sprockets 3.0.0.beta.1 → 3.0.0.beta.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 221043e6f00af1601780ca6aeb8c68911c1eeab6
-  data.tar.gz: 480adcfe9d59b1381dc000142ca7c4df6fc69a08
+  metadata.gz: 2dcb1bab6dcd806bd08e5f467aa057cd75004be8
+  data.tar.gz: 86037ea057923f8b2afd7dbffdea6d72f3596d02
 SHA512:
-  metadata.gz: e1260c1e89442a746a8c5bf095cb72fc2fb04115dadec6874147b5a9794bea557255cf429af883e9f1216c6dee84ed2da3019ceb1a5ccd1dcbc14166058ceb24
-  data.tar.gz: 0eaa3ace51ff6477b1b411fc2b4bfc67f9e3a268b088dc2c6fc1848ed5ffe9939ac481676324107be54e53abe835c0b4b2cb44a60c34083557c5d1458fad480b
+  metadata.gz: ce12f8ec442a3d4a3cef5352f12a6c83151ff4dd717ce0fb94d31811ca9f3c80953a3f52e3f582eb5ecb42d0af05d2e5320fe925c3c55e4b8b61fd6280ff4ef8
+  data.tar.gz: fbe0b9468d6e81a596517d4b4ecda0faf34ef84027ac7340ea2b603bc7635585ed2f93fa7e215e9c1062df1990c46222aefefd97caa4ba54a2dfcafa68c21811

data/README.md

@@ -394,6 +394,10 @@ submit a pull request.
   idea](https://issues.apache.org/bugzilla/show_bug.cgi?id=39727)
 * Added linked or referenced assets. When an asset is compiled, any of its links
   will be compiled as well.
+* Add Asset integrity attribute for Subresource Integrity
+* Default digest changed to SHA256. Configuring digest_class is deprecated.
+* Rename Asset#digest to Asset#hexdigest. Asset#digest is deprecated and will
+  return a raw byte String in 4.x.
 
 **2.12.2** (September 5, 2014)
 

data/lib/sprockets.rb

@@ -29,6 +29,7 @@ module Sprockets
   autoload :AssetURI,                'sprockets/asset_uri'
   autoload :Cache,                   'sprockets/cache'
   autoload :ContentTypeMismatch,     'sprockets/errors'
+  autoload :DigestUtils,             'sprockets/digest_utils'
   autoload :EncodingUtils,           'sprockets/encoding_utils'
   autoload :Error,                   'sprockets/errors'
   autoload :FileNotFound,            'sprockets/errors'
@@ -58,8 +59,8 @@ module Sprockets
   @version           = ''
 
   # Set the default digest
-  require 'digest/sha1'
-  @digest_class = Digest::SHA1
+  require 'digest/sha2'
+  @digest_class = Digest::SHA256
 
   require 'logger'
   @logger = Logger.new($stderr)

data/lib/sprockets/asset.rb

@@ -1,3 +1,4 @@
+require 'base64'
 require 'fileutils'
 require 'pathname'
 
@@ -49,7 +50,7 @@ module Sprockets
 
     # Internal: Unique asset object ID.
     #
-    # Returns String SHA1 String.
+    # Returns a String.
     attr_reader :id
 
     # Public: Internal URI to lookup asset by.
@@ -65,7 +66,7 @@ module Sprockets
     #
     # Returns String.
     def digest_path
-      logical_path.sub(/\.(\w+)$/) { |ext| "-#{digest}#{ext}" }
+      logical_path.sub(/\.(\w+)$/) { |ext| "-#{etag}#{ext}" }
     end
 
     # Public: Returns String MIME type of asset. Returns nil if type is unknown.
@@ -165,10 +166,25 @@ module Sprockets
     end
 
