bundler: Fix Bundler::Fetcher for PQC support, adding integration connection tests

Created spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb
adding non-PQC and PQC server/client connection integration tests.
As "Bundler::Fetcher local SSL server #connection PQC connects with client cert
auth" failed with the following error due to hardcoded `OpenSSL::PKey::RSA.new` in
`Bundler::Fetcher#connection`, fixed it to support ML-DSA ssl_client_cert.

```
$ bin/rspec spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb
...
Failures:

  1) Bundler::Fetcher local SSL server #connection PQC connects with client cert auth
     Failure/Error: fetcher = Bundler::Fetcher.new(remote)

     OpenSSL::PKey::PKeyError:
       incorrect pkey type: UNDEF
     # /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'OpenSSL::PKey::RSA#initialize'
     # /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'Class#new'
     # /home/jaruga/.local/ruby-4.1.0-debug-3ef48ef9c8-openssl-4.1.0-7194354488/lib/ruby/4.1.0+1/openssl/pkey.rb:394:in 'OpenSSL::PKey::RSA.new'
     # ./bundler/lib/bundler/fetcher.rb:321:in 'Bundler::Fetcher#connection'
     # ./bundler/lib/bundler/fetcher.rb:140:in 'Bundler::Fetcher#initialize'
     # ./spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb:69:in 'RSpec::ExampleGroups::BundlerFetcherLocalSSLServer#fetch_path'
     # ./spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb:60:in 'block (4 levels) in <top (required)>'
...
```

Created test/rubygems/local_ssl_server_utilities.rb to manage utility methods
called by RubyGems test-unit and Bundler rspec tests.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: junaruga

bundler/lib/bundler/fetcher.rb

@@ -318,7 +318,7 @@ def connection
         if ssl_client_cert
           pem = File.read(ssl_client_cert)
           con.cert = OpenSSL::X509::Certificate.new(pem)
-          con.key  = OpenSSL::PKey::RSA.new(pem)
+          con.key  = OpenSSL::PKey.read(pem)
         end
 
         con.read_timeout = Fetcher.api_timeout

spec/bundler/fetcher/gem_remote_fetcher_local_ssl_server_spec.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "bundler/fetcher"
+require Spec::Path.rubygems_test_dir.join("local_ssl_server_utilities")
+
+RSpec.describe "Bundler::Fetcher local SSL server", if: Gem::HAVE_OPENSSL do
+  include Gem::LocalSSLServerUtilities
+
+  before do
+    initialize_ssl_server
+  end
+
+  after do
+    stop_ssl_server
+  end
+
+  describe "#connection" do
+    context "non-PQC" do
+      it "connects" do
+        ssl_server = start_ssl_server
+        allow(Bundler.settings).to receive(:[]).and_call_original
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "ca_cert.pem"))
+        response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
+        expect(response.code).to eq("200")
+      end
+
+      it "connects with client cert auth" do
+        ssl_server = start_ssl_server(
+          verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+        )
+        allow(Bundler.settings).to receive(:[]).and_call_original
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "ca_cert.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(File.join(certs_dir, "client.pem"))
+        response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
+        expect(response.code).to eq("200")
+      end
+    end
+
+    context "PQC" do
+      before do
+        skip_unless_support_pqc
+      end
+
+      it "connects" do
+        ssl_server = start_ssl_server(mode: :pqc)
+        allow(Bundler.settings).to receive(:[]).and_call_original
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "mldsa65_ca_cert.pem"))
+        response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
+        expect(response.code).to eq("200")
+      end
+
+      it "connects with client cert auth" do
+        ssl_server = start_ssl_server(
+          mode: :pqc,
+          verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
+        )
+        allow(Bundler.settings).to receive(:[]).and_call_original
+        allow(Bundler.settings).to receive(:[]).with(:ssl_ca_cert).and_return(File.join(certs_dir, "mldsa65_ca_cert.pem"))
+        allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(File.join(certs_dir, "mldsa65_client.pem"))
+        response = fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
+        expect(response.code).to eq("200")
+      end
+    end
+  end
+
+  def fetch_path(uri)
+    uri = Gem::URI(uri)
+    remote = double("remote", uri: uri, original_uri: nil)
+    fetcher = Bundler::Fetcher.new(remote)
+
+    connection = fetcher.send(:connection)
+    connection.request(uri)
+  end
+
+  def skip_unless_support_pqc
+    skip "PQC is not supported" unless pqc_supported?
+  end
+end

