sirp 2.0.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. checksums.yaml +5 -5
  2. data/.ruby-version +1 -0
  3. data/.travis.yml +4 -4
  4. data/CHANGELOG.md +8 -0
  5. data/README.md +4 -57
  6. data/RELEASE.md +0 -25
  7. data/lib/sirp.rb +0 -2
  8. data/lib/sirp/verifier.rb +10 -2
  9. data/lib/sirp/version.rb +1 -1
  10. data/sirp.gemspec +2 -4
  11. metadata +9 -59
  12. checksums.yaml.gz.sig +0 -0
  13. data.tar.gz.sig +0 -0
  14. metadata.gz.sig +0 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
- SHA1:
3
- metadata.gz: 5c52dff2045e6a63899115731fa0b6b47c211e83
4
- data.tar.gz: b39d228ae76c0afb76e228203025ef9c3ebfd33d
2
+ SHA256:
3
+ metadata.gz: 328294062ce7ee27d99e91e5449118300d85a1da742f1e3b86d5eac30c6ddee1
4
+ data.tar.gz: 8cb725290d951fb0cff234363d1365381466177b67c928a87491e3acd59a0fcc
5
5
  SHA512:
6
- metadata.gz: e13201e91458fd8f6d69e70482038a37007bd8faff54ca83c2b4ffa87be1f4906a49480ef3256152dde8b18fd1955566dbfc4b733ad1257fe159077aa8456f06
7
- data.tar.gz: 2f129346aa66933aecbdb7ed76d26e32ac67a423a03ae291e3d995c9e8c1de6a3786bfa1c7975556f3d0d648da5097a88635aa2eff8dae544df1c2c121a58fe0
6
+ metadata.gz: 771d1d636d5ef9d93842e9bdcee6bf66628c6143834d9e0eb46e7fdfa15ddb8c2f83b309367495652ce5b2e963ebb97814ca0baf1762346a2bcd53c2daeed041
7
+ data.tar.gz: 6827b625f7abc11d8d9c08a6f0ff456e6719b3b69fa74189e9ed868e0ca48cae58e30685662fdaed5bf83c7a640fb7b58e9eba302dca56325eda3c6189e327f9
data/.ruby-version ADDED
@@ -0,0 +1 @@
1
+ 2.4.0
data/.travis.yml CHANGED
@@ -1,6 +1,6 @@
1
1
  language: ruby
2
2
  rvm:
3
- - 2.1.0
4
- - 2.2.4
5
- - 2.3.1
6
- before_install: gem install bundler -v 1.12.1
3
+ - 2.3.3
4
+ - 2.4.0
5
+ - 2.6.3
6
+ before_install: gem install bundler -v 2.0.2
data/CHANGELOG.md CHANGED
@@ -1,5 +1,13 @@
1
1
  # CHANGELOG
2
2
 
3
+ ## v2.0.1 (8/14/2019)
4
+
5
+ - Modernization of dependencies.
6
+ - Fix issue with string keys for the proof. Fixes https://github.com/grempe/sirp/issues/7
7
+ - Update supported Ruby versions in travis tests
8
+ - Remove the unused and deprecated rbnacl-libsodium dependency
9
+ - Removed RubyGem signing process and verification
10
+
3
11
  ## v2.0.0 (9/20/2016)
4
12
 
5
13
  Initial release after shake-down in a real app.
data/README.md CHANGED
@@ -1,7 +1,6 @@
1
1
  # SiRP : Secure (interoperable) Remote Password Authentication
2
2
 
3
3
  [![Gem Version](https://badge.fury.io/rb/sirp.svg)](https://badge.fury.io/rb/sirp)
4
- [![Dependency Status](https://gemnasium.com/badges/github.com/grempe/sirp.svg)](https://gemnasium.com/github.com/grempe/sirp)
5
4
  [![Build Status](https://travis-ci.org/grempe/sirp.svg?branch=master)](https://travis-ci.org/grempe/sirp)
6
5
  [![Coverage Status](https://coveralls.io/repos/github/grempe/sirp/badge.svg?branch=master)](https://coveralls.io/github/grempe/sirp?branch=master)
7
6
  [![Code Climate](https://codeclimate.com/github/grempe/sirp/badges/gpa.svg)](https://codeclimate.com/github/grempe/sirp)
@@ -56,13 +55,9 @@ You can check my documentation quality score at
56
55
 
