Skip to content

Commit 4d762fa

Browse files
committed
rubygems: Fix Gem::Request for PQC support, adding integration connection tests
Added PQC server/client connection integration tests. As test_pqc_ssl_client_cert_auth_connection failed with the following error due to hardcoded `OpenSSL::PKey::RSA.new` in `Gem::Request.configure_connection_for_https`, fixed it to support ML-DSA ssl_client_cert. ``` Error: test_pqc_ssl_client_cert_auth_connection(TestGemRemoteFetcherLocalSSLServer): OpenSSL::PKey::PKeyError: incorrect pkey type: UNDEF /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'OpenSSL::PKey::RSA#initialize' /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'Class#new' /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'OpenSSL::PKey::RSA.new' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request.rb:64:in 'Gem::Request.configure_connection_for_https' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request/https_pool.rb:7:in 'Gem::Request::HTTPSPool#setup_connection' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request/http_pool.rb:43:in 'Gem::Request::HTTPPool#make_connection' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request/http_pool.rb:23:in 'Gem::Request::HTTPPool#checkout' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request.rb:136:in 'Gem::Request#connection_for' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request.rb:194:in 'Gem::Request#perform_request' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/request.rb:161:in 'Gem::Request#fetch' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/remote_fetcher.rb:326:in 'Gem::RemoteFetcher#request' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/remote_fetcher.rb:217:in 'Gem::RemoteFetcher#fetch_http' /home/jaruga/var/git/ruby/rubygems/lib/rubygems/remote_fetcher.rb:261:in 'Gem::RemoteFetcher#fetch_path' /home/jaruga/var/git/ruby/rubygems/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb:98:in 'block in TestGemRemoteFetcherLocalSSLServer#test_pqc_ssl_client_cert_auth_connection' 95: ":ssl_ca_cert: #{temp_ca_cert}\n" \ 96: ":ssl_client_cert: #{temp_client_cert}\n" 97: ) do |fetcher| => 98: fetcher.fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml") 99: end 100: end 101: /home/jaruga/var/git/ruby/rubygems/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb:174:in 'TestGemRemoteFetcherLocalSSLServer#with_configured_fetcher' /home/jaruga/var/git/ruby/rubygems/test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb:94:in 'TestGemRemoteFetcherLocalSSLServer#test_pqc_ssl_client_cert_auth_connection' ``` In test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb, created new tests, test_pqc_ssl_connection and test_pqc_ssl_client_cert_auth_connection The `start_ssl_server` has 2 modes: :non_pqc (default) and :pqc. With the mode :pqc, `start_ssl_server` runs with the RubyGems single PQC server with ML-KEM (X25519MLKEM768) key exchange and ML-DSA-65 certification. Selected X25519MLKEM768 because rubygems.org supports X25519MLKEM768 for now. Selected ML-DSA-65 because it is used and tested https://github.com/ruby/openssl/blob/master/test/openssl/test_ssl.rb - test_pqc_sigalg Created `tool/create_mldsa65_certs.sh` to create ML-DSA-65 cert files, `test/rubygems/mldsa65_*.pem`. It is inspired by `tool/create_certs.sh` to create RSA cert files, `test/rubygems/*.pem`. Note the 65 in ML-DSA-65 is not bit length. ML-DSA-65 is algorithm name.
1 parent a89e1cb commit 4d762fa

7 files changed

Lines changed: 624 additions & 6 deletions

File tree

lib/rubygems/request.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ def self.configure_connection_for_https(connection, cert_files)
6161
if Gem.configuration.ssl_client_cert
6262
pem = File.read Gem.configuration.ssl_client_cert
6363
connection.cert = OpenSSL::X509::Certificate.new pem
64-
connection.key = OpenSSL::PKey::RSA.new pem
64+
connection.key = OpenSSL::PKey.read pem
6565
end
6666

