webauthn 3.4.1 → 3.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 93072800aa309dfef7946c9dd7f1601b41c8b6b11de8142aa388fb1f19b62869
4
- data.tar.gz: 76bdba0f89cbcd48f30692af6ba50eb558dab98f07e4e8c7913d6a60a70ef582
3
+ metadata.gz: 50b5c2c43f3e5719dd1ed0f63e9a7bb9705f2f1e97861ab0a0ee0a7d61c4ee41
4
+ data.tar.gz: d8849b387d30e54f7a45fd66bcb2b164983100b0b3369ca8fbf52840261e7fe4
5
5
  SHA512:
6
- metadata.gz: 7801c6840c5f4287724887ee2646ee1aa7966ffe8da3cf8f7a2b014564448f33a68b8d12011a87f8445bf661b6c55cca0a5d7309fe44411ad4b249ff5ceff01e
7
- data.tar.gz: d25993a7b2868a3f3445af99b388ac68ef67a406a73f997b99f690304506d75f46a06b22c99aeeeb105271b849e86f855c11f610fd2908ea9b2f44a3f245060a
6
+ metadata.gz: 4189cd8d89340585a464e6d9368b6ea532c7c59189cbd47022a04d767ec230979076652e333e70878dcead127688d7fe01e57706f63afe325eb1ec5673cf851a
7
+ data.tar.gz: 1cba3b28cd9388256f6d47493fb151f7732ad8680da5863476d4b5e237db7389e362f7a2543bc1447cd0e205e44134957cfa2e4ceb43e9fb32a6b5f851ff349a
@@ -0,0 +1,55 @@
1
+ name: Install OpenSSL
2
+
3
+ inputs:
4
+ version:
5
+ description: 'The version of OpenSSL to install'
6
+ required: true
7
+
8
+ runs:
9
+ using: 'composite'
10
+ steps:
11
+ - name: Restore cached OpenSSL library
12
+ id: cache-openssl-restore
13
+ uses: actions/cache/restore@v4
14
+ with:
15
+ path: ~/openssl
16
+ key: openssl-${{ inputs.version }}
17
+
18
+ - name: Compile OpenSSL library
19
+ if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
20
+ shell: bash
21
+ run: |
22
+ mkdir -p tmp/build-openssl && cd tmp/build-openssl
23
+ case ${{ inputs.version }} in
24
+ 1.1.*)
25
+ OPENSSL_COMMIT=OpenSSL_
26
+ OPENSSL_COMMIT+=$(echo ${{ inputs.version }} | sed -e 's/\./_/g')
27
+ git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
28
+ echo "Git commit: $(git rev-parse HEAD)"
29
+ ./Configure --prefix=$HOME/openssl --libdir=lib linux-x86_64
30
+ make depend && make -j4 && make install_sw
31
+ ;;
32
+ 3.*)
33
+ OPENSSL_COMMIT=openssl-
34
+ OPENSSL_COMMIT+=$(echo ${{ inputs.version }})
35
+ git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
36
+ echo "Git commit: $(git rev-parse HEAD)"
37
+ if [[ ${{ inputs.version }} == 3.5* ]]; then
38
+ ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests no-legacy
39
+ else
40
+ ./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests
41
+ fi
42
+ make -j4 && make install_sw && make install_fips
43
+ ;;
44
+ *)
45
+ echo "Don't know how to build OpenSSL ${{ inputs.version }}"
46
+ ;;
47
+ esac
48
+
49
+ - name: Save OpenSSL library cache
50
+ if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
51
+ id: cache-openssl-save
52
+ uses: actions/cache/save@v4
53
+ with:
54
+ path: ~/openssl
55
+ key: ${{ steps.cache-openssl-restore.outputs.cache-primary-key }}
@@ -0,0 +1,84 @@
1
+ name: Install Ruby
2
+
3
+ inputs:
4
+ version:
5
+ description: 'The version of Ruby to install'
6
+ required: true
7
+ openssl-version:
8
+ description: 'The version of OpenSSL used'
9
+ required: true
10
+
11
+ runs:
12
+ using: 'composite'
13
+ steps:
14
+ - name: Restore cached Ruby installation
15
+ id: cache-ruby-restore
16
+ uses: actions/cache/restore@v4
17
+ with:
18
+ path: ~/rubies/ruby-${{ inputs.version }}
19
+ key: ruby-${{ inputs.version }}-with-openssl-${{ inputs.openssl-version }}
20
+
21
+ - name: Install Ruby
22
+ if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
23
+ shell: bash
24
+ run: |
25
+ latest_patch=$(curl -s https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ \
26
+ | grep -oP "ruby-${{ inputs.version }}\.\d+\.tar\.xz" \
27
+ | grep -oP "\d+(?=\.tar\.xz)" \
28
+ | sort -V | tail -n 1)
29
+ wget https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ruby-${{ inputs.version }}.${latest_patch}.tar.xz
30
+ tar -xJvf ruby-${{ inputs.version }}.${latest_patch}.tar.xz
31
+ cd ruby-${{ inputs.version }}.${latest_patch}
32
+ ./configure --prefix=$HOME/rubies/ruby-${{ inputs.version }} --with-openssl-dir=$HOME/openssl
33
+ make
34
+ make install
35
+
36
+ - name: Update PATH
37
+ shell: bash
38
+ run: |
39
+ echo "~/rubies/ruby-${{ inputs.version }}/bin" >> $GITHUB_PATH
40
+
41
+ - name: Install Bundler
42
+ shell: bash
43
+ run: |
44
+ case ${{ inputs.version }} in
45
+ 2.7* | 3.*)
46
+ echo "Skipping Bundler installation for Ruby ${{ inputs.version }}"
47
+ ;;
48
+ 2.5* | 2.6*)
49
+ gem install bundler -v '~> 2.3.0'
50
+ ;;
51
+ *)
52
+ echo "Don't know how to install Bundler for Ruby ${{ inputs.version }}"
53
+ ;;
54
+ esac
55
+
56
+ - name: Save Ruby installation cache
57
+ if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
58
+ id: cache-ruby-save
59
+ uses: actions/cache/save@v4
60
+ with:
61
+ path: ~/rubies/ruby-${{ inputs.version }}
62
+ key: ${{ steps.cache-ruby-restore.outputs.cache-primary-key }}
63
+
64
+ - name: Cache Bundler Install
65
+ id: cache-bundler-restore
66
+ uses: actions/cache/restore@v4
67
+ env:
68
+ GEMFILE: ${{ env.BUNDLE_GEMFILE || 'Gemfile' }}
69
+ with:
70
+ path: ~/bundler/cache
71
+ key: bundler-ruby-${{ inputs.version }}-${{ inputs.openssl-version }}-${{ hashFiles(env.Gemfile, 'webauthn.gemspec') }}
72
+
73
+ - name: Install dependencies
74
+ shell: bash
75
+ run: |
76
+ bundle config set --local path ~/bundler/cache
77
+ bundle install
78
+
79
+ - name: Save Bundler Install cache
80
+ id: cache-bundler-save
81
+ uses: actions/cache/save@v4
82
+ with:
83
+ path: ~/bundler/cache
84
+ key: ${{ steps.cache-bundler-restore.outputs.cache-primary-key }}
@@ -15,6 +15,7 @@ on:
15
15
 