     # Public: Returns String hexdigest of source.
-    attr_reader :digest
+    def hexdigest
+      DigestUtils.pack_hexdigest(@digest)
+    end
+
+    # Deprecated: Returns String hexdigest of source.
+    #
+    # In 4.x this will be changed to return a raw Digest byte String.
+    alias_method :digest, :hexdigest
 
     # Pubic: ETag String of Asset.
-    alias_method :etag, :digest
+    alias_method :etag, :hexdigest
+
+    # Public: Returns String base64 digest of source.
+    def base64digest
+      DigestUtils.pack_base64digest(@digest)
+    end
+
+    # Public: A "named information" URL for subresource integrity.
+    attr_reader :integrity
 
     # Public: Add enumerator to allow `Asset` instances to be used as Rack
     # compatible body objects.

data/lib/sprockets/base.rb

@@ -8,7 +8,7 @@ require 'sprockets/server'
 module Sprockets
   # `Base` class for `Environment` and `Cached`.
   class Base
-    include PathUtils, HTTPUtils
+    include PathUtils, HTTPUtils, DigestUtils
     include Configuration
     include Server
     include Resolve
@@ -33,39 +33,37 @@ module Sprockets
     end
     alias_method :index, :cached
 
-    # Internal: Compute hexdigest for path.
+    # Internal: Compute digest for path.
     #
     # path - String filename or directory path.
     #
-    # Returns a String SHA1 hexdigest or nil.
-    def file_hexdigest(path)
+    # Returns a String digest or nil.
+    def file_digest(path)
       if stat = self.stat(path)
         # Caveat: Digests are cached by the path's current mtime. Its possible
         # for a files contents to have changed and its mtime to have been
         # negligently reset thus appearing as if the file hasn't changed on
         # disk. Also, the mtime is only read to the nearest second. Its
         # also possible the file was updated more than once in a given second.
-        cache.fetch(['file_hexdigest', path, stat.mtime.to_i]) do
+        cache.fetch(['file_digest', path, stat.mtime.to_i]) do
           if stat.directory?
             # If its a directive, digest the list of filenames
-            Digest::SHA1.hexdigest(self.entries(path).join(','))
+            digest_class.digest(self.entries(path).join(','))
           elsif stat.file?
             # If its a file, digest the contents
-            Digest::SHA1.file(path.to_s).hexdigest
+            digest_class.file(path.to_s).digest
           end
         end
       end
     end
 
-    # Internal: Compute hexdigest for a set of paths.
+    # Internal: Compute digest for a set of paths.
     #
     # paths - Array of filename or directory paths.
     #
-    # Returns a String SHA1 hexdigest.
-    def dependencies_hexdigest(paths)
-      digest = Digest::SHA1.new
-      paths.each { |path| digest.update(file_hexdigest(path).to_s) }
-      digest.hexdigest
+    # Returns a String digest.
+    def files_digest(paths)
+      digest(paths.map { |path| file_digest(path) })
     end
 
     # Find asset by logical path or expanded path.
@@ -191,16 +189,18 @@ module Sprockets
           asset.merge!({
             encoding: Encoding::BINARY,
             length: self.stat(asset[:filename]).size,
-            digest: digest_class.file(asset[:filename]).hexdigest,
+            digest: file_digest(asset[:filename]),
             metadata: {}
           })
         end
 
         metadata = asset[:metadata]
         metadata[:dependency_paths] = Set.new(metadata[:dependency_paths]).merge([asset[:filename]])
-        metadata[:dependency_digest] = dependencies_hexdigest(metadata[:dependency_paths])
+        metadata[:dependency_sources_digest] = files_digest(metadata[:dependency_paths])
 
-        asset[:id]  = Utils.hexdigest(asset)
+        asset[:integrity] = integrity_uri(asset[:digest], asset[:content_type])
+
+        asset[:id]  = pack_hexdigest(digest(asset))
         asset[:uri] = AssetURI.build(filename, params.merge(id: asset[:id]))
 