6767
store.set_default_paths

test/rubygems/mldsa65_ca_cert.pem

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIV3DCCCNmgAwIBAgIUchMTGFFLB1Gm+ufumzApE6z5JUswCwYJYIZIAWUDBAMS
3+
MEExCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVUb2t5bzEVMBMGA1UECgwMUnVieUdl
4+
bXNUZXN0MQswCQYDVQQDDAJDQTAeFw0wOTAxMDEwMDAwMDBaFw00OTEyMzEyMzU5
5+
NTlaMEExCzAJBgNVBAYTAkpQMQ4wDAYDVQQIDAVUb2t5bzEVMBMGA1UECgwMUnVi
6+
eUdlbXNUZXN0MQswCQYDVQQDDAJDQTCCB7IwCwYJYIZIAWUDBAMSA4IHoQCTRGwM
7+
LF+sWXTTcp6/iu+heLosEXP4XPbmf0o78azm87UGo11E2fxwC+2Q5dGrrPZyT5KG
8+
IhzKkg9R6ZmJqgQnWjhMuu93I64RtfY69yQuvcDiWVqRHjZL6WOgvcKVdqrwGZQg
9+
sA+h0Hb16OtHrdJVvEmVm5+Daijef3I4PM7pzEFMpPPcTZJ/vxeRZYBRkVnp62Sv
10+
xe1WTVPTY4iSHTHycWngUtmiNffyRTy0oWNy+G6pNqJ7ulOmGhn1EbtE2SUCmrUG
11+
JLMSOmJFFs8RGm9ftOxl5Ltrj0ehscfCI/h11IRdYXTpPjGfyiUi0FCko7gT4lqZ
12+
Pr8ZBaJPHgXtS73DbeD3bR8Lmq+ELE8XHa6tGpg/f8cf3O78CAkEFDRUaNfuO+2i
13+
pSMK8yCMxoW3jCT/UbsAUcBKNexWg92eJgEf/5Cj4VKbymHbxXif32MHbDPQi1iE
14+
r8txrZvjW1ElrM57mURZmoznTRCeSH5Ik7UnegT2UbAlWASivvVObpEysV9qTkDu
15+
npUQ4D3Y7nZkQIfahYGmzJw3idwDGoRRB3B9b/Ry9c5khV0zwxplbb8HUZHJsiJr
16+
OPVur5hl7QO3kI4liNXXXQTuaa5fQfMIwnmEiRVYBJu4rjr7F6FLNXEbg18O9Jb3
17+
qs03BoR96eHqWlXrdr12vMymkJQkzduNLeLMISL0N2AOpJ+wZdRwIJsPCT3Dob7i
18+
uE/bnPDGJsQRhEgulKu9Kr28Sd6r7IDMheXbfRXY9V+ulxEg0UogPnipC5YtA987
19+
TLaDlDQTVvJkLqKv6me0bFKJT1CXsJ0Y2+BGwn6rALyYIi0OoikzdFB143vR56/a
20+
jW2T5Mc1Z6zZ6Y1cMWci03GGwKuHlexFEBG3FsGr15tpQX697jLG0y6CABKAe4Vu
21+
TYsSTHA1UsAB8QsX9GCGJKVVHHiH33wpRrwwo4wZP0dwN0r5VGHhG7nB/gC1VgQn
22+
b2/sFHRuDeIaaGsUkgdJhRrbLO8dO8XdU5cR6nU1c0WSandjDfBqQGsscDbD4sYR
23+
dFSazWnM+p1QlIz2hmTuVOpDZJnhj3hpFCEHnnscyGBa+Uc8KtSF+6TlE9vdSVRy
24+
bCo0NX2iNWlmjCc/rJbhNAbsgE6iwV6Jx4xD5lLcW4HlYYdQZh1zuXTT9E3aiNEh
25+
gwRO2AkMBrvEBKPJF4+2+joM9EoIT/a8QNmUrw2SFNSHXNtSUqEPdrRreo1WS2Ab
26+
MZFYbS/EZZZ6W/IYcOMBCoPUZ/tc/NcDpmgl7x/Y7YOragJHWpx9JnDMKGepm/RM
27+
FU9aKTcCCEarowaZzDe8ALV1IjEJEPWCNdtsAudblvl69iIg+k0qW52QtKRv2Q0w
28+
XeYsxpbtHszWTN8wmSXtagEECMlcSY70MvhhCxbKOVrFXIs/MnixESXAx5Sx8XVR
29+
XFFdm1HHor8Ntertjnz7fmD8bXBayZj+BX/tMjVgsAnH1I/pSXo3b/jjsfyKxY7t
30+
Dp9whEGMVvD2V7LNWGFgQ/HajcWRSIYtJ1j53BPdSdx17pNRn5sG53IE1OtiNfly
31+
PKazMQ3hXlkyfwRPdzdeZVGbdOEbk5MiGjoy4ykwgO3Mg5EGbbVMN3TjsSdW54t1
32+
6s1U4Cuk1sNjH/NwOVWH+6y+4ltcDkb7+kEH7DxL89rk2/WWQaKhtEQgiI33VJCN
33+
DfM8r95sUqiEHt70dC+JJRT8E7zrHCAFpqR4yohDi1wAyqtqOSy8CQlI8gsefh4D
34+
RWzsWel5tMKoGAVbdEnqPyFKDhH+rRrTcwFaPWsLmS6RRJI9tduvMQbrv3U3Y4+D
35+
SNjBGTqMqigvb1ohjChRhIVSQM/lcI5E365f4uMqvJbpn27+AM+A20KSH/Qwt7bZ
36+
SeU/ofmcTh38fEP2Itur1ug76Eenr1zuk8KUcR9fDD28yOmtYIqX1o4wcCM/M6q7
37+
R1doOEVrtp5BRBkiuyCZEyPHBniNmVQQA6f+1uIiNz8PXoGJ9vc4uCYOR/fqDxdi
38+
kir7agbYNirnvuQGspUETdQTngPZlnQyGfwe1KClwsz4TOwzLUGxNW3DPrGLbs+F
39+
lJW5PFal/MY9P3yxaUxprO2QUsgaU3CSEIt2A/bUkFpu6/h2V3RMrJAnuD6kH7hM
40+
gzmnbGuRgmv3NLKPRB7bE2cwa8vBJAfDPy2Xm0V4+Fmv1qvaZ/AJukTAt5AOAV+u
41+
mwn6Su4hjfVjyRfQ+Fr/JmXbVdm7Q3DhyLOfinVb4GnJrXFrCLeDz9FBH2yKVsau
42+
yLWLnLlO0UB2nLX3Q8+JH29YCoMR4TPBThYmLkp/OXm+ttcKwVXeu+7QbZGRqshy
43+
Mv1O7ju8dgch5VTDTKNaXrlc98hwGQPh0jbT66ZoB2R062UH3tid03dFbYCNdzl2
44+
f+sYRiXnOvUqX641sVKRHCeMwECP4XGKF+B0G8EIzTQRDxEDP8oEVZSHkUGIb3bJ
45+
GrnbeXzwXncnfuPcXGCFbdjj/V4s5LuZeaRWL/G2d1aN+ewYSrYgfCsgAeGKiTKf
46+
V6eDw83KIWgyo/T3VSIyoKXwJxpIoZwdYdUG7ct2ZqwbrkS5KA4nwMe16+HBWR2+
47+
NNOM19D/OQVAVoAziBKceFfvcz2mtuotq7uD5aNTMFEwHQYDVR0OBBYEFI2wJsR1
48+
YbzM3ZeQc8bZ2rHPYxvEMB8GA1UdIwQYMBaAFI2wJsR1YbzM3ZeQc8bZ2rHPYxvE
49+
MA8GA1UdEwEB/wQFMAMBAf8wCwYJYIZIAWUDBAMSA4IM7gBuzqF0mFVFZmpRmqDR
50+
28vMOE19HFCPLjDeQA4VNuZlp36wwaQbkcriumstIb5QfK0lewqiUF8vdFWXS8rh
51+
87ntM2VZgV7bIUuI/NXIuY92JrDymNLrTlM8fNOYVIHtPMMgpMSuhKPLjVUWjUAR
52+
TNRtb0MVU/updHcfGzwHiWx+pmO42R1L6Qp+7aBKgE2WBzs4LdBcjMdE6HgU+J78
53+
Cu6MpYrNt5POTDQ7Y33plXUoJZao12nR204S7qwOhJgT18io9hdog6JfizjQP2PL
54+
53HmnHNAd/tvrfeVq/DXFLX7TlHq4TUG/htiUOYxddXo1Ui2uYLHeeBVn6sPaNJP
55+
djvSpHRqwfUmjFwNo0AESZUI4AbPKXXAb5zJ+ELkfGKb1bjJ1Pt0YACzjV4Wff1c
56+
WBXj3NVxr+Mwgg65ySVVoH1nUSbGdhAjZwYbJNPQECwTVdXD6LFKJi3rm7uRbhWK
57+
CSYL5fEi8Htn0eawML3J7R4oWtalnfiG5i31s5qQ+nY6X2n7RfcvEjTE8FadMQ2E
58+
AMVW3/pNsYGw98K91xnrvUGlZT738RtB7XWluYkzejilVa4O9JIkLz2k28iS5V8T
59+
+uhIRNj6W3HXPajJRTYSgCR+ov8QsKd1n/qNeKQcotJnUmo9xCXAT+GgGcXoYvqH