57
56
  ## Supported Platforms
58
57
 
59
- SiRP is continuously integration tested on the following Ruby VMs:
58
+ SiRP is continuously integration tested on the versions of MRI Ruby found in the `.travis.yml` file.
60
59
 
61
- * MRI 2.1
62
- * MRI 2.2
63
- * MRI 2.3
64
-
65
- Ruby versions < 2.1 are not supported.
60
+ This may work with other Ruby versions, but they are not supported.
66
61
 
67
62
  ## Installation
68
63
 
@@ -73,6 +68,7 @@ gem 'sirp', '~> 2.0'
73
68
  ```
74
69
 
75
70
  And then execute:
71
+
76
72
  ```sh
77
73
  $ bundle
78
74
  ```
@@ -83,55 +79,6 @@ Or install it yourself as:
83
79
  $ gem install sirp
84
80
  ```
85
81
 
86
- ### Installation Security : Signed Ruby Gem
87
-
88
- The SiRP gem is cryptographically signed. To be sure the gem you install hasn’t
89
- been tampered with you can install it using the following method:
90
-
91
- Add my public key (if you haven’t already) as a trusted certificate
92
-
93
- ```
94
- # Caveat: Gem certificates are trusted globally, such that adding a
95
- # cert.pem for one gem automatically trusts all gems signed by that cert.
96
- gem cert --add <(curl -Ls https://raw.github.com/grempe/sirp/master/certs/gem-public_cert_grempe.pem)
97
- ```
98
-
99
- To install, it is possible to specify either `HighSecurity` or `MediumSecurity`
100
- mode. Since the `sirp` gem depends on one or more gems that are not cryptographically
101
- signed you will likely need to use `MediumSecurity`. You should receive a warning
102
- if any signed gem does not match its signature.
103
-
104
- ```
105
- # All dependent gems must be signed and verified.
106
- gem install sirp -P HighSecurity
107
- ```
108
-
109
- ```
110
- # All signed dependent gems must be verified.
111
- gem install sirp -P MediumSecurity
112
- ```
113
-
114
- ```
115
- # Same as above, except Bundler only recognizes
116
- # the long --trust-policy flag, not the short -P
117
- bundle --trust-policy MediumSecurity
118
- ```
119
-
120
- You can [learn more about security and signed Ruby Gems](http://guides.rubygems.org/security/).
121
-
122
- ### Installation Security : Signed Git Commits
123
-
124
- Most, if not all, of the commits and tags to the repository for this code are
125
- signed with my PGP/GPG code signing key. I have uploaded my code signing public
126
- keys to GitHub and you can now verify those signatures with the GitHub UI.
127
- See [this list of commits](https://github.com/grempe/sirp/commits/master)
128
- and look for the `Verified` tag next to each commit. You can click on that tag
129
- for additional information.
130
-
131
- You can also clone the repository and verify the signatures locally using your
132
- own GnuPG installation. You can find my certificates and read about how to conduct
133
- this verification at [https://www.rempe.us/keys/](https://www.rempe.us/keys/).
134
-
135
82
  ## Compatibility
136
83
 
137
84
  This implementation has been tested for compatibility with the following SRP-6a
@@ -217,7 +164,7 @@ API and is not intended to be a 'copy & paste' code sample since the
217
164
  client and server interaction is something left up to the implementer and likely
218
165
  different in every case.
219
166
 