spec/bundler/fetcher_spec.rb

@@ -93,14 +93,14 @@
       end
     end
 
-    context "when bunder ssl ssl configuration is set" do
+    context "when bunder ssl configuration is set" do
       before do
         cert = File.join(Spec::Path.tmpdir, "cert")
         File.open(cert, "w") {|f| f.write "PEM" }
         allow(Bundler.settings).to receive(:[]).and_return(nil)
         allow(Bundler.settings).to receive(:[]).with(:ssl_client_cert).and_return(cert)
         expect(OpenSSL::X509::Certificate).to receive(:new).with("PEM").and_return("cert")
-        expect(OpenSSL::PKey::RSA).to receive(:new).with("PEM").and_return("key")
+        expect(OpenSSL::PKey).to receive(:read).with("PEM").and_return("key")
       end
       after do
         FileUtils.rm File.join(Spec::Path.tmpdir, "cert")
@@ -120,7 +120,7 @@
         )
         expect(File).to receive(:read).and_return("")
         expect(OpenSSL::X509::Certificate).to receive(:new).and_return("cert")
-        expect(OpenSSL::PKey::RSA).to receive(:new).and_return("key")
+        expect(OpenSSL::PKey).to receive(:read).and_return("key")
         store = double("ca store")
         expect(store).to receive(:add_file)
         expect(OpenSSL::X509::Store).to receive(:new).and_return(store)

spec/support/path.rb

@@ -79,6 +79,10 @@ def spec_dir
       @spec_dir ||= source_root.join(ruby_core? ? "spec/bundler" : "../spec")
     end
 
+    def rubygems_test_dir
+      @rubygems_test_dir ||= source_root.join(ruby_core? ? "test/rubygems" : "../test/rubygems")
+    end
+
     def man_dir
       @man_dir ||= lib_dir.join("bundler/man")
     end

