kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

[rubygems/rubygems] Simplify digest name selection and use SHA256

Browse source 
The previous commit introduces the Gem::Security.create_digest method, allowing to:
- decouple algorithm choice from implementation (OpenSSL or Ruby built-in)
- untangle the SHA512 fallback for TarWriter from the generic hashing digest choice (undoing commit 9471f8ed2bdc12248d2619bbbce6e53cd6c16cb6)

https://github.com/rubygems/rubygems/commit/1bc03231e4
This commit is contained in:
Bart de Water 2020-06-29 18:31:15 -04:00 • committed by Hiroshi SHIBATA
parent 8161cf85ba
commit 734c5276f0
Notes: git 2020-07-31 21:08:28 +09:00
2 changed files with 2 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/rubygems/package/tar_writer.rb
View file

@ -4,8 +4,6 @@
# See LICENSE.txt for additional licensing information. # See LICENSE.txt for additional licensing information.
#++ #++
require 'digest'
## ##
# Allows writing of tar files # Allows writing of tar files
@ -168,7 +166,7 @@ class Gem::Package::TarWriter
def add_file_signed(name, mode, signer) def add_file_signed(name, mode, signer)
digest_algorithms = [ digest_algorithms = [
signer.digest_algorithm, signer.digest_algorithm,
Digest::SHA512.new, Gem::Security.create_digest('SHA512'),
].compact.uniq ].compact.uniq
digests = add_file_digest name, mode, digest_algorithms do |io| digests = add_file_digest name, mode, digest_algorithms do |io|

9
lib/rubygems/security.rb
View file

@ -341,14 +341,7 @@ module Gem::Security
## ##
# Used internally to select the signing digest from all computed digests # Used internally to select the signing digest from all computed digests
DIGEST_NAME = # :nodoc: DIGEST_NAME = 'SHA256' # :nodoc:
if defined?(OpenSSL::Digest::SHA256)
'SHA256'
elsif defined?(OpenSSL::Digest::SHA1)
'SHA1'
else
'SHA512'
end
## ##
# Algorithm for creating the key pair used to sign gems # Algorithm for creating the key pair used to sign gems