sirp 2.0.0 → 2.0.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (14) hide show
  1. checksums.yaml +5 -5
  2. data/.ruby-version +1 -0
  3. data/.travis.yml +4 -4
  4. data/CHANGELOG.md +8 -0
  5. data/README.md +4 -57
  6. data/RELEASE.md +0 -25
  7. data/lib/sirp.rb +0 -2
  8. data/lib/sirp/verifier.rb +10 -2
  9. data/lib/sirp/version.rb +1 -1
  10. data/sirp.gemspec +2 -4
  11. metadata +9 -59
  12. checksums.yaml.gz.sig +0 -0
  13. data.tar.gz.sig +0 -0
  14. metadata.gz.sig +0 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
- SHA1:
3
- metadata.gz: 5c52dff2045e6a63899115731fa0b6b47c211e83
4
- data.tar.gz: b39d228ae76c0afb76e228203025ef9c3ebfd33d
2
+ SHA256:
3
+ metadata.gz: 328294062ce7ee27d99e91e5449118300d85a1da742f1e3b86d5eac30c6ddee1
4
+ data.tar.gz: 8cb725290d951fb0cff234363d1365381466177b67c928a87491e3acd59a0fcc
5
5
  SHA512:
6
- metadata.gz: e13201e91458fd8f6d69e70482038a37007bd8faff54ca83c2b4ffa87be1f4906a49480ef3256152dde8b18fd1955566dbfc4b733ad1257fe159077aa8456f06
7
- data.tar.gz: 2f129346aa66933aecbdb7ed76d26e32ac67a423a03ae291e3d995c9e8c1de6a3786bfa1c7975556f3d0d648da5097a88635aa2eff8dae544df1c2c121a58fe0
6
+ metadata.gz: 771d1d636d5ef9d93842e9bdcee6bf66628c6143834d9e0eb46e7fdfa15ddb8c2f83b309367495652ce5b2e963ebb97814ca0baf1762346a2bcd53c2daeed041
7
+ data.tar.gz: 6827b625f7abc11d8d9c08a6f0ff456e6719b3b69fa74189e9ed868e0ca48cae58e30685662fdaed5bf83c7a640fb7b58e9eba302dca56325eda3c6189e327f9
data/.ruby-version ADDED
@@ -0,0 +1 @@
1
+ 2.4.0
data/.travis.yml CHANGED
@@ -1,6 +1,6 @@
1
1
  language: ruby
2
2
  rvm:
3
- - 2.1.0
4
- - 2.2.4
5
- - 2.3.1
6
- before_install: gem install bundler -v 1.12.1
3
+ - 2.3.3
4
+ - 2.4.0
5
+ - 2.6.3
6
+ before_install: gem install bundler -v 2.0.2
data/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # CHANGELOG
2
2
 
3
+ ## v2.0.1 (8/14/2019)
4
+
5
+ - Modernization of dependencies.
6
+ - Fix issue with string keys for the proof. Fixes https://github.com/grempe/sirp/issues/7
7
+ - Update supported Ruby versions in travis tests
8
+ - Remove the unused and deprecated rbnacl-libsodium dependency
9
+ - Removed RubyGem signing process and verification
10
+
3
11
  ## v2.0.0 (9/20/2016)
4
12
 
5
13
  Initial release after shake-down in a real app.
data/README.md CHANGED
@@ -1,7 +1,6 @@
1
1
  # SiRP : Secure (interoperable) Remote Password Authentication
2
2
 
3
3
  [![Gem Version](https://badge.fury.io/rb/sirp.svg)](https://badge.fury.io/rb/sirp)
4
- [![Dependency Status](https://gemnasium.com/badges/github.com/grempe/sirp.svg)](https://gemnasium.com/github.com/grempe/sirp)
5
4
  [![Build Status](https://travis-ci.org/grempe/sirp.svg?branch=master)](https://travis-ci.org/grempe/sirp)
6
5
  [![Coverage Status](https://coveralls.io/repos/github/grempe/sirp/badge.svg?branch=master)](https://coveralls.io/github/grempe/sirp?branch=master)
7
6
  [![Code Climate](https://codeclimate.com/github/grempe/sirp/badges/gpa.svg)](https://codeclimate.com/github/grempe/sirp)
@@ -56,13 +55,9 @@ You can check my documentation quality score at
56
55
 
