diff options
author | Samuel Giddins <segiddins@segiddins.me> | 2016-08-08 17:15:17 -0500 |
---|---|---|
committer | Samuel Giddins <segiddins@segiddins.me> | 2016-08-22 11:57:30 -0500 |
commit | 689aff2244c80f8246035a839e7d83bb26915a4d (patch) | |
tree | cca8f17178c645b48ac9b42d470a27e2ebb6fb59 /lib/bundler | |
parent | cdd286377909e8f1c116ce176a2a4c78105ab2fd (diff) | |
download | bundler-689aff2244c80f8246035a839e7d83bb26915a4d.tar.gz |
[RubyGemsGemInstaller] Validate checksums from the compact index
Diffstat (limited to 'lib/bundler')
-rw-r--r-- | lib/bundler/rubygems_gem_installer.rb | 27 | ||||
-rw-r--r-- | lib/bundler/source/rubygems.rb | 3 |
2 files changed, 29 insertions, 1 deletions
diff --git a/lib/bundler/rubygems_gem_installer.rb b/lib/bundler/rubygems_gem_installer.rb index e18f4626..cccd28e2 100644 --- a/lib/bundler/rubygems_gem_installer.rb +++ b/lib/bundler/rubygems_gem_installer.rb @@ -12,5 +12,32 @@ module Bundler def check_executable_overwrite(filename) # Bundler needs to install gems regardless of binstub overwriting end + + def pre_install_checks + super && validate_bundler_checksum(options[:bundler_expected_checksum]) + end + + private + + def validate_bundler_checksum(checksum) + return true unless checksum + return true unless source = @package.instance_variable_get(:@gem) + return true unless source.respond_to?(:with_read_io) + digest = source.with_read_io do |io| + digest = Digest::SHA256.new + digest << io.read(16_384) until io.eof? + io.rewind + digest.base64digest! + end + unless digest == checksum + raise SecurityError, + "The checksum for the downloaded `#{spec.full_name}.gem` did not match " \ + "the checksum given by the API. This means that the contents of the " \ + "gem appear to be different from what was uploaded, and could be an indicator of a security issue.\n" \ + "(The expected SHA256 checksum was #{checksum.inspect}, but the checksum for the downloaded gem was #{digest.inspect}.)\n" \ + "Bundler cannot continue installing #{spec.name} (#{spec.version})." + end + true + end end end diff --git a/lib/bundler/source/rubygems.rb b/lib/bundler/source/rubygems.rb index aedad708..89f7673e 100644 --- a/lib/bundler/source/rubygems.rb +++ b/lib/bundler/source/rubygems.rb @@ -140,7 +140,8 @@ module Bundler :bin_dir => bin_path.to_s, :ignore_dependencies => true, :wrappers => true, - :env_shebang => true + :env_shebang => true, + :bundler_expected_checksum => spec.respond_to?(:checksum) && spec.checksum ).install end spec.full_gem_path = installed_spec.full_gem_path |