         # TODO: Avoid tracking Asset mtime

data/lib/sprockets/cache.rb

@@ -1,4 +1,4 @@
-require 'sprockets/utils'
+require 'sprockets/digest_utils'
 require 'logger'
 
 module Sprockets
@@ -142,7 +142,7 @@ module Sprockets
       #
       # Returns a String with a length less than 250 characters.
       def expand_key(key)
-        "sprockets/v#{VERSION}/#{Utils.hexdigest(key)}"
+        "sprockets/v#{VERSION}/#{DigestUtils.pack_urlsafe_base64digest(DigestUtils.digest(key))}"
       end
 
       PEEK_SIZE = 100
@@ -158,7 +158,7 @@ module Sprockets
           key.each { |k| str << peek_key(k) }
           str.join(':')[0, PEEK_SIZE]
         else
-          peek_key(Utils.hexdigest(key))
+          peek_key(DigestUtils.pack_urlsafe_base64digest(DigestUtils.digest(key)))
         end
       end
 

data/lib/sprockets/cached_environment.rb

@@ -14,10 +14,10 @@ module Sprockets
     def initialize(environment)
       initialize_configuration(environment)
 
-      @cache      = environment.cache
-      @stats      = Hash.new { |h, k| h[k] = _stat(k) }
-      @entries    = Hash.new { |h, k| h[k] = _entries(k) }
-      @hexdigests = Hash.new { |h, k| h[k] = _file_hexdigest(k) }
+      @cache   = environment.cache
+      @stats   = Hash.new { |h, k| h[k] = _stat(k) }
+      @entries = Hash.new { |h, k| h[k] = _entries(k) }
+      @digests = Hash.new { |h, k| h[k] = _file_digest(k) }
     end
 
     # No-op return self as cached environment.
@@ -38,10 +38,10 @@ module Sprockets
       @stats[path]
     end
 
-    # Internal: Cache Environment#file_hexdigest
-    alias_method :_file_hexdigest, :file_hexdigest
-    def file_hexdigest(path)
-      @hexdigests[path]
+    # Internal: Cache Environment#file_digest
+    alias_method :_file_digest, :file_digest
+    def file_digest(path)
+      @digests[path]
     end
 
     protected
@@ -53,7 +53,7 @@ module Sprockets
           self.version,
           self.paths,
           uri,
-          file_hexdigest(filename)
+          file_digest(filename)
         ]
       end
 
@@ -75,9 +75,9 @@ module Sprockets
       def build_asset_by_uri(uri)
         dep_graph_key = asset_dependency_graph_cache_key(uri)
 
-        dependency_paths, dependency_digest, digest_uri = cache._get(dep_graph_key)
-        if dependency_paths && dependency_digest && digest_uri
-          if dependencies_hexdigest(dependency_paths) == dependency_digest
+        dependency_paths, dependency_sources_digest, digest_uri = cache._get(dep_graph_key)
+        if dependency_paths && dependency_sources_digest && digest_uri
+          if files_digest(dependency_paths) == dependency_sources_digest
             if asset = cache._get(asset_digest_uri_cache_key(digest_uri))
               return asset
             end
@@ -86,8 +86,8 @@ module Sprockets
 
         asset = super
 
-        dependency_digest, dependency_paths = asset[:metadata].values_at(:dependency_digest, :dependency_paths)
-        cache._set(dep_graph_key, [dependency_paths, dependency_digest, asset[:uri]])
+        dependency_sources_digest, dependency_paths = asset[:metadata].values_at(:dependency_sources_digest, :dependency_paths)
+        cache._set(dep_graph_key, [dependency_paths, dependency_sources_digest, asset[:uri]])
         cache.fetch(asset_digest_uri_cache_key(asset[:uri])) { asset }
 
         asset

data/lib/sprockets/configuration.rb

@@ -52,13 +52,13 @@ module Sprockets
       mutate_config(:version) { version.dup }
     end
 
