smile-identity-core 2.3.1 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39966ea73f1a7ad317cf4bb110622c9b5c67efcf5246487b2a7a4124d418a8f6
-  data.tar.gz: cc969bff36cdb9a725e4776d0879b8159cb88b22f2e7d316a9b43848c7ddc388
+  metadata.gz: 93af320b6183d3f3975d74e1dd0ea7bf6c7da3ee3dd8db612d0410db826cc278
+  data.tar.gz: df7978dd7585ff27d41662f1ec0ace415cb7ff69e503eaf0e1724ed641851b6f
 SHA512:
-  metadata.gz: db43ee16f48ec3f8c87069f21aac2b5ba1cc509abfa54531efd4695a9d56c98beeb3d78b45ec1841e386d48c4847d116d6464545fca5bf4fbd33fafc5e508242
-  data.tar.gz: 8827bbbf277fbb9687aae8cdbf567de94e1f3deeeea9d9913a8088c4a0d47a0399d5c02a80d2acc9a218f0a577122a22e397457dbebb9075f55ebc593d07b8cc
+  metadata.gz: dcc1946711b63d2eadbb6f451da20d8d24cdda4c308fd2d545572e42815345a8ae70f76259308efd28bc059b8ca426eb1c4e9ce2755e4a2e771d094f8d210243
+  data.tar.gz: a3195d58f992b7c85086372d99fbc797ec9c58ad17ae6a01b64181bf054599145d9334cba1839b9e162fc4a161ed5b08de8a226d26eac3d3bb38966c09b2d458

data/.github/dependabot.yml

@@ -1,12 +1,16 @@
 version: 2
 updates:
-- package-ecosystem: github-actions
-  directory: /
-  schedule:
-    interval: monthly
-    day: tuesday
-    time: '15:00'
-  groups:
-    github-actions:
-      patterns:
-      - '*'
+  - package-ecosystem: bundler
+    open-pull-requests-limit: 0
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    open-pull-requests-limit: 5
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

data/.github/workflows/audit.yml

@@ -0,0 +1,42 @@
+name: Security Audit
+
+on:
+  pull_request:
+    paths:
+      - 'Gemfile'
+      - 'Gemfile.lock'
+      - '*.gemspec'
+  workflow_dispatch:
+  schedule:
+    - cron: '0 9 * * *'
+
+jobs:
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+      - name: Update advisory database
+        run: bundle exec bundler-audit update
+      - name: Run bundler-audit
+        run: bundle exec bundler-audit check
+      - name: Create issue on failure
+        if: failure() && github.event_name != 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          EXISTING=$(gh issue list --label "security-audit" --state open --json number --jq 'length')
+          if [ "$EXISTING" -gt 0 ]; then exit 0; fi
+          TITLE_DATE=$(date +%Y-%m-%d)
+          gh issue create \
+            --title "Security: Ruby dependency vulnerabilities detected (${TITLE_DATE})" \
+            --label "security-audit" \
+            --label "priority:high" \
+            --body "The daily security audit has detected vulnerabilities. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."

data/.github/workflows/release.yml

@@ -10,11 +10,11 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         set-safe-directory: false
     - name: Release Gem
-      uses: cadwallion/publish-rubygems-action@master
+      uses: cadwallion/publish-rubygems-action@94a6f4cd5350581749c569b5001eecc864e3ad0b # master
       env:
         RUBYGEMS_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

data/.github/workflows/semgrep.yml

@@ -19,7 +19,7 @@ jobs:
     container:
       image: semgrep/semgrep:1.157.0
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
 
       - name: Run Semgrep
         continue-on-error: true
@@ -28,10 +28,37 @@ jobs:
       - name: Upload SARIF to GitHub Security
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: semgrep.sarif
 
+      - name: Import results into DefectDojo
+        if: always()
+        continue-on-error: true
+        env:
+          DEFECTDOJO_URL: ${{ secrets.DEFECTDOJO_URL }}
+          DEFECTDOJO_API_TOKEN: ${{ secrets.DEFECTDOJO_API_TOKEN }}
+          REPO_NAME: ${{ github.event.repository.name }}
+          BRANCH_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          if [ ! -s semgrep.sarif ]; then
+            echo "No semgrep.sarif file found, skipping DefectDojo import"
+            exit 0
+          fi
+          curl -sS -f \
+            -H "Authorization: Token ${DEFECTDOJO_API_TOKEN}" \
+            -F "scan_type=SARIF" \
+            -F "file=@semgrep.sarif" \
+            -F "product_type_name=GitHub" \
+            -F "product_name=${REPO_NAME}" \
+            -F "engagement_name=CI" \
+            -F "auto_create_context=true" \
+            -F "close_old_findings=true" \
+            -F "deduplication_on_engagement=true" \
+            -F "commit_hash=${{ github.sha }}" \
+            -F "branch_tag=${BRANCH_TAG}" \
+            "${DEFECTDOJO_URL}/api/v2/reimport-scan/"
+
       - name: Comment findings on PR
         if: github.event_name == 'pull_request' && always()
         env:

data/.github/workflows/test.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
   workflow_call:
+
+env:
+  BUNDLE_FROZEN: "true"
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -14,10 +18,10 @@ jobs:
       matrix:
         # Due to https://github.com/actions/runner/issues/849, we have to use quotes for '3.0'
         # See https://www.ruby-lang.org/en/downloads/ for latest stable releases.
-        ruby: ['2.6', '2.7', '3.0', '3.1', '3.2']
+        ruby: ['3.0', '3.1', '3.2', '3.3', '3.4']
     steps:
-    - uses: actions/checkout@v6
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
         bundler-cache: true
@@ -25,8 +29,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: 3.2
         bundler-cache: true

data/.rubocop.yml

@@ -5,7 +5,7 @@ require:
 - rubocop-rspec
 
 AllCops:
-  TargetRubyVersion: 2.6
+  TargetRubyVersion: 3.0
   NewCops: enable
 
 Bundler/DuplicatedGem:

data/CHANGELOG.md

@@ -5,6 +5,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [3.0.0] - 2026-09-07
+### Changed
+- Require Ruby 3.0 or later, matching rubyzip 3.x. This drops support for Ruby 2.6 and 2.7.
+
+### Fixed
+- Declare the `base64` dependency so the SDK loads on Ruby 3.4.
+
+### Security
+- Require rubyzip 3.4.0 or later (below 4.0) to address [CVE-2026-85396](https://rubysec.com/advisories/CVE-2026-85396/). The SDK creates ZIP archives and does not call the affected `Zip::Entry#extract` method.
+
 ## [2.3.1] - 2026-04-24
 ### Added
 - Support for optional `aliases` parameter in AML Check (`AmlCheck#submit_job`) to allow secondary names in screening requests

data/Gemfile

@@ -4,3 +4,7 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in smile-identity-core.gemspec
 gemspec
+
+group :development do
+  gem 'bundler-audit', require: false
+end

data/Gemfile.lock

@@ -1,19 +1,25 @@
 PATH
   remote: .
   specs:
-    smile-identity-core (2.3.1)
-      rubyzip (~> 1.2, >= 1.2.3)
+    smile-identity-core (3.0.0)
+      base64 (~> 0.3)
+      rubyzip (>= 3.4.0, < 4.0)
       typhoeus (~> 1.0, >= 1.0.1)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.2)
+    base64 (0.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
     diff-lcs (1.3)
     docile (1.4.0)
     ethon (0.16.0)
       ffi (>= 1.15.0)
     ffi (1.16.3)
+    ffi (1.16.3-x64-mingw-ucrt)
     json (2.5.1)
     parallel (1.22.1)
     parser (3.1.2.1)
@@ -52,13 +58,14 @@ GEM
     rubocop-rspec (2.14.1)
       rubocop (~> 1.33)
     ruby-progressbar (1.11.0)
-    rubyzip (1.3.0)
+    rubyzip (3.4.0)
     simplecov (0.22.0)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
+    thor (1.5.0)
     typhoeus (1.4.0)
       ethon (>= 0.9.0)
     unicode-display_width (2.3.0)
@@ -68,6 +75,7 @@ PLATFORMS
 
 DEPENDENCIES
   bundler (~> 2.0)
+  bundler-audit
   rake (~> 12.3)
   rspec (~> 3.0)
   rubocop (~> 1.37.1)

data/README.md

@@ -1,5 +1,7 @@
 # Smile Identity Ruby Server Side SDK
 
+Requires Ruby 3.0 or later.
+
 Smile Identity provides the best solutions for real time Digital KYC, identity verification, user onboarding, and user authentication across Africa. Our server side libraries make it easy to integrate us on the server-side. Since the library is server-side, you will be required to pass the images (if required) to the library.
 