220
- ``` ruby
167
+ ```ruby
221
168
  require 'sirp'
222
169
 
223
170
  username = 'user'
data/RELEASE.md CHANGED
@@ -27,34 +27,9 @@ $ vi CHANGELOG.md
27
27
  $ git add CHANGELOG.md
28
28
  ```
29
29
 
30
- ## Local Build and Install w/ Signed Gem
31
-
32
- The `build` step should ask for PEM passphrase to sign gem. If it does
33
- not ask it means that the signing cert is not present.
34
-
35
- Build:
36
-
37
- ```sh
38
- $ rake build
39
- Enter PEM pass phrase:
40
- sirp x.x.x built to pkg/sirp-x.x.x.gem
41
- ```
42
-
43
- Install locally w/ Cert:
44
-
45
- ```sh
46
- $ gem uninstall sirp
47
- $ rbenv rehash
48
- $ gem install pkg/tss-x.x.x.gem -P MediumSecurity
49
- Successfully installed sirp-x.x.x
50
- 1 gem installed
51
- ```
52
-
53
30
  ## Git Commit Version and CHANGELOG Changes, Tag and push to Github
54
31
 
55
32
  ```sh
56
- $ git add lib/tss/version.rb
57
- $ git add CHANGELOG.md
58
33
  $ git commit -m 'Bump version v2.0.0'
59
34
  $ git tag -s v2.0.0 -m "v2.0.0" SHA1_OF_COMMIT
60
35
  ```
data/lib/sirp.rb CHANGED
@@ -1,8 +1,6 @@
1
1
  require 'openssl'
2
2
  require 'digest'
3
- require 'rbnacl/libsodium'
4
3
  require 'sysrandom/securerandom'
5
- require 'hashie'
6
4
  require 'sirp/sirp'
7
5
  require 'sirp/parameters'
8
6
  require 'sirp/client'
data/lib/sirp/verifier.rb CHANGED
@@ -66,6 +66,14 @@ module SIRP
66
66
  }
67
67
  end
68
68
 
69
+ def symbolize_keys_deep!(h)
70
+ h.keys.each do |k|
71
+ ks = k.respond_to?(:to_sym) ? k.to_sym : k
72
+ h[ks] = h.delete k # Preserve order even when k == ks
73
+ symbolize_keys_deep! h[ks] if h[ks].kind_of? Hash
74
+ end
75
+ end
76
+
69
77
  #
70
78
  # Phase 2 : Step 1 : See Client#start_authentication
71
79
  #
@@ -86,8 +94,7 @@ module SIRP
86
94
  # @return [String, false] the H_AMK value in hex for the client, or false if verification failed
87
95
  def verify_session(proof, client_M)
88
96
  raise ArgumentError, 'proof must be a hash' unless proof.is_a?(Hash)
89
- # gracefully handle string or symbol keys
90
- Hashie.symbolize_keys!(proof)
97
+ symbolize_keys_deep!(proof)
91
98
  raise ArgumentError, 'proof must have required hash keys' unless proof.keys == [:A, :B, :b, :I, :s, :v]
92
99
  raise ArgumentError, 'client_M must be a string' unless client_M.is_a?(String)
93
100
  raise ArgumentError, 'client_M must be a hex string' unless client_M =~ /^[a-fA-F0-9]+$/
@@ -121,3 +128,4 @@ module SIRP
121
128
  end
122
129
  end
123
130
  end
131
+
data/lib/sirp/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module SIRP
2
- VERSION = '2.0.0'.freeze
2
+ VERSION = '2.0.1'.freeze
3
3
  end
data/sirp.gemspec CHANGED
@@ -35,15 +35,13 @@ Gem::Specification.new do |spec|
35
35
  spec.require_paths = ['lib']
36
36
 
37
37