-    # Returns a `Digest` implementation class.
+    # Deprecated: Returns a `Digest` implementation class.
     #
-    # Defaults to `Digest::SHA1`.
+    # Defaults to `Digest::SHA256`.
     attr_reader :digest_class
 
-    # Assign a `Digest` implementation class. This maybe any Ruby
-    # `Digest::` implementation such as `Digest::SHA1` or
+    # Deprecated: Assign a `Digest` implementation class. This maybe any Ruby
+    # `Digest::` implementation such as `Digest::SHA256` or
     # `Digest::MD5`.
     #
     #     environment.digest_class = Digest::MD5

data/lib/sprockets/digest_utils.rb

@@ -0,0 +1,144 @@
+require 'digest/md5'
+require 'digest/sha1'
+require 'digest/sha2'
+
+module Sprockets
+  module DigestUtils
+    extend self
+
+    # Internal: Default digest class.
+    #
+    # Returns a Digest::Base subclass.
+    def digest_class
+      Digest::SHA256
+    end
+
+    # Internal: Maps digest bytesize to the digest class.
+    DIGEST_SIZES = {
+      16 => Digest::MD5,
+      20 => Digest::SHA1,
+      32 => Digest::SHA256,
+      48 => Digest::SHA384,
+      64 => Digest::SHA512
+    }
+
+    # Internal: Detect digest class hash algorithm for digest bytes.
+    #
+    # While not elegant, all the supported digests have a unique bytesize.
+    #
+    # Returns Digest::Base or nil.
+    def detect_digest_class(bytes)
+      DIGEST_SIZES[bytes.bytesize]
+    end
+
+    # Internal: Generate a hexdigest for a nested JSON serializable object.
+    #
+    # obj - A JSON serializable object.
+    #
+    # Returns a String digest of the object.
+    def digest(obj)
+      digest = digest_class.new
+      queue  = [obj]
+
+      while queue.length > 0
+        obj = queue.shift
+        klass = obj.class
+
+        if klass == String
+          digest << obj
+        elsif klass == Symbol
+          digest << 'Symbol'
+          digest << obj.to_s
+        elsif klass == Fixnum
+          digest << 'Fixnum'
+          digest << obj.to_s
+        elsif klass == TrueClass
+          digest << 'TrueClass'
+        elsif klass == FalseClass
+          digest << 'FalseClass'
+        elsif klass == NilClass
+          digest << 'NilClass'
+        elsif klass == Array
+          digest << 'Array'
+          queue.concat(obj)
+        elsif klass == Hash
+          digest << 'Hash'
+          queue.concat(obj.sort)
+        elsif klass == Set
+          digest << 'Set'
+          queue.concat(obj.to_a)
+        elsif klass == Encoding
+          digest << 'Encoding'
+          digest << obj.name
+        else
+          raise TypeError, "couldn't digest #{klass}"
+        end
+      end
+
+      digest.digest
+    end
+
+    # Internal: Pack a binary digest to a hex encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns hex String.
+    def pack_hexdigest(bin)
+      bin.unpack('H*').first
+    end
+
+    # Internal: Pack a binary digest to a base64 encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns base64 String.
+    def pack_base64digest(bin)
+      [bin].pack('m0')
+    end
+
+    # Internal: Pack a binary digest to a urlsafe base64 encoded string.
+    #
+    # bin - String bytes
+    #
+    # Returns urlsafe base64 String.
+    def pack_urlsafe_base64digest(bin)
+      pack_base64digest(bin).tr('+/', '-_').tr('=', '')
+    end
+
+    # Internal: Maps digest class to the named information hash algorithm name.
+    #
+    # http://www.iana.org/assignments/named-information/named-information.xhtml
+    NI_HASH_ALGORIHMS = {
+      Digest::SHA256 => 'sha-256'.freeze,
+      Digest::SHA384 => 'sha-384'.freeze,
+      Digest::SHA512 => 'sha-512'.freeze
+    }
+
+    # Internal: Generate a "named information" URI for use in the `integrity`
+    # attribute of an asset tag as per the subresource integrity specification.
+    #
+    # digest       - The String byte digest of the asset content.
+    # content_type - The content-type the asset will be served with. This *must*
+    #                be accurate if provided. Otherwise, subresource integrity
+    #                will block the loading of the asset.
+    #
+    # Returns a String or nil if hash algorithm is incompatible.
+    def integrity_uri(digest, content_type = nil)
+      case digest
+      when Digest::Base
+        digest_class = digest.class
+        digest = digest.digest
+      when String
+        digest_class = DIGEST_SIZES[digest.bytesize]
+      else
+        raise TypeError, "unknown digest: #{digest.inspect}"
+      end
+
+      if hash_name = NI_HASH_ALGORIHMS[digest_class]
+        uri = "ni:///#{hash_name};#{pack_urlsafe_base64digest(digest)}"
+        uri << "?ct=#{content_type}" if content_type
+        uri
+      end
+    end
+  end
+end