test/rubygems/local_ssl_server_utilities.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+# This file can be loaded by RubyGems test-unit files and Bundler rspec files.
+# Don't add test-unit or rspec dependent logic in this file.
+
+require "socket"
+require "openssl"
+
+module Gem::LocalSSLServerUtilities
+  def certs_dir
+    __dir__
+  end
+
+  def initialize_ssl_server
+    @ssl_server_thread = nil
+    @ssl_server = nil
+  end
+
+  def stop_ssl_server
+    if @ssl_server_thread
+      @ssl_server_thread.kill.join
+      @ssl_server_thread = nil
+    end
+    if @ssl_server
+      @ssl_server.close
+      @ssl_server = nil
+    end
+  end
+
+  # mode:
+  #   :non_pqc - Run single server with PQC-unsupported RSA (default)
+  #   :pqc     - Run single server with PQC-supported key exchange,
+  #              X25519MLKEM768, and PQC-supported certificate, ML-DSA-65
+  def start_ssl_server(config = {})
+    mode = config.fetch(:mode, :non_pqc)
+    server = TCPServer.new(0)
+    ctx = OpenSSL::SSL::SSLContext.new
+
+    case mode
+    when :non_pqc
+      ctx.cert = cert("ssl_cert.pem")
+      ctx.key = key("ssl_key.pem")
+      ctx.ca_file = File.join(certs_dir, "ca_cert.pem")
+    when :pqc
+      ctx.cert = cert("mldsa65_ssl_cert.pem")
+      ctx.key = key("mldsa65_ssl_key.pem")
+      ctx.ca_file = File.join(certs_dir, "mldsa65_ca_cert.pem")
+      ctx.groups = "X25519MLKEM768"
+    end
+
+    ctx.verify_mode = config[:verify_mode] if config[:verify_mode]
+    @ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)
+    @ssl_server_thread = Thread.new do
+      loop do
+        ssl_client = @ssl_server.accept
+        Thread.new(ssl_client) do |client|
+          handle_request(client)
+        ensure
+          client.close
+        end
+      rescue OpenSSL::SSL::SSLError
+        # Ignore SSL errors because we're testing them implicitly
+      end
+    end
+    @ssl_server
+  end
+
+  def handle_request(client)
+    request = client.gets
+    if request&.start_with?("GET /yaml")
+      client.print "HTTP/1.1 200 OK\r\nContent-Type: text/yaml\r\n\r\n--- true\n"
+    elsif request&.start_with?("GET /insecure_redirect")
+      location = request.match(/to=([^ ]+)/)[1]
+      client.print "HTTP/1.1 301 Moved Permanently\r\nLocation: #{location}\r\n\r\n"
+    else
+      client.print "HTTP/1.1 404 Not Found\r\n\r\n"
+    end
+  end
+
+  def cert(filename)
+    OpenSSL::X509::Certificate.new(File.read(File.join(certs_dir, filename)))
+  end
+
+  def key(filename)
+    OpenSSL::PKey.read(File.read(File.join(certs_dir, filename)))
+  end
+
+  def pqc_supported?
+    # PQC algorithms ML-KEM and ML-DSA require OpenSSL >= 3.5.
+    # https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
+    # ctx.groups (OpenSSL::SSL::SSLContext#groups) used in start_ssl_server
+    # mode :pqc requires Ruby OpenSSL >= 4.0.
+    OpenSSL::OPENSSL_VERSION_NUMBER >= 0x30500000 &&
+      Gem::Version.new(OpenSSL::VERSION) >= Gem::Version.new("4.0")
+  end
+end

test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb

@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "helper"
-require "socket"
-require "openssl"
+require_relative "local_ssl_server_utilities"
 
 unless Gem::HAVE_OPENSSL
   warn "Skipping Gem::RemoteFetcher tests.  openssl not found."
@@ -13,28 +12,21 @@
 
 class TestGemRemoteFetcherLocalSSLServer < Gem::TestCase
   include Gem::DefaultUserInteraction
+  include Gem::LocalSSLServerUtilities
 
   def setup
     super
-    @ssl_server_thread = nil
-    @ssl_server = nil
+    initialize_ssl_server
   end
 
   def teardown
-    if @ssl_server_thread
-      @ssl_server_thread.kill.join
-      @ssl_server_thread = nil
-    end
-    if @ssl_server
-      @ssl_server.close
-      @ssl_server = nil
-    end
+    stop_ssl_server
     super
   end
 
   def test_ssl_connection
     ssl_server = start_ssl_server
-    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
+    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
     end
@@ -44,7 +36,7 @@ def test_pqc_ssl_connection
     omit_unless_support_pqc
 
     ssl_server = start_ssl_server(mode: :pqc)
-    temp_ca_cert = File.join(__dir__, "mldsa65_ca_cert.pem")
+    temp_ca_cert = File.join(certs_dir, "mldsa65_ca_cert.pem")
     with_configured_fetcher(":ssl_ca_cert: #{temp_ca_cert}") do |fetcher|
       fetcher.fetch_path("https://localhost:#{ssl_server.addr[1]}/yaml")
     end
@@ -55,8 +47,8 @@ def test_ssl_client_cert_auth_connection
       { verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT }
     )
 
-    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
-    temp_client_cert = File.join(__dir__, "client.pem")
+    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
+    temp_client_cert = File.join(certs_dir, "client.pem")
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -74,8 +66,8 @@ def test_pqc_ssl_client_cert_auth_connection
       verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
     )
 
-    temp_ca_cert = File.join(__dir__, "mldsa65_ca_cert.pem")
-    temp_client_cert = File.join(__dir__, "mldsa65_client.pem")
+    temp_ca_cert = File.join(certs_dir, "mldsa65_ca_cert.pem")
+    temp_client_cert = File.join(certs_dir, "mldsa65_client.pem")
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -90,8 +82,8 @@ def test_do_not_allow_invalid_client_cert_auth_connection
       { verify_mode: OpenSSL::SSL::VERIFY_PEER | OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT }
     )
 
