tina4ruby 3.13.134 → 3.13.136

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d0d4c7801e0766f00041e3d004a0318d7bd4e22d9b4a4d102d05516b89ebba1
-  data.tar.gz: 837234011a9a76e4d0733d8a05936bdb08a5bcb8681638679064b51d84dc2392
+  metadata.gz: 76e4848167cfc04c327d95658f37ec1e8c95448f143000eaec69218527b86b9f
+  data.tar.gz: 97775ba90cbd5c991b44d27af3c5a94db4288f3e70feb07147fc4fe3df672ba0
 SHA512:
-  metadata.gz: bfd2d4b058f1366920dd46b66f1d59f504f1b30cc649b71ecc7f5d8f8d15a385eaa19b5de9078768c0f935aba9a3115e8e10efe72806cfa53be5aca73f5c2caf
-  data.tar.gz: 178596fd8db63262bc35aeb25ae13e11c609b3f50a85bc06d91ce12063b9739973f80ce5783ec5a330d115b3b07e9389718f2316d8c53590b47867ad777b193d
+  metadata.gz: f548932ee5b0b890a972e09727b2c73264cc30188e8a9ee24ef7f61cfa165a71b52797cf8e0c69c6331e3a7be2d5b82b5bc41c791c32ef88ef3e2760a44d6c65
+  data.tar.gz: cd7ab7cb88ca3775bbdd49ed1e1a187e0a5846383815735eec415edfc12bd3318c36f85b6b77d479659c2fdf86bc38fcb8b0caa2838d138c2de9eb4ea8eba46e

data/CHANGELOG.md

@@ -6,6 +6,15 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.135
+
+Fix release. The dev-admin version check returns no version and a reason when it cannot
+reach RubyGems (set TINA4_VERSION_CHECK_URL to override the registry), so the toolbar reports
+"could not check" instead of a false "up to date". Web Push pads the VAPID private scalar to
+the fixed 32-byte width, so a leading-zero scalar no longer produces a key the app's own
+validation rejects; the public point and the ECDH secret were already correct. Full notes:
+https://tina4.com/ruby/36-releases
+
 ## 3.13.134
 
 Feature 140 Web Push is now available with provider-neutral subscription delivery,

data/lib/tina4/dev_admin.rb

@@ -842,23 +842,43 @@ module Tina4
         [status, { "content-type" => "application/json; charset=utf-8" }, [body]]
       end
 
+      # A version check that did not happen says so.
+      #
+      # This used to fall back to latest = current on any failure, and the
+      # toolbar renders that as a green "Latest: vX — You are up to date!". A
+      # developer several releases behind, on a machine with no route out, was
+      # told the opposite of the truth — and the toolbar's own "Could not check
+      # for updates" branch could never fire, because the failure arrived as a
+      # success.
+      #
+      # latest is nil when the check could not be made, and error says why. The
+      # registry URL is TINA4_VERSION_CHECK_URL when set (a mirror, or a test's
+      # own server), else RubyGems.
       def version_check_payload
         current = Tina4::VERSION
-        latest = current
+        url = ENV.fetch("TINA4_VERSION_CHECK_URL",
+                        "https://rubygems.org/api/v1/versions/tina4ruby/latest.json")
         begin
-          uri = URI.parse("https://rubygems.org/api/v1/versions/tina4ruby/latest.json")
+          uri = URI.parse(url)
           http = Net::HTTP.new(uri.host, uri.port)
-          http.use_ssl = true
+          http.use_ssl = (uri.scheme == "https")
           http.open_timeout = 5
           http.read_timeout = 5
-          req = Net::HTTP::Get.new(uri)
-          resp = http.request(req)
-          if resp.is_a?(Net::HTTPSuccess)
-            data = JSON.parse(resp.body)
-            latest = data["version"] || current
+          resp = http.request(Net::HTTP::Get.new(uri))
+          unless resp.is_a?(Net::HTTPSuccess)
+            return { current: current, latest: nil,
+                     error: "RubyGems answered #{resp.code}" }
           end
-        rescue StandardError
-          # Offline or timeout — return current as latest
+          latest = JSON.parse(resp.body)["version"]
+          # Reaching RubyGems is not the same as learning the version: an
+          # answer with none in it is the same lie by another route.
+          if latest.nil? || latest.to_s.empty?
+            return { current: current, latest: nil,
+                     error: "RubyGems did not report a version" }
+          end
+        rescue StandardError => e
+          return { current: current, latest: nil,
+                   error: "#{e.class}: #{e.message}" }
         end
         { current: current, latest: latest }
       end

data/lib/tina4/public/swagger/index.html

@@ -71,7 +71,7 @@
 
         // Build a system
         const ui = SwaggerUIBundle({
-            url: "{SWAGGER_ROUTE}/swagger.json",
+            url: "/swagger/openapi.json",
             dom_id: '#swagger-ui',
             deepLinking: true,
             presets: [

data/lib/tina4/push.rb

@@ -20,11 +20,20 @@ module Tina4
       require_openssl
       key = OpenSSL::PKey::EC.generate("prime256v1")
       {
+        # The public point keeps its width -- the 0x04 lead byte is non-zero, so
+        # to_s(2) never drops it. The private SCALAR has no such guard: OpenSSL
+        # strips a leading zero byte, so ~0.3% of keys come back 31 bytes and the
+        # app's own 32-byte validation would then reject the key it just made.
         "publicKey" => b64(key.public_key.to_bn.to_s(2)),
-        "privateKey" => b64(key.private_key.to_s(2))
+        "privateKey" => b64(pad32(key.private_key.to_s(2)))
       }
     end
 
+    # Left-pad big-endian EC material to the fixed 32-byte P-256 field width.
+    def self.pad32(bytes)
+      bytes.b.rjust(32, "\x00".b)
+    end
+
     def initialize(subject: nil, public_key: nil, private_key: nil, ttl: 60, urgency: nil)
       @subject = (subject || ENV.fetch("TINA4_VAPID_SUBJECT", "")).strip
       @public_key = (public_key || ENV.fetch("TINA4_VAPID_PUBLIC", "")).strip

data/lib/tina4/rack_app.rb

@@ -1033,6 +1033,14 @@ module Tina4
                 el.className = 't4-ok';
                 el.innerHTML = 'Latest: <strong class="t4-ok">v' + latest + '</strong> &mdash; You are up to date!';
             }
+            // A check that did not happen is not a clean bill of health. The
+            // server sends latest: null when it could not reach the registry,
+            // and saying so is the whole point -- "up to date" here would be a
+            // guess dressed as a fact.
+            function couldNotCheck(el, why) {
+                el.className = 't4-err';
+                el.textContent = 'Could not check for updates' + (why ? ' (' + why + ')' : '');
+            }
             function checkVersion() {
                 if (modal.style.display === 'block') { modal.style.display = 'none'; return; }
                 modal.style.display = 'block';
@@ -1041,6 +1049,10 @@ module Tina4
                 el.textContent = 'Checking for updates...';
                 fetch('/__dev/api/version-check').then(function (r) { return r.json(); }).then(function (d) {
                     var latest = d.latest, current = d.current;
+                    // A check that did not happen says so -- act on a missing
+                    // latest before comparing, so a null never falls into the
+                    // up-to-date branch.
+                    if (!latest) { couldNotCheck(el, d.error); return; }
                     if (latest === current) { upToDate(el, latest); return; }
                     var cP = current.split('.').map(Number), lP = latest.split('.').map(Number);
                     var isNewer = false, i, c, l;

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.134"
+  VERSION = "3.13.136"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.134
+  version: 3.13.136
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-05 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack