kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Revert r42938 "* lib/rubygems: Update to RubyGems 2.1.3"

Browse source 
It breaks build.
20130913T200302Z.diff.html.gz

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@42941 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
naruse 2013-09-14 08:59:02 +00:00
parent 2614d9ba2f
commit 269503b544
110 changed files with 4928 additions and 3479 deletions
Download patch file Download diff file Expand all files Collapse all files

49
lib/rubygems/security/policy.rb
View file

@ -1,3 +1,5 @@
require 'rubygems/user_interaction'
##
# A Gem::Security::Policy object encapsulates the settings for verifying
# signed gem files. This is the base class. You can either declare an
@ -6,6 +8,8 @@
class Gem::Security::Policy
include Gem::UserInteraction
attr_reader :name
attr_accessor :only_signed
@ -175,6 +179,19 @@ class Gem::Security::Policy
true
end
##
# Extracts the email or subject from +certificate+
def subject certificate # :nodoc:
certificate.extensions.each do |extension|
next unless extension.oid == 'subjectAltName'
return extension.value
end
certificate.subject.to_s
end
def inspect # :nodoc:
("[Policy: %s - data: %p signer: %p chain: %p root: %p " +
"signed-only: %p trusted-only: %p]") % [
@ -184,16 +201,24 @@ class Gem::Security::Policy
end
##
# Verifies the certificate +chain+ is valid, the +digests+ match the
# signatures +signatures+ created by the signer depending on the +policy+
# settings.
# For +full_name+, verifies the certificate +chain+ is valid, the +digests+
# match the signatures +signatures+ created by the signer depending on the
# +policy+ settings.
#
# If +key+ is given it is used to validate the signing certificate.
def verify chain, key = nil, digests = {}, signatures = {}
if @only_signed and signatures.empty? then
raise Gem::Security::Exception,
"unsigned gems are not allowed by the #{name} policy"
def verify chain, key = nil, digests = {}, signatures = {},
full_name = '(unknown)'
if signatures.empty? then
if @only_signed then
raise Gem::Security::Exception,
"unsigned gems are not allowed by the #{name} policy"
elsif digests.empty? then
# lack of signatures is irrelevant if there is nothing to check
# against
else
alert_warning "#{full_name} is not signed"
end
end
opt = @opt
@ -222,7 +247,13 @@ class Gem::Security::Policy
check_root chain, time if @verify_root
check_trust chain, digester, trust_dir if @only_trusted
if @only_trusted then
check_trust chain, digester, trust_dir
elsif signatures.empty? and digests.empty? then
# trust is irrelevant if there's no signatures to verify
else
alert_warning "#{subject signer} is not trusted for #{full_name}"
end
signatures.each do |file, _|
digest = signer_digests[file]
@ -252,7 +283,7 @@ class Gem::Security::Policy
OpenSSL::X509::Certificate.new cert_pem
end
verify chain, nil, digests, signatures
verify chain, nil, digests, signatures, spec.full_name
true
end