  # See : https://bugs.ruby-lang.org/issues/9569
38
- spec.add_runtime_dependency 'rbnacl-libsodium', '~> 1.0'
39
38
  spec.add_runtime_dependency 'sysrandom', '~> 1.0'
40
- spec.add_runtime_dependency 'hashie', '~> 3.4'
41
39
 
42
40
  spec.add_development_dependency 'bundler'
43
41
  spec.add_development_dependency 'rake'
44
42
  spec.add_development_dependency 'rspec', '~> 3.4'
45
- spec.add_development_dependency 'pry', '~> 0.10'
43
+ spec.add_development_dependency 'pry', '~> 0.12'
46
44
  spec.add_development_dependency 'coveralls', '~> 0.8'
47
- spec.add_development_dependency 'coco', '~> 0.14'
45
+ spec.add_development_dependency 'coco', '~> 0.15'
48
46
  spec.add_development_dependency 'wwtd', '~> 1.3'
49
47
  end
metadata CHANGED
@@ -1,52 +1,16 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: sirp
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.0
4
+ version: 2.0.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Glenn Rempe
8
8
  - lamikae
9
9
  autorequire:
10
10
  bindir: exe
11
- cert_chain:
12
- - |
13
- -----BEGIN CERTIFICATE-----
14
- MIIDYDCCAkigAwIBAgIBATANBgkqhkiG9w0BAQUFADA7MQ4wDAYDVQQDDAVnbGVu
15
- bjEVMBMGCgmSJomT8ixkARkWBXJlbXBlMRIwEAYKCZImiZPyLGQBGRYCdXMwHhcN
16
- MTYwNDExMDI0NTU0WhcNMTcwNDExMDI0NTU0WjA7MQ4wDAYDVQQDDAVnbGVubjEV
17
- MBMGCgmSJomT8ixkARkWBXJlbXBlMRIwEAYKCZImiZPyLGQBGRYCdXMwggEiMA0G
18
- CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDZqTH5Jf+D/W2B4BIiL49CpHa86rK/
19
- oT+v3xZwuEE92lJea+ygn3IAsidVTW47AKE6Lt3UqUkGQGKxsqH/Dhir08BqjLlD
20
- gBUozGZpM3B6uWZnD6QXLbOmZeGVDnwB/QDfzaawN1i3smlYxYT+KNLjl80aN3we
21
- /cHAWG7JG47AF/S91mYcg1WgZnDgZt9+RyVR1AsfYbM+SidOSoXEOHPCbuUxLKJb
22
- gj5ieCFhm5GNWEugvgiX/ruas+VHV0fF3fzjYlU2fZPTuQyB4UD5FWX4UqdsBf3w
23
- jB94TDBsJ3FVGPbggEhLGKd8pbQmBIOqXolGaqhs7dnuf5imu5mAXHC1AgMBAAGj
24
- bzBtMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQWBBRfxEyosUbKjfFa
25
- j+gae2CcT3aFCTAZBgNVHREEEjAQgQ5nbGVubkByZW1wZS51czAZBgNVHRIEEjAQ
26
- gQ5nbGVubkByZW1wZS51czANBgkqhkiG9w0BAQUFAAOCAQEAzgK20+MNOknR9Kx6
27
- RisI3DsioCADjGldxY+INrwoTfPDVmNm4GdTYC+V+/BvxJw1RqHjEbuXSg0iibQC
28
- 4vN+th0Km7dnas/td1i+EKfGencfyQyecIaG9l3kbCkCWnldRtZ+BS5EfP2ML2u8
29
- fyCtze/Piovu8IwXL1W5kGZMnvzLmWxdqI3VPUou40n8F+EiMMLgd53kpzjtNOau
30
- 4W+mqVGOwlEGVSgI5+0SIsD8pvc62PlPWTv0kn1bcufKKCZmoVmpfbe3j4JpBInq
31
- zieXiXZSAojfFx9g91fKdIrlPbInHU/BaCxXSLBwvOM0drE+c2ue9X8gB55XAhzX
32
- 37oBiw==
33
- -----END CERTIFICATE-----
34
- date: 2016-09-21 00:00:00.000000000 Z
11
+ cert_chain: []
12
+ date: 2019-08-14 00:00:00.000000000 Z
35
13
  dependencies:
36
- - !ruby/object:Gem::Dependency
37
- name: rbnacl-libsodium
38
- requirement: !ruby/object:Gem::Requirement
39
- requirements:
40
- - - "~>"
41
- - !ruby/object:Gem::Version
42
- version: '1.0'
43
- type: :runtime
