mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
314 lines
8.9 KiB
Ruby
314 lines
8.9 KiB
Ruby
# frozen_string_literal: true
|
|
require 'rubygems/command'
|
|
require 'rubygems/security'
|
|
|
|
class Gem::Commands::CertCommand < Gem::Command
|
|
def initialize
|
|
super 'cert', 'Manage RubyGems certificates and signing settings',
|
|
:add => [], :remove => [], :list => [], :build => [], :sign => []
|
|
|
|
OptionParser.accept OpenSSL::X509::Certificate do |certificate_file|
|
|
begin
|
|
certificate = OpenSSL::X509::Certificate.new File.read certificate_file
|
|
rescue Errno::ENOENT
|
|
raise OptionParser::InvalidArgument, "#{certificate_file}: does not exist"
|
|
rescue OpenSSL::X509::CertificateError
|
|
raise OptionParser::InvalidArgument,
|
|
"#{certificate_file}: invalid X509 certificate"
|
|
end
|
|
[certificate, certificate_file]
|
|
end
|
|
|
|
OptionParser.accept OpenSSL::PKey::RSA do |key_file|
|
|
begin
|
|
passphrase = ENV['GEM_PRIVATE_KEY_PASSPHRASE']
|
|
key = OpenSSL::PKey::RSA.new File.read(key_file), passphrase
|
|
rescue Errno::ENOENT
|
|
raise OptionParser::InvalidArgument, "#{key_file}: does not exist"
|
|
rescue OpenSSL::PKey::RSAError
|
|
raise OptionParser::InvalidArgument, "#{key_file}: invalid RSA key"
|
|
end
|
|
|
|
raise OptionParser::InvalidArgument,
|
|
"#{key_file}: private key not found" unless key.private?
|
|
|
|
key
|
|
end
|
|
|
|
add_option('-a', '--add CERT', OpenSSL::X509::Certificate,
|
|
'Add a trusted certificate.') do |(cert, _), options|
|
|
options[:add] << cert
|
|
end
|
|
|
|
add_option('-l', '--list [FILTER]',
|
|
'List trusted certificates where the',
|
|
'subject contains FILTER') do |filter, options|
|
|
filter ||= ''
|
|
|
|
options[:list] << filter
|
|
end
|
|
|
|
add_option('-r', '--remove FILTER',
|
|
'Remove trusted certificates where the',
|
|
'subject contains FILTER') do |filter, options|
|
|
options[:remove] << filter
|
|
end
|
|
|
|
add_option('-b', '--build EMAIL_ADDR',
|
|
'Build private key and self-signed',
|
|
'certificate for EMAIL_ADDR') do |email_address, options|
|
|
options[:build] << email_address
|
|
end
|
|
|
|
add_option('-C', '--certificate CERT', OpenSSL::X509::Certificate,
|
|
'Signing certificate for --sign') do |(cert, cert_file), options|
|
|
options[:issuer_cert] = cert
|
|
options[:issuer_cert_file] = cert_file
|
|
end
|
|
|
|
add_option('-K', '--private-key KEY', OpenSSL::PKey::RSA,
|
|
'Key for --sign or --build') do |key, options|
|
|
options[:key] = key
|
|
end
|
|
|
|
add_option('-s', '--sign CERT',
|
|
'Signs CERT with the key from -K',
|
|
'and the certificate from -C') do |cert_file, options|
|
|
raise OptionParser::InvalidArgument, "#{cert_file}: does not exist" unless
|
|
File.file? cert_file
|
|
|
|
options[:sign] << cert_file
|
|
end
|
|
|
|
add_option('-d', '--days NUMBER_OF_DAYS',
|
|
'Days before the certificate expires') do |days, options|
|
|
options[:expiration_length_days] = days.to_i
|
|
end
|
|
|
|
add_option('-R', '--re-sign',
|
|
'Re-signs the certificate from -C with the key from -K') do |resign, options|
|
|
options[:resign] = resign
|
|
end
|
|
end
|
|
|
|
def add_certificate(certificate) # :nodoc:
|
|
Gem::Security.trust_dir.trust_cert certificate
|
|
|
|
say "Added '#{certificate.subject}'"
|
|
end
|
|
|
|
def execute
|
|
options[:add].each do |certificate|
|
|
add_certificate certificate
|
|
end
|
|
|
|
options[:remove].each do |filter|
|
|
remove_certificates_matching filter
|
|
end
|
|
|
|
options[:list].each do |filter|
|
|
list_certificates_matching filter
|
|
end
|
|
|
|
options[:build].each do |email|
|
|
build email
|
|
end
|
|
|
|
if options[:resign]
|
|
re_sign_cert(
|
|
options[:issuer_cert],
|
|
options[:issuer_cert_file],
|
|
options[:key]
|
|
)
|
|
end
|
|
|
|
sign_certificates unless options[:sign].empty?