data/lib/sprockets/manifest.rb

@@ -173,7 +173,8 @@ module Sprockets
             'logical_path' => asset.logical_path,
             'mtime'        => asset.mtime.iso8601,
             'size'         => asset.bytesize,
-            'digest'       => asset.digest
+            'digest'       => asset.hexdigest,
+            'integrity'    => asset.integrity
           }
           assets[asset.logical_path] = asset.digest_path
 

data/lib/sprockets/path_utils.rb

@@ -114,6 +114,41 @@ module Sprockets
       File.basename(path).scan(/\.[^.]+/)
     end
 
+    # Internal: Returns all parents for path
+    #
+    # path - String absolute filename or directory
+    # root - String path to stop at (default: system root)
+    #
+    # Returns an Array of String paths.
+    def path_parents(path, root = nil)
+      root = "#{root}#{File::SEPARATOR}" if root
+      parents = []
+
+      loop do
+        parent = File.dirname(path)
+        break if parent == path
+        break if root && !path.start_with?(root)
+        parents << path = parent
+      end
+
+      parents
+    end
+
+    # Internal: Find target basename checking upwards from path.
+    #
+    # basename - String filename: ".sprocketsrc"
+    # path     - String path to start search: "app/assets/javascripts/app.js"
+    # root     - String path to stop at (default: system root)
+    #
+    # Returns String filename or nil.
+    def find_upwards(basename, path, root = nil)
+      path_parents(path, root).each do |dir|
+        filename = File.join(dir, basename)
+        return filename if file?(filename)
+      end
+      nil
+    end
+
     # Internal: Stat all the files under a directory.
     #
     # dir - A String directory

data/lib/sprockets/processing.rb

@@ -180,7 +180,7 @@ module Sprockets
           when NilClass
             # noop
           when Hash
-            data = result[:data]
+            data = result[:data] if result.key?(:data)
             metadata = metadata.merge(result)
             metadata.delete(:data)
           when String
@@ -195,7 +195,7 @@ module Sprockets
         source: data,
         charset: data.encoding.name.downcase,
         length: data.bytesize,
-        digest: digest_class.hexdigest(data),
+        digest: digest(data),
         metadata: metadata
       }
     end

data/lib/sprockets/server.rb

@@ -67,11 +67,11 @@ module Sprockets
 
       if asset.nil?
         status = :not_found
-      elsif fingerprint && asset.digest != fingerprint
+      elsif fingerprint && asset.etag != fingerprint
         status = :not_found
-      elsif if_match && asset.digest != if_match
+      elsif if_match && asset.etag != if_match
         status = :precondition_failed
-      elsif if_none_match && asset.digest == if_none_match
+      elsif if_none_match && asset.etag == if_none_match
         status = :not_modified
       else
         status = :ok
@@ -124,8 +124,8 @@ module Sprockets
       end
 