16
16
  jobs:
17
17
  test:
18
+ name: 'Test Ruby ${{ matrix.ruby }} with OpenSSL ${{ matrix.openssl }}'
18
19
  runs-on: ubuntu-24.04
19
20
  strategy:
20
21
  fail-fast: false
@@ -24,17 +25,48 @@ jobs:
24
25
  - '3.3'
25
26
  - '3.2'
26
27
  - '3.1'
27
- - '3.0'
28
- - '2.7'
29
- - '2.6'
30
- - '2.5'
31
- - truffleruby
28
+ openssl:
29
+ - '3.5.3'
30
+ - '3.4.2'
31
+ - '3.3.4'
32
+ - '3.2.5'
33
+ - '3.1.8'
34
+ - '3.0.17'
35
+ - '1.1.1w'
36
+ include:
37
+ - ruby: truffleruby
38
+ - ruby: '3.0'
39
+ openssl: '1.1.1w'
40
+ - ruby: '2.7'
41
+ openssl: '1.1.1w'
42
+ - ruby: '2.6'
43
+ openssl: '1.1.1w'
44
+ - ruby: '2.5'
45
+ openssl: '1.1.1w'
46
+
32
47
  steps:
33
- - uses: actions/checkout@v4
34
- - uses: ruby/setup-ruby@v1
48
+ - uses: actions/checkout@v5
49
+
50
+ - name: Install OpenSSL
51
+ if: matrix.ruby != 'truffleruby'
52
+ uses: ./.github/actions/install-openssl
53
+ with:
54
+ version: ${{ matrix.openssl }}
55
+
56
+ - name: Manually set up Ruby
57
+ if: matrix.ruby != 'truffleruby'
58
+ uses: ./.github/actions/install-ruby
59
+ with:
60
+ version: ${{ matrix.ruby }}
61
+ openssl-version: ${{ matrix.openssl }}
62
+
63
+ - name: Set up Ruby
64
+ if: matrix.ruby == 'truffleruby'
65
+ uses: ruby/setup-ruby@v1
35
66
  with:
36
67
  ruby-version: ${{ matrix.ruby }}
37
68
  bundler-cache: true
69
+
38
70
  - run: bundle exec rspec
39
71
  env:
40
72
  RUBYOPT: ${{ startsWith(matrix.ruby, '3.4') && '--enable=frozen-string-literal' || '' }}
@@ -42,7 +74,7 @@ jobs:
42
74
  lint:
43
75
  runs-on: ubuntu-latest
44
76
  steps:
45
- - uses: actions/checkout@v4
77
+ - uses: actions/checkout@v5
46
78
  - uses: ruby/setup-ruby@v1
47
79
  with:
48
80
  ruby-version: '3.3'
@@ -14,7 +14,7 @@ jobs:
14
14
  runs-on: ubuntu-latest
15
15
 