|
|
end
|
|
|
|
def build(email)
|
|
if !valid_email?(email)
|
|
raise Gem::CommandLineError, "Invalid email address #{email}"
|
|
end
|
|
|
|
key, key_path = build_key
|
|
cert_path = build_cert email, key
|
|
|
|
say "Certificate: #{cert_path}"
|
|
|
|
if key_path
|
|
say "Private Key: #{key_path}"
|
|
say "Don't forget to move the key file to somewhere private!"
|
|
end
|
|
end
|
|
|
|
def build_cert(email, key) # :nodoc:
|
|
expiration_length_days = options[:expiration_length_days] ||
|
|
Gem.configuration.cert_expiration_length_days
|
|
|
|
cert = Gem::Security.create_cert_email(
|
|
email,
|
|
key,
|
|
(Gem::Security::ONE_DAY * expiration_length_days)
|
|
)
|
|
|
|
Gem::Security.write cert, "gem-public_cert.pem"
|
|
end
|
|
|
|
def build_key # :nodoc:
|
|
return options[:key] if options[:key]
|
|
|
|
passphrase = ask_for_password 'Passphrase for your Private Key:'
|
|
say "\n"
|
|
|
|
passphrase_confirmation = ask_for_password 'Please repeat the passphrase for your Private Key:'
|
|
say "\n"
|
|
|
|
raise Gem::CommandLineError,
|
|
"Passphrase and passphrase confirmation don't match" unless passphrase == passphrase_confirmation
|
|
|
|
key = Gem::Security.create_key
|
|
key_path = Gem::Security.write key, "gem-private_key.pem", 0600, passphrase
|
|
|
|
return key, key_path
|
|
end
|
|
|
|
def certificates_matching(filter)
|
|
return enum_for __method__, filter unless block_given?
|
|
|
|
Gem::Security.trusted_certificates.select do |certificate, _|
|
|
subject = certificate.subject.to_s
|
|
subject.downcase.index filter
|
|
end.sort_by do |certificate, _|
|
|
certificate.subject.to_a.map {|name, data,| [name, data] }
|
|
end.each do |certificate, path|
|
|
yield certificate, path
|
|
end
|
|
end
|
|
|
|
def description # :nodoc:
|
|
<<-EOF
|
|
The cert command manages signing keys and certificates for creating signed
|
|
gems. Your signing certificate and private key are typically stored in
|
|
~/.gem/gem-public_cert.pem and ~/.gem/gem-private_key.pem respectively.
|
|
|
|
To build a certificate for signing gems:
|
|
|
|
gem cert --build you@example
|
|
|
|
If you already have an RSA key, or are creating a new certificate for an
|
|
existing key:
|
|
|
|
gem cert --build you@example --private-key /path/to/key.pem
|
|
|
|
If you wish to trust a certificate you can add it to the trust list with:
|
|
|
|
gem cert --add /path/to/cert.pem
|
|
|
|
You can list trusted certificates with:
|
|
|
|
gem cert --list
|
|
|
|
or:
|
|
|
|
gem cert --list cert_subject_substring
|
|
|
|
If you wish to remove a previously trusted certificate:
|
|
|
|
gem cert --remove cert_subject_substring
|
|
|
|
To sign another gem author's certificate:
|
|
|
|
gem cert --sign /path/to/other_cert.pem
|
|
|
|
For further reading on signing gems see `ri Gem::Security`.
|
|
EOF
|
|
end
|
|
|
|
def list_certificates_matching(filter) # :nodoc:
|
|
certificates_matching filter do |certificate, _|
|
|
# this could probably be formatted more gracefully
|
|
say certificate.subject.to_s
|
|
end
|
|
end
|
|
|
|
def load_default_cert
|
|
cert_file = File.join Gem.default_cert_path
|
|
cert = File.read cert_file
|
|
options[:issuer_cert] = OpenSSL::X509::Certificate.new cert
|
|
rescue Errno::ENOENT
|
|
alert_error \
|
|
"--certificate not specified and ~/.gem/gem-public_cert.pem does not exist"
|
|
|
|
terminate_interaction 1
|
|
rescue OpenSSL::X509::CertificateError
|
|
alert_error \
|
|
"--certificate not specified and ~/.gem/gem-public_cert.pem is not valid"
|
|
|
|
terminate_interaction 1
|
|
end
|
|
|
|
def load_default_key
|
|
key_file = File.join Gem.default_key_path
|
|
key = File.read key_file
|
|
passphrase = ENV['GEM_PRIVATE_KEY_PASSPHRASE']
|
|
options[:key] = OpenSSL::PKey::RSA.new key, passphrase
|
|
rescue Errno::ENOENT
|
|
alert_error \
|
|
"--private-key not specified and ~/.gem/gem-private_key.pem does not exist"
|
|
|
|
terminate_interaction 1
|
|
rescue OpenSSL::PKey::RSAError
|
|
alert_error \
|
|
"--private-key not specified and ~/.gem/gem-private_key.pem is not valid"
|
|
|
|
terminate_interaction 1
|
|
end
|
|
|
|
def load_defaults # :nodoc:
|
|
load_default_cert unless options[:issuer_cert]
|
|
load_default_key unless options[:key]
|
|
end
|
|
|
|
def remove_certificates_matching(filter) # :nodoc:
|
|
certificates_matching filter do |certificate, path|
|
|
FileUtils.rm path
|
|
say "Removed '#{certificate.subject}'"
|
|
end
|
|
end
|
|
|
|
def sign(cert_file)
|
|
cert = File.read cert_file
|
|
cert = OpenSSL::X509::Certificate.new cert
|
|
|
|
permissions = File.stat(cert_file).mode & 0777
|
|
|
|
issuer_cert = options[:issuer_cert]
|
|
issuer_key = options[:key]
|
|
|
|
cert = Gem::Security.sign cert, issuer_key, issuer_cert
|
|
|
|
Gem::Security.write cert, cert_file, permissions
|
|
end
|
|
|
|
def sign_certificates # :nodoc:
|
|
load_defaults unless options[:sign].empty?
|
|
|
|
options[:sign].each do |cert_file|
|
|
sign cert_file
|
|
end
|
|
end
|
|
|
|
def re_sign_cert(cert, cert_path, private_key)
|
|
Gem::Security::Signer.re_sign_cert(cert, cert_path, private_key) do |expired_cert_path, new_expired_cert_path|
|
|
alert("Your certificate #{expired_cert_path} has been re-signed")
|
|
alert("Your expired certificate will be located at: #{new_expired_cert_path}")
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def valid_email?(email)
|
|
# It's simple, but is all we need
|
|
email =~ /\A.+@.+\z/
|
|
end
|
|
end if defined?(OpenSSL::SSL)
|