       # Returns a 304 Not Modified response tuple
-      def not_modified_response(env, digest)
-        [ 304, cache_headers(env, digest), [] ]
+      def not_modified_response(env, etag)
+        [ 304, cache_headers(env, etag), [] ]
       end
 
       # Returns a 403 Forbidden response tuple
@@ -221,12 +221,12 @@ module Sprockets
         env["QUERY_STRING"].to_s =~ /body=(1|t)/
       end
 
-      def cache_headers(env, digest)
+      def cache_headers(env, etag)
         headers = {}
 
         # Set caching headers
         headers["Cache-Control"] = "public"
-        headers["ETag"]          = %("#{digest}")
+        headers["ETag"]          = %("#{etag}")
 
         # If the request url contains a fingerprint, set a long
         # expires on the response
@@ -262,16 +262,16 @@ module Sprockets
           headers["Content-Type"] = type
         end
 
-        headers.merge(cache_headers(env, asset.digest))
+        headers.merge(cache_headers(env, asset.etag))
       end
 
-      # Gets digest fingerprint.
+      # Gets ETag fingerprint.
       #
       #     "foo-0aa2105d29558f3eb790d411d7d8fb66.js"
       #     # => "0aa2105d29558f3eb790d411d7d8fb66"
       #
       def path_fingerprint(path)
-        path[/-([0-9a-f]{7,40})\.[^.]+$/, 1]
+        path[/-([0-9a-f]{7,128})\.[^.]+$/, 1]
       end
   end
 end

data/lib/sprockets/utils.rb

@@ -1,4 +1,3 @@
-require 'digest/sha1'
 require 'set'
 
 module Sprockets
@@ -101,54 +100,6 @@ module Sprockets
       end
     end
 
-    # Internal: Generate a hexdigest for a nested JSON serializable object.
-    #
-    # obj - A JSON serializable object.
-    #
-    # Returns a String SHA1 digest of the object.
-    def hexdigest(obj)
-      digest = Digest::SHA1.new
-      queue  = [obj]
-
-      while queue.length > 0
-        obj = queue.shift
-        klass = obj.class
-
-        if klass == String
-          digest << 'String'
-          digest << obj
-        elsif klass == Symbol
-          digest << 'Symbol'
-          digest << obj.to_s
-        elsif klass == Fixnum
-          digest << 'Fixnum'
-          digest << obj.to_s
-        elsif klass == TrueClass
-          digest << 'TrueClass'
-        elsif klass == FalseClass
-          digest << 'FalseClass'
-        elsif klass == NilClass
-          digest << 'NilClass'
-        elsif klass == Array
-          digest << 'Array'
-          queue.concat(obj)
-        elsif klass == Hash
-          digest << 'Hash'
-          queue.concat(obj.sort)
-        elsif klass == Set
-          digest << 'Set'
-          queue.concat(obj.to_a)
-        elsif klass == Encoding
-          digest << 'Encoding'
-          digest << obj.name
-        else
-          raise TypeError, "couldn't digest #{klass}"
-        end
-      end
-
-      digest.hexdigest
-    end
-
     # Internal: Post-order Depth-First search algorithm.
     #
     # Used for resolving asset dependencies.

data/lib/sprockets/version.rb

@@ -1,3 +1,3 @@
 module Sprockets
-  VERSION = "3.0.0.beta.1"
+  VERSION = "3.0.0.beta.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sprockets
 version: !ruby/object:Gem::Version
-  version: 3.0.0.beta.1
+  version: 3.0.0.beta.2
 platform: ruby
 authors:
 - Sam Stephenson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-28 00:00:00.000000000 Z
+date: 2014-10-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -237,6 +237,7 @@ files:
 - lib/sprockets/compressing.rb
 - lib/sprockets/configuration.rb
 - lib/sprockets/context.rb
+- lib/sprockets/digest_utils.rb
 - lib/sprockets/directive_processor.rb
 - lib/sprockets/eco_template.rb
 - lib/sprockets/ejs_template.rb