")
+      def set_search_list(keychains, domain: :user)
+        Command.relay('security', 'list-keychains', '-d', domain_name(domain), '-s',
+                      *keychains.map { |keychain| filename_for(keychain) }).success?
       end
 
       def lock
-        Command.relay(%(security lock-keychain -a)).success?
+        Command.relay('security', 'lock-keychain', '-a').success?
       end
 
       def unlock(password)
-        Command.relay(%(security unlock-keychain -p #{password.shellescape})).success?
+        Command.relay_interactive('unlock-keychain', '-p', password.to_s).success?
       end
 
       def default_keychain
-        keychains_from_command('security default-keychain').first
+        keychains_from_command('security', 'default-keychain').first
+      end
+
+      def set_default_keychain(keychain, domain: :user)
+        Command.relay('security', 'default-keychain', '-d', domain_name(domain), '-s', filename_for(keychain)).success?
       end
 
       def login_keychain
-        keychains_from_command('security login-keychain').first
+        keychains_from_command('security', 'login-keychain').first
+      end
+
+      def supports_key_partition_list?
+        Command.run('security', '-h').stdout.include?('set-key-partition-list')
       end
 
       private
 
-      def keychains_from_command(command)
-        result = Command.run(command)
+      def domain_name(domain)
+        raise ArgumentError, "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
+
+        domain.to_s
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
+      end
+
+      def keychains_from_command(*command)
+        result = Command.run(*command)
         raise Error.new(result.exitstatus, result.stderr) unless result.success?
 
         keychains_from_output(result.stdout)

data/lib/security/password.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module Security
   # :nodoc:
   class Password
@@ -22,8 +20,8 @@ module Security
     class << self
       private
 
-      def password_from_command(command)
-        result = Command.run(command)
+      def password_from_command(*command)
+        result = Command.run(*command)
         return nil if result.exitstatus == ITEM_NOT_FOUND
         raise Error.new(result.exitstatus, result.stderr) unless result.success?
 
@@ -62,18 +60,16 @@ module Security
         flags[:G] ||= flags.delete(:value)
         flags[:j] ||= flags.delete(:comment)
 
-        arguments = flags.compact.collect { |k, v| "-#{k} #{v.shellescape}".strip }
+        arguments = flags.compact.flat_map { |k, v| ["-#{k}", v.to_s] }
         arguments << filename_for_keychain(keychain) if keychain
 
-        arguments.join(' ')
+        arguments
       end
 
       # `security` takes the keychain to act on as a trailing argument. Without
       # one it uses the default keychain, or the default search list.
       def filename_for_keychain(keychain)
-        filename = keychain.is_a?(Keychain) ? keychain.filename : keychain
-
-        filename.shellescape
+        keychain.is_a?(Keychain) ? keychain.filename : keychain.to_s
       end
 
       def decode_hex_blob(string)
@@ -90,15 +86,15 @@ module Security
         options[:s] = service
         options[:w] = password
 
-        Command.relay("security add-generic-password #{flags_for_options(options)}").success?
+        Command.relay_interactive('add-generic-password', *flags_for_options(options)).success?
       end
 
       def find(options)
-        password_from_command("security find-generic-password -g #{flags_for_options(options)}")
+        password_from_command('security', 'find-generic-password', '-g', *flags_for_options(options))
       end
 
       def delete(options)
-        Command.run("security delete-generic-password #{flags_for_options(options)}").success?
+        Command.run('security', 'delete-generic-password', *flags_for_options(options)).success?
       end
 
       private
@@ -117,15 +113,15 @@ module Security
         options[:a] = account
         options[:s] = server
         options[:w] = password
-        Command.relay("security add-internet-password #{flags_for_options(options)}").success?
+        Command.relay_interactive('add-internet-password', *flags_for_options(options)).success?
       end
 
       def find(options)
-        password_from_command("security find-internet-password -g #{flags_for_options(options)}")
+        password_from_command('security', 'find-internet-password', '-g', *flags_for_options(options))
       end
 
       def delete(options)
-        Command.run("security delete-internet-password #{flags_for_options(options)}").success?
+        Command.run('security', 'delete-internet-password', *flags_for_options(options)).success?
       end
 
       private

data/lib/security/version.rb

@@ -2,5 +2,5 @@
 
 # :nodoc:
 module Security
-  VERSION = '0.3.0'
+  VERSION = '0.4.0'
 end

data/lib/security.rb

@@ -5,4 +5,5 @@ require 'security/error'
 require 'security/command'
 require 'security/keychain'
 require 'security/certificate'
+require 'security/identity'
 require 'security/password'

data/security.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.files         = Dir['./**/*'].grep_v(%r{\./(bin|log|pkg|script|spec|test|vendor)})
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   s.require_paths = ['lib']
-  s.required_ruby_version = '>= 3.1.0'
+  s.required_ruby_version = '>= 3.2.0'
 
   s.metadata['rubygems_mfa_required'] = 'true'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: security
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Josh Holtz
@@ -26,6 +26,7 @@ files:
 - "./lib/security/certificate.rb"
 - "./lib/security/command.rb"
 - "./lib/security/error.rb"
+- "./lib/security/identity.rb"
 - "./lib/security/keychain.rb"
 - "./lib/security/password.rb"
 - "./lib/security/version.rb"
@@ -42,7 +43,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.1.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="