[pull] master from ruby:master - #1370
Merged
Merged
Conversation
Bumps the rb-sys group with 1 update in the /test/rubygems/test_gem_ext_cargo_builder/custom_name/ext/custom_name_lib directory: [rb-sys](https://github.com/oxidize-rb/rb-sys). Bumps the rb-sys group with 1 update in the /test/rubygems/test_gem_ext_cargo_builder/rust_ruby_example directory: [rb-sys](https://github.com/oxidize-rb/rb-sys). Updates `rb-sys` from 0.9.128 to 0.9.130 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](oxidize-rb/rb-sys@v0.9.128...v0.9.130) Updates `rb-sys` from 0.9.128 to 0.9.130 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](oxidize-rb/rb-sys@v0.9.128...v0.9.130) Updates `rb-sys` from 0.9.128 to 0.9.130 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](oxidize-rb/rb-sys@v0.9.128...v0.9.130) Updates `rb-sys` from 0.9.128 to 0.9.130 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](oxidize-rb/rb-sys@v0.9.128...v0.9.130) --- updated-dependencies: - dependency-name: rb-sys dependency-version: 0.9.130 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rb-sys - dependency-name: rb-sys dependency-version: 0.9.130 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rb-sys ... Signed-off-by: dependabot[bot] <support@github.com> ruby/rubygems@929690eab0
…atch help text
The following help text and error message in lib/rubygems/security.rb show that
the order of algorithms is RSA, DSA, EC. Align the case branches in create_key with
this order.
```
-A, --key-algorithm ALGORITHM Select key algorithm for --build from RSA, DSA, or EC. Defaults to RSA.
```
```
"#{algorithm} algorithm not found. RSA, DSA, and EC algorithms are supported."
```
Assisted-by: Claude:Opus 4.6
ruby/rubygems@3f07a81aae
Acronyms should be in all caps for naming convention. Assisted-by: Claude:Opus 4.6 ruby/rubygems@7dc8e9e72d
* Move omit_unless_support_pqc from test_gem_remote_fetcher_local_ssl_server.rb to helper.rb so that all rubygems test files can use it * Create test/rubygems/pqc_utilities.rb to manage PQC utilities * Update local_ssl_server_utilities.rb to require and include pqc_utilities.rb Assisted-by: Claude:Opus 4.6 ruby/rubygems@6ccce5d35f
…y signed gems workflow These changes enable the full PQC ML-DSA cryptographically signed gems workflow: `gem cert --build` (key/cert generation), `gem build` (package signing), and `gem install -P HighSecurity` (signature verification). The `gem cert -A` accepts `ML-DSA-44`, `ML-DSA-65`, or `ML-DSA-87` to generate ML-DSA based cert and key. It raises `Gem::Security::Exception` if ML-DSA is not supported such as OpenSSL < 3.5. ``` $ gem cert --build your@email.com -A ML-DSA-44 $ gem cert --build your@email.com -A ML-DSA-65 $ gem cert --build your@email.com -A ML-DSA-87 ``` PQC algorithms ML-KEM and ML-DSA require OpenSSL >= 3.5. https://openssl-library.org/post/2025-04-08-openssl-35-final-release/ The reason why it accepts all 3 ML-DSA parameter sets rather than one of them is because all 3 ML-DSA parameter sets suit different workflows. While ML-DSA-65 can be used commonly, a high security environment requires ML-DSA-87. ML-DSA-44: NIST security strength category 2, signature size 2420 bytes ML-DSA-65: NIST security strength category 3, signature size 3309 bytes ML-DSA-87: NIST security strength category 5, signature size 4627 bytes See NIST FIPS 204 Section 4 (Parameter Sets). https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf See Security (Evaluation Criteria) - 4.A.5 Security Strength Categories. https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria) The ML-DSA signed gems workflow also includes * `gem cert -C cert.pem` * `gem cert -K private_key.pem` It raises `Gem::OptionParser::InvalidArgument` if ML-DSA is not supported. * `gem cert --add cert.pem` * `gem cert --remove filter` * `gem build gemname.gemspec` with `s.cert_chain` and `s.signing_key` to build signed gem. It raises `Gem::Security::Exception` if ML-DSA is not supported. * `gem install gemname -P HighSecurity` It raises `Gem::Security::Exception` on RSA server/client connection if ML-DSA is not supported. * `gem update gemname -P HighSecurity` It raises `Gem::Security::Exception` on RSA server/client connection if ML-DSA is not supported. The changes come from: * Ruby OpenSSL methods `#sign` (signing) and `#verify` don't accept digest algorithm, in ML-DSA cases because ML-DSA has a built-in digest * Unifying tool/create_certs.rb with tool/create_encrypted_key.rb to generate RSA and ML-DSA-65 keys/certificates. * Adding ML-DSA-65 related .pem files generated by tool/create_certs.rb. * Adding ML-DSA tests. We need many tests due to differences between `OpenSSL::PKey::RSA/DSA/EC` and `OpenSSL::PKey::PKey`. Note JRuby remains unsupported for the signed gems feature. The following tests have been skipped entirely in JRuby. * test/rubygems/test_gem_security.rb * test/rubygems/test_gem_commands_cert_command.rb See also https://guides.rubygems.org/security/ for the signed gems workflows. Assisted-by: Claude:Fable 5 ruby/rubygems@8135567fdb
Simplify PQC check not to depend on OpenSSL and Ruby OpenSSL versions. ruby/rubygems@303e1214a1
…e_cert defaults keyEncipherment should be set only when the subject public key is used for key transport, and dataEncipherment only when it is used to directly encrypt user data. RubyGems uses the key for neither purpose. These key usages are also not applicable to non-RSA keys. In preparation for ML-DSA support, remove them from the default settings. ruby/rubygems@46c869633b
…signing digest_required? treated every algorithm outside RSA, DSA and EC as digest-less, so a gemspec cert_chain could steer verification into a scheme nobody reviewed. Only ML-DSA belongs on that side of the branch. ruby/rubygems@62a5df0d15 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The signing tests were gated on the PQC handshake probe, which needs SSLContext#groups=. On OpenSSL >= 3.5 with Ruby OpenSSL < 4.0 all 23 were omitted even though ML-DSA keys work there, so the core of this PR went unverified. They now gate on ML-DSA key support, and the five that build a certificate gate on nil-digest X509 signing, which Ruby OpenSSL only accepts from 3.3 on. The algorithm assertions read the SubjectPublicKeyInfo instead of PKey#inspect, whose type_name field only exists from Ruby OpenSSL 4.0. The handshake probe also returned nil on its early exits, so its memoization never took and it rebound a TCP socket per call. ruby/rubygems@9a4353546d Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… signing fails Signing a certificate for an ML-DSA key passes a nil digest, which Ruby OpenSSL rejects with a bare TypeError before 3.3. On Ruby 3.2 or 3.3 with OpenSSL >= 3.5 the key generates and only `gem cert --build` breaks, so the message has to name the missing piece. ruby/rubygems@7817de95c2 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )