diff options
Diffstat (limited to 'lib/rubygems/security/policy.rb')
| -rw-r--r-- | lib/rubygems/security/policy.rb | 59 |
1 files changed, 28 insertions, 31 deletions
diff --git a/lib/rubygems/security/policy.rb b/lib/rubygems/security/policy.rb index 9683e55b32..7b86ac5763 100644 --- a/lib/rubygems/security/policy.rb +++ b/lib/rubygems/security/policy.rb @@ -1,5 +1,6 @@ # frozen_string_literal: true -require_relative '../user_interaction' + +require_relative "../user_interaction" ## # A Gem::Security::Policy object encapsulates the settings for verifying @@ -53,8 +54,8 @@ class Gem::Security::Policy # and is valid for the given +time+. def check_chain(chain, time) - raise Gem::Security::Exception, 'missing signing chain' unless chain - raise Gem::Security::Exception, 'empty signing chain' if chain.empty? + raise Gem::Security::Exception, "missing signing chain" unless chain + raise Gem::Security::Exception, "empty signing chain" if chain.empty? begin chain.each_cons 2 do |issuer, cert| @@ -83,21 +84,21 @@ class Gem::Security::Policy # If the +issuer+ is +nil+ no verification is performed. def check_cert(signer, issuer, time) - raise Gem::Security::Exception, 'missing signing certificate' unless + raise Gem::Security::Exception, "missing signing certificate" unless signer message = "certificate #{signer.subject}" - if not_before = signer.not_before and not_before > time + if (not_before = signer.not_before) && not_before > time raise Gem::Security::Exception, "#{message} not valid before #{not_before}" end - if not_after = signer.not_after and not_after < time + if (not_after = signer.not_after) && not_after < time raise Gem::Security::Exception, "#{message} not valid after #{not_after}" end - if issuer and not signer.verify issuer.public_key + if issuer && !signer.verify(issuer.public_key) raise Gem::Security::Exception, "#{message} was not issued by #{issuer.subject}" end @@ -109,15 +110,15 @@ class Gem::Security::Policy # Ensures the public key of +key+ matches the public key in +signer+ def check_key(signer, key) - unless signer and key + unless signer && key return true unless @only_signed - raise Gem::Security::Exception, 'missing key or signature' + raise Gem::Security::Exception, "missing key or signature" end raise Gem::Security::Exception, "certificate #{signer.subject} does not match the signing key" unless - signer.public_key.to_pem == key.public_key.to_pem + signer.check_private_key(key) true end @@ -127,14 +128,14 @@ class Gem::Security::Policy # +time+. def check_root(chain, time) - raise Gem::Security::Exception, 'missing signing chain' unless chain + raise Gem::Security::Exception, "missing signing chain" unless chain root = chain.first - raise Gem::Security::Exception, 'missing root certificate' unless root + raise Gem::Security::Exception, "missing root certificate" unless root raise Gem::Security::Exception, - "root certificate #{root.subject} is not self-signed " + + "root certificate #{root.subject} is not self-signed " \ "(issuer #{root.issuer})" if root.issuer != root.subject @@ -146,11 +147,11 @@ class Gem::Security::Policy # the digests of the two certificates match according to +digester+ def check_trust(chain, digester, trust_dir) - raise Gem::Security::Exception, 'missing signing chain' unless chain + raise Gem::Security::Exception, "missing signing chain" unless chain root = chain.first - raise Gem::Security::Exception, 'missing root certificate' unless root + raise Gem::Security::Exception, "missing root certificate" unless root path = Gem::Security.trust_dir.cert_path root @@ -164,13 +165,13 @@ class Gem::Security::Policy end save_cert = OpenSSL::X509::Certificate.new File.read path - save_dgst = digester.digest save_cert.public_key.to_s + save_dgst = digester.digest save_cert.public_key.to_pem - pkey_str = root.public_key.to_s + pkey_str = root.public_key.to_pem cert_dgst = digester.digest pkey_str raise Gem::Security::Exception, - "trusted root certificate #{root.subject} checksum " + + "trusted root certificate #{root.subject} checksum " \ "does not match signing root certificate checksum" unless save_dgst == cert_dgst @@ -182,7 +183,7 @@ class Gem::Security::Policy def subject(certificate) # :nodoc: certificate.extensions.each do |extension| - next unless extension.oid == 'subjectAltName' + next unless extension.oid == "subjectAltName" return extension.value end @@ -191,11 +192,8 @@ class Gem::Security::Policy end def inspect # :nodoc: - ("[Policy: %s - data: %p signer: %p chain: %p root: %p " + - "signed-only: %p trusted-only: %p]") % [ - @name, @verify_chain, @verify_data, @verify_root, @verify_signer, - @only_signed, @only_trusted - ] + format("[Policy: %s - data: %p signer: %p chain: %p root: %p " \ + "signed-only: %p trusted-only: %p]", @name, @verify_chain, @verify_data, @verify_root, @verify_signer, @only_signed, @only_trusted) end ## @@ -205,8 +203,7 @@ class Gem::Security::Policy # # If +key+ is given it is used to validate the signing certificate. - def verify(chain, key = nil, digests = {}, signatures = {}, - full_name = '(unknown)') + def verify(chain, key = nil, digests = {}, signatures = {}, full_name = "(unknown)") if signatures.empty? if @only_signed raise Gem::Security::Exception, @@ -225,13 +222,13 @@ class Gem::Security::Policy trust_dir = opt[:trust_dir] time = Time.now - _, signer_digests = digests.find do |algorithm, file_digests| + _, signer_digests = digests.find do |_algorithm, file_digests| file_digests.values.first.name == Gem::Security::DIGEST_NAME end if @verify_data - raise Gem::Security::Exception, 'no digests provided (probable bug)' if - signer_digests.nil? or signer_digests.empty? + raise Gem::Security::Exception, "no digests provided (probable bug)" if + signer_digests.nil? || signer_digests.empty? else signer_digests = {} end @@ -248,7 +245,7 @@ class Gem::Security::Policy if @only_trusted check_trust chain, digester, trust_dir - elsif signatures.empty? and digests.empty? + elsif signatures.empty? && digests.empty? # trust is irrelevant if there's no signatures to verify else alert_warning "#{subject signer} is not trusted for #{full_name}" @@ -287,5 +284,5 @@ class Gem::Security::Policy true end - alias to_s name # :nodoc: + alias_method :to_s, :name # :nodoc: end |