57
56
  ## Supported Platforms
58
57
 
59
- SiRP is continuously integration tested on the following Ruby VMs:
58
+ SiRP is continuously integration tested on the versions of MRI Ruby found in the `.travis.yml` file.
60
59
 
61
- * MRI 2.1
62
- * MRI 2.2
63
- * MRI 2.3
64
-
65
- Ruby versions < 2.1 are not supported.
60
+ This may work with other Ruby versions, but they are not supported.
66
61
 
67
62
  ## Installation
68
63
 
@@ -73,6 +68,7 @@ gem 'sirp', '~> 2.0'
73
68
  ```
74
69
 
75
70
  And then execute:
71
+
76
72
  ```sh
77
73
  $ bundle
78
74
  ```
@@ -83,55 +79,6 @@ Or install it yourself as:
83
79
  $ gem install sirp
84
80
  ```
85
81
 
86
- ### Installation Security : Signed Ruby Gem
87
-
88
- The SiRP gem is cryptographically signed. To be sure the gem you install hasn’t
89
- been tampered with you can install it using the following method:
90
-
91
- Add my public key (if you haven’t already) as a trusted certificate
92
-
93
- ```
94
- # Caveat: Gem certificates are trusted globally, such that adding a
95
- # cert.pem for one gem automatically trusts all gems signed by that cert.
96
- gem cert --add <(curl -Ls https://raw.github.com/grempe/sirp/master/certs/gem-public_cert_grempe.pem)
97
- ```
98
-
99
- To install, it is possible to specify either `HighSecurity` or `MediumSecurity`
100
- mode. Since the `sirp` gem depends on one or more gems that are not cryptographically
101
- signed you will likely need to use `MediumSecurity`. You should receive a warning
102
- if any signed gem does not match its signature.
103
-
104
- ```
105
- # All dependent gems must be signed and verified.
106
- gem install sirp -P HighSecurity
107
- ```
108
-
109
- ```
110
- # All signed dependent gems must be verified.
111
- gem install sirp -P MediumSecurity
112
- ```
113
-
114
- ```
115
- # Same as above, except Bundler only recognizes
116
- # the long --trust-policy flag, not the short -P
117
- bundle --trust-policy MediumSecurity
118
- ```
119
-
120
- You can [learn more about security and signed Ruby Gems](http://guides.rubygems.org/security/).
121
-
122
- ### Installation Security : Signed Git Commits
123
-
124
- Most, if not all, of the commits and tags to the repository for this code are
125
- signed with my PGP/GPG code signing key. I have uploaded my code signing public
126
- keys to GitHub and you can now verify those signatures with the GitHub UI.
127
- See [this list of commits](https://github.com/grempe/sirp/commits/master)
128
- and look for the `Verified` tag next to each commit. You can click on that tag
129
- for additional information.
130
-
131
- You can also clone the repository and verify the signatures locally using your
132
- own GnuPG installation. You can find my certificates and read about how to conduct
133
- this verification at [https://www.rempe.us/keys/](https://www.rempe.us/keys/).
134
-
135
82
  ## Compatibility
136
83
 
137
84
  This implementation has been tested for compatibility with the following SRP-6a
@@ -217,7 +164,7 @@ API and is not intended to be a 'copy & paste' code sample since the
217
164
  client and server interaction is something left up to the implementer and likely
218
165
  different in every case.
219
166
 