 If you haven’t already, [sign up for a free Smile Identity account](https://usesmileid.com/talk-to-an-expert/), which comes with Sandbox access.

data/lib/smile-identity-core/signature.rb

@@ -25,7 +25,12 @@ module SmileIdentityCore
     # @param [String] msg_signature a previously generated signature, to be confirmed
     # @return [Boolean] TRUE or FALSE
     def confirm_signature(timestamp, msg_signature)
-      get_signature(timestamp)[:signature] == msg_signature
+      return false unless msg_signature.is_a?(String)
+
+      expected = get_signature(timestamp)[:signature]
+      return false unless expected.bytesize == msg_signature.bytesize
+
+      secure_compare(expected, msg_signature)
     end
 
     private
@@ -41,5 +46,16 @@ module SmileIdentityCore
         timestamp: timestamp.to_s,
       }
     end
+
+    # Compares equal-length strings without short-circuiting on the first
+    # differing byte. This keeps compatibility with Ruby versions that do not
+    # provide OpenSSL.fixed_length_secure_compare.
+    def secure_compare(first, second)
+      result = 0
+      first.each_byte.with_index do |byte, index|
+        result |= byte ^ second.getbyte(index)
+      end
+      result.zero?
+    end
   end
 end

data/lib/smile-identity-core/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module SmileIdentityCore
-  VERSION = '2.3.1'
+  VERSION = '3.0.0'
   SOURCE_SDK = 'Ruby'
 end

data/smile-identity-core.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |spec|
   most of the features of the Smile Identity system through direct server to server queries.'
   spec.description = 'The Official Smile Identity gem'
   spec.homepage = 'https://www.usesmileid.com/'
-  spec.required_ruby_version = '>= 2.6'
+  spec.required_ruby_version = '>= 3.0'
   spec.license = 'MIT'
 
   spec.metadata['homepage_uri'] = spec.homepage
@@ -39,7 +39,8 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rubocop-rspec', '~> 2.14.1'
   spec.add_development_dependency 'simplecov', '~> 0.18'
 
-  spec.add_dependency 'rubyzip', '~> 1.2', '>= 1.2.3'
+  spec.add_dependency 'base64', '~> 0.3'
+  spec.add_dependency 'rubyzip', '>= 3.4.0', '< 4.0'
   spec.add_dependency 'typhoeus', '~> 1.0', '>= 1.0.1'
   spec.metadata['rubygems_mfa_required'] = 'true'
 end

data/socket.yml

@@ -0,0 +1,43 @@
+version: 2
+triggerPaths:
+  - 'Gemfile'
+  - 'Gemfile.lock'
+  - '*.gemspec'
+issueRules:
+  malware: true
+  didYouMean: true
+  installScripts: true
+  obfuscatedFile: true
+  troll: true
+  shellScriptOverride: true
+  gptMalware: true
+  manifestConfusion: true
+  gitDependency: true
+  httpDependency: true
+  gitHubDependency: true
+  networkAccess: true
+  shellAccess: true
+  envVars: true
+  highEntropyStrings: true
+  unstableOwnership: true
+  gptSecurity: true
+  hasNativeCode: true
+  telemetry: true
+  invalidPackageJSON: true
+  unresolvedRequire: true
+  deprecated: true
+  unmaintained: true
+  trivialPackage: false
+  minifiedFile: false
+  dynamicRequire: false
+  debugAccess: false
+  filesystemAccess: false
+  usesEval: false
+  floatingDependency: false
+  unpopularPackage: false
+  gptAnomaly: false
+githubApp:
+  enabled: true
+  pullRequestAlertsEnabled: true
+  dependencyOverviewEnabled: true
+  projectReportsEnabled: true

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smile-identity-core
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 3.0.0
 platform: ruby
 authors:
 - Smile Identity
@@ -108,25 +108,39 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.18'
 - !ruby/object:Gem::Dependency
-  name: rubyzip
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.2.3
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '0.3'
+- !ruby/object:Gem::Dependency
+  name: rubyzip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.2.3
+        version: 3.4.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.4.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: typhoeus
   requirement: !ruby/object:Gem::Requirement
@@ -155,6 +169,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/dependabot.yml"
+- ".github/workflows/audit.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/semgrep.yml"
 - ".github/workflows/test.yml"
@@ -197,6 +212,7 @@ files:
 - lib/smile-identity-core/version.rb
 - lib/smile-identity-core/web_api.rb
 - smile-identity-core.gemspec
+- socket.yml
 homepage: https://www.usesmileid.com/
 licenses:
 - MIT
@@ -213,7 +229,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.6'
+      version: '3.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="