16
16
  steps:
17
- - uses: actions/checkout@v4
17
+ - uses: actions/checkout@v5
18
18
  - name: Block autosquash commits
19
19
  uses: xt0rted/block-autosquash-commits-action@v2
20
20
  with:
data/.rubocop.yml CHANGED
@@ -1,4 +1,4 @@
1
- require:
1
+ plugins:
2
2
  - rubocop-rspec
3
3
  - rubocop-rake
4
4
 
data/CHANGELOG.md CHANGED
@@ -1,5 +1,11 @@
1
1
  # Changelog
2
2
 
3
+ ## [v3.4.2] - 2025-09-22
4
+
5
+ ### Added
6
+
7
+ - Updated `safety_net_attestation` dependency from `~> 0.4.0` to `~> 0.5.0`.
8
+
3
9
  ## [v3.4.1] - 2025-06-06
4
10
 
5
11
  - Avoid requiring `base64` as it's not a direct dependency. [#459](https://github.com/cedarcode/webauthn-ruby/pull/459)[@santiagorodriguez96]
@@ -421,6 +427,7 @@ Note: Both additions should help making it compatible with Chrome for Android 70
421
427
  - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
422
428
  - Works with ruby 2.5
423
429
 
430
+ [v3.4.2]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.1...v3.4.2/
424
431
  [v3.4.1]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.0...v3.4.1/
425
432
  [v3.4.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.3.0...v3.4.0/
426
433
  [v3.3.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.2.2...v3.3.0/
data/README.md CHANGED
@@ -1,5 +1,5 @@
1
- __Note__: You are viewing the README for the development version of webauthn-ruby.
2
- For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/2-stable/README.md.
1
+ > [!warning]
2
+ > You are viewing the README for the development version of webauthn-ruby. For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/3-stable/README.md.
3
3
 
4
4
  # webauthn-ruby
5
5
 
@@ -4,24 +4,25 @@
4
4
 
5
5
  Which approach suits best your needs will depend on the architecture of your application and how do your users need to register and authenticate to it.
6
6
 
7
- If you have a multi-tenant application, or any application segmenation, where your users register and authenticate to each of these tenants or segments individuallly using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
7
+ If you have a multi-tenant application, or any application segmentation, where your users register and authenticate to each of these tenants or segments individually using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
8
8
 
9
- However, if your application is served for just one hostname, or else if your users authenticate to only one subdmain (e.g. your application serves www.example.com and admin.example.com but all you users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
9
+ However, if your application is served for just one hostname, or else if your users authenticate to only one subdomain (e.g. your application serves www.example.com and admin.example.com but all your users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
10
10
 
11
11
  If you are still not sure, or want to keep your options open, be aware that [Instance Based Configuration](#instance-based-configuration) is also a valid way of defining a single instance configuration and how you share such configuration across your application, it's up to you.
12
12
 
13
13
 
14
14
  ## Instance Based Configuration
15
15
 
16
- Intead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
16
+ Instead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
17
17
  you can now have an on-demand instance of `WebAuthn::RelyingParty` with the same configuration options, that
18
- you can build anywhere in you application, in the following way:
18
+ you can build anywhere in your application, in the following way:
19
19
 
20
20
  ```ruby
21
21
  relying_party = WebAuthn::RelyingParty.new(
22
22
  # This value needs to match `window.location.origin` evaluated by
23
23
  # the User Agent during registration and authentication ceremonies.
24
- origin: "https://admin.example.com",
24
+ # Multiple origins can be used when needed. Using more than one will imply you MUST configure rp_id explicitely. If you need your credentials to be bound to a single origin but you have more than one tenant, please see [our Advanced Configuration section](https://github.com/cedarcode/webauthn-ruby/blob/master/docs/advanced_configuration.md) instead of adding multiple origins.
25
+ allowed_origins: ["https://admin.example.com"],
25
26
 
26
27
  # Relying Party name for display purposes
27
28
  name: "Admin Site for Example Inc."
@@ -57,7 +58,7 @@ Intead of the [Global Configuration](../README.md#configuration) you place in `c
57
58
 
58
59
  ## Instance Based API
59
60
 
60
- **DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been throughly tested and it is fully functional it might be changed until the final release of version 3.0.0.**
61
+ **DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been thoroughly tested and it is fully functional it might be changed until the final release of version 3.0.0.**
61
62
 
62
63
  The explanation for each ceremony can be found in depth in [Credential Registration](../README.md#credential-registration) and [Credential Authentication](../README.md#credential-authentication) but if you choose this instance based approach to define your WebAuthn configurations and assuming `relying_party` is the result of an instance you get through `WebAuthn::RelyingParty.new(...)` the code in those explanations needs to be updated to:
63
64
 
@@ -101,7 +102,7 @@ session[:creation_challenge] = options.challenge
101
102
  begin
102
103
  webauthn_credential = relying_party.verify_registration(
103
104
  params[:publicKeyCredential],
104
- params[:create_challenge]
105
+ session[:creation_challenge]
105
106
  )
106
107
 
107
108
  # Store Credential ID, Credential Public Key and Sign Count for future authentications
@@ -159,7 +160,7 @@ begin
159
160
  # Continue with successful sign in or 2FA verification...
160
161
 
161
162
  rescue WebAuthn::SignCountVerificationError => e
162
- # Cryptographic verification of the authenticator data succeeded, but the signature counter was less then or equal
163
+ # Cryptographic verification of the authenticator data succeeded, but the signature counter was less than or equal
163
164
  # to the stored value. This can have several reasons and depending on your risk tolerance you can choose to fail or
164
165
  # pass authentication. For more information see https://www.w3.org/TR/webauthn/#sign-counter
165
166
  rescue WebAuthn::Error => e
@@ -171,4 +172,4 @@ end
171
172
 
172
173
  Adding a configuration for a new instance does not mean you need to get rid of your Global configuration. They can co-exist in your application and be both available for the different usages you might have. `WebAuthn.configuration.relying_party` will always return the global one while `WebAuthn::RelyingParty.new`, executed anywhere in your codebase, will allow you to create a different instance as you see the need. They will not collide and instead operate in isolation without any shared state.
173
174
 
174
- The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintain globally at `WebAuthn.configuration.relying_party`.
175
+ The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still be valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintained globally at `WebAuthn.configuration.relying_party`.
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module WebAuthn
4
- VERSION = "3.4.1"
4
+ VERSION = "3.4.2"
5
5
  end
data/webauthn.gemspec CHANGED
@@ -38,7 +38,7 @@ Gem::Specification.new do |spec|
38
38
  spec.add_dependency "cbor", "~> 0.5.9"
39
39
  spec.add_dependency "cose", "~> 1.1"
40
40
  spec.add_dependency "openssl", ">= 2.2"
41
- spec.add_dependency "safety_net_attestation", "~> 0.4.0"
41
+ spec.add_dependency "safety_net_attestation", "~> 0.5.0"
42
42
  spec.add_dependency "tpm-key_attestation", "~> 0.14.0"
43
43
 
44
44
  spec.add_development_dependency "bundler", ">= 1.17", "< 3.0"
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: webauthn
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.4.1
4
+ version: 3.4.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
9
9
  autorequire:
10
10
  bindir: exe
11
11
  cert_chain: []
12
- date: 2025-06-15 00:00:00.000000000 Z
12
+ date: 2025-09-23 00:00:00.000000000 Z
13
13
  dependencies:
14
14
  - !ruby/object:Gem::Dependency
15
15
  name: android_key_attestation
@@ -87,14 +87,14 @@ dependencies:
87
87
  requirements:
88
88
  - - "~>"
89
89
  - !ruby/object:Gem::Version
90
- version: 0.4.0
90
+ version: 0.5.0
91
91
  type: :runtime
92
92
  prerelease: false
93
93
  version_requirements: !ruby/object:Gem::Requirement
94
94
  requirements:
95
95
  - - "~>"
96
96
  - !ruby/object:Gem::Version
97
- version: 0.4.0
97
+ version: 0.5.0
98
98
  - !ruby/object:Gem::Dependency
99
99
  name: tpm-key_attestation
100
100
  requirement: !ruby/object:Gem::Requirement
@@ -229,6 +229,8 @@ executables: []
229
229
  extensions: []
230
230
  extra_rdoc_files: []
231
231
  files:
232
+ - ".github/actions/install-openssl/action.yml"
233
+ - ".github/actions/install-ruby/action.yml"
232
234
  - ".github/dependabot.yml"
233
235
  - ".github/workflows/build.yml"
234
236
  - ".github/workflows/git.yml"
@@ -317,7 +319,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
317
319
  - !ruby/object:Gem::Version
318
320
  version: '0'
319
321
  requirements: []
320
- rubygems_version: 3.5.11
322
+ rubygems_version: 3.2.1
321
323
  signing_key:
322
324
  specification_version: 4
323
325
  summary: WebAuthn ruby server library