220
- ``` ruby
167
+ ```ruby
221
168
  require 'sirp'
222
169
 
223
170
  username = 'user'
data/RELEASE.md CHANGED
@@ -27,34 +27,9 @@ $ vi CHANGELOG.md
27
27
  $ git add CHANGELOG.md
28
28
  ```
29
29
 
30
- ## Local Build and Install w/ Signed Gem
31
-
32
- The `build` step should ask for PEM passphrase to sign gem. If it does
33
- not ask it means that the signing cert is not present.
34
-
35
- Build:
36
-
37
- ```sh
38
- $ rake build
39
- Enter PEM pass phrase:
40
- sirp x.x.x built to pkg/sirp-x.x.x.gem
41
- ```
42
-
43
- Install locally w/ Cert:
44
-
45
- ```sh
46
- $ gem uninstall sirp
47
- $ rbenv rehash
48
- $ gem install pkg/tss-x.x.x.gem -P MediumSecurity
49
- Successfully installed sirp-x.x.x
50
- 1 gem installed
51
- ```
52
-
53
30
  ## Git Commit Version and CHANGELOG Changes, Tag and push to Github
54
31
 
55
32
  ```sh
56
- $ git add lib/tss/version.rb
57
- $ git add CHANGELOG.md
58
33
  $ git commit -m 'Bump version v2.0.0'
59
34
  $ git tag -s v2.0.0 -m "v2.0.0" SHA1_OF_COMMIT
60
35
  ```
data/lib/sirp.rb CHANGED
@@ -1,8 +1,6 @@
1
1
  require 'openssl'
2
2
  require 'digest'
3
- require 'rbnacl/libsodium'
4
3
  require 'sysrandom/securerandom'
5
- require 'hashie'
6
4
  require 'sirp/sirp'
7
5
  require 'sirp/parameters'
8
6
  require 'sirp/client'
data/lib/sirp/verifier.rb CHANGED
@@ -66,6 +66,14 @@ module SIRP
66
66
  }
67
67
  end
68
68
 
69
+ def symbolize_keys_deep!(h)
70
+ h.keys.each do |k|
71
+ ks = k.respond_to?(:to_sym) ? k.to_sym : k
72
+ h[ks] = h.delete k # Preserve order even when k == ks
73
+ symbolize_keys_deep! h[ks] if h[ks].kind_of? Hash
74
+ end
75
+ end
76
+
69
77
  #
70
78
  # Phase 2 : Step 1 : See Client#start_authentication
71
79
  #
@@ -86,8 +94,7 @@ module SIRP
86
94
  # @return [String, false] the H_AMK value in hex for the client, or false if verification failed
87
95
  def verify_session(proof, client_M)
88
96
  raise ArgumentError, 'proof must be a hash' unless proof.is_a?(Hash)
89
- # gracefully handle string or symbol keys
90
- Hashie.symbolize_keys!(proof)
97
+ symbolize_keys_deep!(proof)
91
98
  raise ArgumentError, 'proof must have required hash keys' unless proof.keys == [:A, :B, :b, :I, :s, :v]
92
99
  raise ArgumentError, 'client_M must be a string' unless client_M.is_a?(String)
93
100
  raise ArgumentError, 'client_M must be a hex string' unless client_M =~ /^[a-fA-F0-9]+$/
@@ -121,3 +128,4 @@ module SIRP
121
128
  end
122
129
  end
123
130
  end
131
+
data/lib/sirp/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module SIRP
2
- VERSION = '2.0.0'.freeze
2
+ VERSION = '2.0.1'.freeze
3
3
  end
data/sirp.gemspec CHANGED
@@ -35,15 +35,13 @@ Gem::Specification.new do |spec|
35
35
  spec.require_paths = ['lib']
36
36
 
37
37
  # See : https://bugs.ruby-lang.org/issues/9569
38
- spec.add_runtime_dependency 'rbnacl-libsodium', '~> 1.0'
39
38
  spec.add_runtime_dependency 'sysrandom', '~> 1.0'
40
- spec.add_runtime_dependency 'hashie', '~> 3.4'
41
39
 
42
40
  spec.add_development_dependency 'bundler'
43
41
  spec.add_development_dependency 'rake'
44
42
  spec.add_development_dependency 'rspec', '~> 3.4'
45
- spec.add_development_dependency 'pry', '~> 0.10'
43
+ spec.add_development_dependency 'pry', '~> 0.12'
46
44
  spec.add_development_dependency 'coveralls', '~> 0.8'
47
- spec.add_development_dependency 'coco', '~> 0.14'
45
+ spec.add_development_dependency 'coco', '~> 0.15'
48
46
  spec.add_development_dependency 'wwtd', '~> 1.3'
49
47
  end
metadata CHANGED
@@ -1,52 +1,16 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: sirp
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.0
4
+ version: 2.0.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Glenn Rempe
8
8
  - lamikae
9
9
  autorequire:
10
10
  bindir: exe
11
- cert_chain:
12
- - |
13
- -----BEGIN CERTIFICATE-----
14
- MIIDYDCCAkigAwIBAgIBATANBgkqhkiG9w0BAQUFADA7MQ4wDAYDVQQDDAVnbGVu
15
- bjEVMBMGCgmSJomT8ixkARkWBXJlbXBlMRIwEAYKCZImiZPyLGQBGRYCdXMwHhcN
16
- MTYwNDExMDI0NTU0WhcNMTcwNDExMDI0NTU0WjA7MQ4wDAYDVQQDDAVnbGVubjEV
17
- MBMGCgmSJomT8ixkARkWBXJlbXBlMRIwEAYKCZImiZPyLGQBGRYCdXMwggEiMA0G
18
- CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZqTH5Jf+D/W2B4BIiL49CpHa86rK/
19
- oT+v3xZwuEE92lJea+ygn3IAsidVTW47AKE6Lt3UqUkGQGKxsqH/Dhir08BqjLlD
20
- gBUozGZpM3B6uWZnD6QXLbOmZeGVDnwB/QDfzaawN1i3smlYxYT+KNLjl80aN3we
21
- /cHAWG7JG47AF/S91mYcg1WgZnDgZt9+RyVR1AsfYbM+SidOSoXEOHPCbuUxLKJb
22
- gj5ieCFhm5GNWEugvgiX/ruas+VHV0fF3fzjYlU2fZPTuQyB4UD5FWX4UqdsBf3w
23
- jB94TDBsJ3FVGPbggEhLGKd8pbQmBIOqXolGaqhs7dnuf5imu5mAXHC1AgMBAAGj
24
- bzBtMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBRfxEyosUbKjfFa
25
- j+gae2CcT3aFCTAZBgNVHREEEjAQgQ5nbGVubkByZW1wZS51czAZBgNVHRIEEjAQ
26
- gQ5nbGVubkByZW1wZS51czANBgkqhkiG9w0BAQUFAAOCAQEAzgK20+MNOknR9Kx6
27
- RisI3DsioCADjGldxY+INrwoTfPDVmNm4GdTYC+V+/BvxJw1RqHjEbuXSg0iibQC
28
- 4vN+th0Km7dnas/td1i+EKfGencfyQyecIaG9l3kbCkCWnldRtZ+BS5EfP2ML2u8
29
- fyCtze/Piovu8IwXL1W5kGZMnvzLmWxdqI3VPUou40n8F+EiMMLgd53kpzjtNOau
30
- 4W+mqVGOwlEGVSgI5+0SIsD8pvc62PlPWTv0kn1bcufKKCZmoVmpfbe3j4JpBInq
31
- zieXiXZSAojfFx9g91fKdIrlPbInHU/BaCxXSLBwvOM0drE+c2ue9X8gB55XAhzX
32
- 37oBiw==
33
- -----END CERTIFICATE-----
34
- date: 2016-09-21 00:00:00.000000000 Z
11
+ cert_chain: []
12
+ date: 2019-08-14 00:00:00.000000000 Z
35
13
  dependencies:
36
- - !ruby/object:Gem::Dependency
37
- name: rbnacl-libsodium
38
- requirement: !ruby/object:Gem::Requirement
39
- requirements:
40
- - - "~>"
41
- - !ruby/object:Gem::Version
42
- version: '1.0'
43
- type: :runtime