60+
Mo0K+ASejfq+h9yVNOD7ELzi3ph7nWYmSzs5WAftqeRXo/VOf1IVvZxGPOtpqqs4
61+
762xPxzTktrotB4sFegtCt76tlUIiBLdCx9J7TAgcTKdi03quIEMRalsePRejZiw
62+
gQsRY0bWQtKeXbR8matP2n7yUkzczGb6RINs3gQ0TY1+VWfACz9LcxYhbYXmmqPZ
63+
Z5QnMmzTZE0TcjiCr2aWuVo2N/2ZDHz2z6lHq7B09jE/okBllcyWbgS8Mb6RiwSL
64+
iajulnzlVB7k273WCwimu2CPH8gSpLnAPt+gAciZ6K1DtHKxJtbKFZxpp7PuW9tC
65+
/8hdnavdACjAVVtIoGa1HwRytyuBEDB18LULNNyYsG5aK2sHhwb+mTQyyggfZRGE
66+
ko8if6+/UuHZTxANAt9lXfZIWgqIbcH4kUIAKgzXQgOTOnb49BrlIN3Xar9J7rqB
67+
totxxe802VKGZXbmt5rtBZE1AKAnikSq0Nu6/C5LVshnPRK07ITsG9hw022avmkG
68+
jJizBVGYuxB/+0xblr2o08RRl0pbfTONrBvJdc92DfVa8hJwCh1OHPjiBKBFqKIB
69+
/fDpYRoHnU1avdAi86lOHthl8ERbGAY9gjFTj9QMBKydrYpJcV3asV85lkY/HwnL
70+
0x1DA2eJsBRyy49Sokjde/vGjjs+kdUIPEy6qnSYTdr32U5n10TiL8+JoHglerkV
71+
vBdNTBfob9WwVpJYchZoGHzfASsyHdatG4Oh2jEs8zxByjEGkpVUD/gUe/S9TSR6
72+
dAr0wibqE0GtPNpkdiid1tsGxauXhF5vD+XrDQpff6uAaC8ISG3f+SzYrPjL58tL
73+
AmmLJ6U1PNjCxyDJh+i9mDszdcP8rQpiEOU+M/CpqQ95ZmPyJ2dZMLTgXT7+X+pj
74+
lbG50B/9hy1/5JDvtQ0DhxjpMo+MdJKqewIvrHpXG/Rm4sgeEaIHXFue47EBirVL
75+
V4PSBCsAffDWh1AuFV9eWY54pU+u/D8b4pXzX+eFzOfWRoth58+21rY7Q8f7eqyz
76+
tEqsW7mSyPkpJSJAkvphrG/lg6Scdn9CEuvOzwEGqSIEE6C21NB5hIt+KsXEW6g6
77+
BqgX9JRzrgkpfop7+2wfU4RhRNrPrajZtTZiKCm1PQgWt8VL9TVkoZWWToEyjo2c
78+
0Zq9/y9OuK6n+Y2AMFtac8oNsjnLXH5vNnwFQKV6kYSr5qJ3nIEHq2eiN/0Dy+XI
79+
zSIC/4A1tfCY3P/9yYjKshs6NUJVKtFHMPCas1b7Vk4+yweNmt1IisNRrXJ2dH5x
80+
DNLE4CGCd+jkw2J+BBXikLV1xb9/cRe3ytHUIlvUcRtft16NqDZgLkuCev+PUfwk
81+
0sNhr7SSIeF5ZIxj1cm0mTE/7DI1de6YCmy9Eea0UgzPNb8RREnt2JhEHKEBYzG1
82+
YG8yefbwQKW/yvmTF6gBhHjbqeB6yYpSd68llFjhbqgg7YAfi6+nXj9Gqkoy+GRy
83+
wuHv67dNpoY0wX0J3v8AG4NuC/Mv9Y75Hj3jWVYTGnGnfx8cewesoAbjwt5q2uvq
84+
rnTzUrlcfmArNem2nWFrGzcSZStqzL92fHCoVbfEYQj8KWifgKQGEGp3CpZnbJTT
85+
BUCv3RwpUoPi2gNWikTkNYYXDHEizC9Rc9yVrnrcSmeo+jUXNzAGOXH2LUzTJpBG
86+
pi2UMz9aKmmV0G6U/9tt4YlTFRhTHdOBodFnCtGz7Si7/IXy86vB2Gom7nASaGsS
87+
Yd3eU3GsOgYGoSj3Cx8zp5uXQolfDAFVeM/H/UNSG+R+PUBFhu6Bssy8koyVKT9l
88+
DzCsPmjtEHUeQvlk8e6Toguo/rnbBxihjl8qrh51tpKKg/MV8pFAjWlc3KYzW41G
89+
CMIANXhc8yBPjEurmq/AK+seKeLe5go5fx8F2i+I3KG/TlZTpLjuR7AcEW5Z+Fba
90+
QUxAPryxzkwPeFh5bRGrXFs6weVQJ1hXqA2PgKuUv6lSNJrezUhcBRqBIBQ0HP94
91+
T4F+KBUEvBBpJ4KorS3U6uyNri4MMZCxrYfKGfdnWURjTLKGecKAM423w4jjDFxP
92+
V/REDR/BhqhI2WQxJ9iapmKpDR0Fx9rkltL7dTIOrJQdsYdJ4odxgF2Ka9j1DKn0
93+
ZUT5UxcaXNj4CSdvcJUyJ5M+qrdM6u2iiV22Bafx4ag972u+abDdlGgcURVLvuVA
94+
gfWAGsczgtqSQ+qAbKWEPFDPHAvMWHQeJUt54B7pzOI8yVAaqh4brkYi9nyzxgPx
95+
RyqhQvRPgCc3iO1q3Mt3AscTx3trK+ILe/sKFk8+LF+7LmyFpcX4gynzyiTtnWtM
96+
R5oKPLa1GANP4hzRYGH95xKs/cLhAvawGl4QiZWL/64HlrnUMiWUrxH7/Uy1Wgmn
97+
v/9pn6bOGJ38Ty+C9/sPimmsh/Eu3GNyPURC+yVkAvhZ7FspmYZC0l/R4BSm2t2q
98+
dNHhBet7RVgBJmqfa80pavxwEB+ZEvg+Wt5wU+hdF+iJfDlNjhjwTqfkt3J1B6y9
99+
xuP1mil4A7XFJ2xYN0DoE4U2czUzx3nJpdt+iyWI8SdFApUUVGNo0mPJMcrr/aRP
100+
cDcioFxOBIoNdTeqVEdK9IIvBUDXnz6wKl1gousW6UsDGQrM8oO6lxmhLezLvb0w
101+
piOpS74RuF+8/ImjCZcjRTfSzn43WUe5UKqEmoUhQbcKKpvUrmYcUVrsrJoQWFSw
102+
8/7ENfnk4nbMou/YipUmWv5nv/Xu+0NIo3CkXw6nYoTp4SErZZIuEt+erYMX6Ipi
103+
X+1AIpBFVF4IIaGZtMHKPFiRttcT6YR76AK02d6Mnjm36PkUpg1UldOG9gt8HsLP
104+
wTH7UpBDCEp6knvFktl4Je+WP9HI9Au8e3Y538/5JX5jw/ywluNRiC8WQ4ZIo5W6
105+
sQ9Ae+sJ/6WoXOzSSETnrepEbeBfx+TsmutyZKX8NfXl1MBybrTh4a94kqgxsrJV
106+
lDnzDre/cix9hpZQDe0ONy10mokc5YUNRrsBoJCEkBFjsjCM3yELbu6qBq5Rybi5
107+
ssH6Co+r39ZOBDhvM1aNyAwyKoVy4cbFleMUsiiHPZAroLU+4is1B+ZVl63Qyp2H
108+
g4XDtDJB9b/PkTIVLDviclPGkzlFnqfw4nNyyWm1AM+JT6FSvZ1yDCDkfGhked31
109+
UuOeI6UgBW56TAa6MSFVCPnhyLOimndHF2vT3r5Zr6QcTP7oeGG8QCwPFdylUZ8z
110+
T2jvVBijF9ZbDtlOnl1/dS4qXiWKyfZbYCr4gX/Mhncg7qQ8mGE8+186Rf537wSW
111+
BdFoyRxIrgbvt4Sv8EjJwg1/twxNOaA8bQe8N68jkaLQdpgSS7jVSw4NDtscWez5
112+
JdLgOD2vw+ga8hPmZLQNGGGG29k7/vV+9qxBdb8YD8ZY6x8QbJEzRT4jvrvuG49R
113+
Qgm1eAMc3GuwPLzagLn4C9UDn8UH7vYaLDVKsHVVbIorueLHnlPpJijnEU/ea8mc
114+
C00k436/Unan+QfQEKq65YgpcBHKfj+mEDfYefoBYIpjFuvGZlp8QlAaiF0Wl+cq
115+
MrKUcpw1Klb3RiPFKvEdgU9wYLIMbaAApvsjtzMcnJdMbujThqajWwOoaTkDD4d4
116+
me3SURBem4WPxRRxyhV90DZ12cVwY8jzXQhX03lQwc/xhEuqrLozXqx1usqeV52V
117+
ePvzkLIQQFX6fvDOhsrALuY+Xgkbcvg5XH+Gmqu13vERHrHNCTdFdZOj4AcuMEph
118+
h9fp+PwYOj9BRNkAAAAAAAAAAAAAAAAAAAAEDREYIig=
119+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)