mirror of
https://github.com/ruby/ruby.git
synced 2025-09-18 18:13:58 +02:00
90df7a08e4
Merge RubyGems-2.7.5 from upstream. Please see its details: http://blog.rubygems.org/2018/02/06/2.7.5-released.html test_gem_util.rb: fix broken test * test/rubygems/test_gem_util.rb: no guarantee that tmpdir is always underneath the root directory at all. test_gem_commands_setup_command.rb: BUNDLER_VERS * test/rubygems/test_gem_commands_setup_command.rb: run bundled gem command, instead of installed one. no need to set bundled bundler unless Gem::USE_BUNDLER_FOR_GEMDEPS revert r62302 and force to define the version constant Merge RubyGems 2.7.6 from upstream. It fixed some security vulnerabilities. http://blog.rubygems.org/2018/02/15/2.7.6-released.html fix regexp literal warning. test/rubygems/test_gem_server.rb: eliminate duplicated character class warning. [Bug #14481] Remove unnecessary `[]`s git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62837 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
119 lines
2.5 KiB
Ruby
119 lines
2.5 KiB
Ruby
# frozen_string_literal: true
|
|
##
|
|
# The TrustDir manages the trusted certificates for gem signature
|
|
# verification.
|
|
|
|
class Gem::Security::TrustDir
|
|
|
|
##
|
|
# Default permissions for the trust directory and its contents
|
|
|
|
DEFAULT_PERMISSIONS = {
|
|
:trust_dir => 0700,
|
|
:trusted_cert => 0600,
|
|
}
|
|
|
|
##
|
|
# The directory where trusted certificates will be stored.
|
|
|
|
attr_reader :dir
|
|
|
|
##
|
|
# Creates a new TrustDir using +dir+ where the directory and file
|
|
# permissions will be checked according to +permissions+
|
|
|
|
def initialize dir, permissions = DEFAULT_PERMISSIONS
|
|
@dir = dir
|
|
@permissions = permissions
|
|
|
|
@digester = Gem::Security::DIGEST_ALGORITHM
|
|
end
|
|
|
|
##
|
|
# Returns the path to the trusted +certificate+
|
|
|
|
def cert_path certificate
|
|
name_path certificate.subject
|
|
end
|
|
|
|
##
|
|
# Enumerates trusted certificates.
|
|
|
|
def each_certificate
|
|
return enum_for __method__ unless block_given?
|
|
|
|
glob = File.join @dir, '*.pem'
|
|
|
|
Dir[glob].each do |certificate_file|
|
|
begin
|
|
certificate = load_certificate certificate_file
|
|
|
|
yield certificate, certificate_file
|
|
rescue OpenSSL::X509::CertificateError
|
|
next # HACK warn
|
|
end
|
|
end
|
|
end
|
|
|
|
##
|
|
# Returns the issuer certificate of the given +certificate+ if it exists in
|
|
# the trust directory.
|
|
|
|
def issuer_of certificate
|
|
path = name_path certificate.issuer
|
|
|
|
return unless File.exist? path
|
|
|
|
load_certificate path
|
|
end
|
|
|
|
##
|
|
# Returns the path to the trusted certificate with the given ASN.1 +name+
|
|
|
|
def name_path name
|
|
digest = @digester.hexdigest name.to_s
|
|
|
|
File.join @dir, "cert-#{digest}.pem"
|
|
end
|
|
|
|
##
|
|
# Loads the given +certificate_file+
|
|
|
|
def load_certificate certificate_file
|
|
pem = File.read certificate_file
|
|
|
|
OpenSSL::X509::Certificate.new pem
|
|
end
|
|
|
|
##
|
|
# Add a certificate to trusted certificate list.
|
|
|
|
def trust_cert certificate
|
|
verify
|
|
|
|
destination = cert_path certificate
|
|
|
|
File.open destination, 'wb', @permissions[:trusted_cert] do |io|
|
|
io.write certificate.to_pem
|
|
end
|
|
end
|
|
|
|
##
|
|
# Make sure the trust directory exists. If it does exist, make sure it's
|
|
# actually a directory. If not, then create it with the appropriate
|
|
# permissions.
|
|
|
|
def verify
|
|
if File.exist? @dir then
|
|
raise Gem::Security::Exception,
|
|
"trust directory #{@dir} is not a directory" unless
|
|
File.directory? @dir
|
|
|
|
FileUtils.chmod 0700, @dir
|
|
else
|
|
FileUtils.mkdir_p @dir, :mode => @permissions[:trust_dir]
|
|
end
|
|
end
|
|
|
|
end
|
|
|