44
- prerelease: false
45
- version_requirements: !ruby/object:Gem::Requirement
46
- requirements:
47
- - - "~>"
48
- - !ruby/object:Gem::Version
49
- version: '1.0'
50
14
  - !ruby/object:Gem::Dependency
51
15
  name: sysrandom
52
16
  requirement: !ruby/object:Gem::Requirement
@@ -61,20 +25,6 @@ dependencies:
61
25
  - - "~>"
62
26
  - !ruby/object:Gem::Version
63
27
  version: '1.0'
64
- - !ruby/object:Gem::Dependency
65
- name: hashie
66
- requirement: !ruby/object:Gem::Requirement
67
- requirements:
68
- - - "~>"
69
- - !ruby/object:Gem::Version
70
- version: '3.4'
71
- type: :runtime
72
- prerelease: false
73
- version_requirements: !ruby/object:Gem::Requirement
74
- requirements:
75
- - - "~>"
76
- - !ruby/object:Gem::Version
77
- version: '3.4'
78
28
  - !ruby/object:Gem::Dependency
79
29
  name: bundler
80
30
  requirement: !ruby/object:Gem::Requirement
@@ -123,14 +73,14 @@ dependencies:
123
73
  requirements:
124
74
  - - "~>"
125
75
  - !ruby/object:Gem::Version
126
- version: '0.10'
76
+ version: '0.12'
127
77
  type: :development
128
78
  prerelease: false
129
79
  version_requirements: !ruby/object:Gem::Requirement
130
80
  requirements:
131
81
  - - "~>"
132
82
  - !ruby/object:Gem::Version
133
- version: '0.10'
83
+ version: '0.12'
134
84
  - !ruby/object:Gem::Dependency
135
85
  name: coveralls
136
86
  requirement: !ruby/object:Gem::Requirement
@@ -151,14 +101,14 @@ dependencies:
151
101
  requirements:
152
102
  - - "~>"
153
103
  - !ruby/object:Gem::Version
154
- version: '0.14'
104
+ version: '0.15'
155
105
  type: :development
156
106
  prerelease: false
157
107
  version_requirements: !ruby/object:Gem::Requirement
158
108
  requirements:
159
109
  - - "~>"
160
110
  - !ruby/object:Gem::Version
161
- version: '0.14'
111
+ version: '0.15'
162
112
  - !ruby/object:Gem::Dependency
163
113
  name: wwtd
164
114
  requirement: !ruby/object:Gem::Requirement
@@ -186,6 +136,7 @@ files:
186
136
  - ".coco.yml"
187
137
  - ".gitignore"
188
138
  - ".rubocop.yml"
139
+ - ".ruby-version"
189
140
  - ".travis.yml"
190
141
  - ".yardopts"
191
142
  - CHANGELOG.md
@@ -226,8 +177,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
226
177
  - !ruby/object:Gem::Version
227
178
  version: '0'
228
179
  requirements: []
229
- rubyforge_project:
230
- rubygems_version: 2.5.1
180
+ rubygems_version: 3.0.3
231
181
  signing_key:
232
182
  specification_version: 4
233
183
  summary: Secure (interoperable) Remote Password Auth (SRP-6a)
checksums.yaml.gz.sig DELETED
Binary file
data.tar.gz.sig DELETED
Binary file
metadata.gz.sig DELETED
@@ -1,3 +0,0 @@
1
- �� �_p���*L!'V��>?�#<��٥��5�:��w
2
- �ޘ�[�
3
- X�Z/���1��Q�8X�#x�i+��t�-��^�|�aO�q��g�#�g\pG�C��{R\uKY��m%���:������O�~��g���Z0j��M��j׎##c