44
- prerelease: false
45
- version_requirements: !ruby/object:Gem::Requirement
46
- requirements:
47
- - - "~>"
48
- - !ruby/object:Gem::Version
49
- version: '1.0'
50
14
  - !ruby/object:Gem::Dependency
51
15
  name: sysrandom
52
16
  requirement: !ruby/object:Gem::Requirement
@@ -61,20 +25,6 @@ dependencies:
61
25
  - - "~>"
62
26
  - !ruby/object:Gem::Version
63
27
  version: '1.0'
64
- - !ruby/object:Gem::Dependency
65
- name: hashie
66
- requirement: !ruby/object:Gem::Requirement
67
- requirements:
68
- - - "~>"
69
- - !ruby/object:Gem::Version
70
- version: '3.4'
71
- type: :runtime
72
- prerelease: false
73
- version_requirements: !ruby/object:Gem::Requirement
74
- requirements:
75
- - - "~>"
76
- - !ruby/object:Gem::Version
77
- version: '3.4'
78
28
  - !ruby/object:Gem::Dependency
79
29
  name: bundler
80
30
  requirement: !ruby/object:Gem::Requirement
@@ -123,14 +73,14 @@ dependencies:
123
73
  requirements:
124
74
  - - "~>"
125
75
  - !ruby/object:Gem::Version
126
- version: '0.10'
76
+ version: '0.12'
127
77
  type: :development
128
78
  prerelease: false
129
79
  version_requirements: !ruby/object:Gem::Requirement
130
80
  requirements:
131
81
  - - "~>"
132
82
  - !ruby/object:Gem::Version
133
- version: '0.10'
83
+ version: '0.12'
134
84
  - !ruby/object:Gem::Dependency
135
85
  name: coveralls
136
86
  requirement: !ruby/object:Gem::Requirement
@@ -151,14 +101,14 @@ dependencies:
151
101
  requirements:
152
102
  - - "~>"
153
103
  - !ruby/object:Gem::Version
154
- version: '0.14'
104
+ version: '0.15'
155
105
  type: :development
156
106
  prerelease: false
157
107
  version_requirements: !ruby/object:Gem::Requirement
158
108
  requirements:
159
109
  - - "~>"
160
110
  - !ruby/object:Gem::Version
161
- version: '0.14'
111
+ version: '0.15'
162
112
  - !ruby/object:Gem::Dependency
163
113
  name: wwtd
164
114
  requirement: !ruby/object:Gem::Requirement
@@ -186,6 +136,7 @@ files:
186
136
  - ".coco.yml"
187
137
  - ".gitignore"
188
138
  - ".rubocop.yml"
139
+ - ".ruby-version"
189
140
  - ".travis.yml"
190
141
  - ".yardopts"
191
142
  - CHANGELOG.md
@@ -226,8 +177,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
226
177
  - !ruby/object:Gem::Version
227
178
  version: '0'
228
179
  requirements: []
229
- rubyforge_project:
230
- rubygems_version: 2.5.1
180
+ rubygems_version: 3.0.3
231
181
  signing_key:
232
182
  specification_version: 4
233
183
  summary: Secure (interoperable) Remote Password Auth (SRP-6a)
checksums.yaml.gz.sig DELETED
Binary file
data.tar.gz.sig DELETED
Binary file
metadata.gz.sig DELETED
@@ -1,3 +0,0 @@
1
- �� �_p���*L!'V��>?�#<��٥��5�:��w
2
- �ޘ�[�
3
- X�Z/���1��Q�8X�#x�i+��t�-��^�|�aO�q��g�#�g\pG�C��{R\uKY��m%���:������O�~��g���Z0j��M��j׎##c