-    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
-    temp_client_cert = File.join(__dir__, "invalid_client.pem")
+    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
+    temp_client_cert = File.join(certs_dir, "invalid_client.pem")
 
     with_configured_fetcher(
       ":ssl_ca_cert: #{temp_ca_cert}\n" \
@@ -122,7 +114,7 @@ def test_ssl_connection_allow_verify_none
   def test_do_not_follow_insecure_redirect
     @server_uri = "http://example.com"
     ssl_server = start_ssl_server
-    temp_ca_cert = File.join(__dir__, "ca_cert.pem")
+    temp_ca_cert = File.join(certs_dir, "ca_cert.pem")
     expected_error_message =
       "redirecting to non-https resource: #{@server_uri} (https://localhost:#{ssl_server.addr[1]}/insecure_redirect?to=#{@server_uri})"
 
@@ -164,72 +156,7 @@ def with_configured_fetcher(config_str = nil, &block)
     Gem.configuration = nil
   end
 
-  # mode:
-  #   :non_pqc - Run single server with PQC-unsupported RSA (default)
-  #   :pqc     - Run single server with PQC-supported key exchange,
-  #              X25519MLKEM768, and PQC-supported certificate, ML-DSA-65
-  def start_ssl_server(config = {})
-    mode = config.fetch(:mode, :non_pqc)
-    server = TCPServer.new(0)
-    ctx = OpenSSL::SSL::SSLContext.new
-
-    case mode
-    when :non_pqc
-      ctx.cert = cert("ssl_cert.pem")
-      ctx.key = key("ssl_key.pem")
-      ctx.ca_file = File.join(__dir__, "ca_cert.pem")
-    when :pqc
-      ctx.cert = cert("mldsa65_ssl_cert.pem")
-      ctx.key = key("mldsa65_ssl_key.pem")
-      ctx.ca_file = File.join(__dir__, "mldsa65_ca_cert.pem")
-      ctx.groups = "X25519MLKEM768"
-    end
-
-    ctx.verify_mode = config[:verify_mode] if config[:verify_mode]
-    @ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)
-    @ssl_server_thread = Thread.new do
-      loop do
-        ssl_client = @ssl_server.accept
-        Thread.new(ssl_client) do |client|
-          handle_request(client)
-        ensure
-          client.close
-        end
-      rescue OpenSSL::SSL::SSLError
-        # Ignore SSL errors because we're testing them implicitly
-      end
-    end
-    @ssl_server
-  end
-
-  def handle_request(client)
-    request = client.gets
-    if request.start_with?("GET /yaml")
-      client.print "HTTP/1.1 200 OK\r\nContent-Type: text/yaml\r\n\r\n--- true\n"
-    elsif request.start_with?("GET /insecure_redirect")
-      location = request.match(/to=([^ ]+)/)[1]
-      client.print "HTTP/1.1 301 Moved Permanently\r\nLocation: #{location}\r\n\r\n"
-    else
-      client.print "HTTP/1.1 404 Not Found\r\n\r\n"
-    end
-  end
-
-  def cert(filename)
-    OpenSSL::X509::Certificate.new(File.read(File.join(__dir__, filename)))
-  end
-
-  def key(filename)
-    OpenSSL::PKey.read(File.read(File.join(__dir__, filename)))
-  end
-
   def omit_unless_support_pqc
-    # PQC algorithms ML-KEM and ML-DSA require OpenSSL >= 3.5.
-    # https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
-    omit "PQC algorithms require OpenSSL >= 3.5" unless
-      OpenSSL::OPENSSL_VERSION_NUMBER >= 0x30500000
-    # ctx.groups (OpenSSL::SSL::SSLContext#groups) used in start_ssl_server
-    # mode :pqc requires Ruby OpenSSL >= 4.0.
-    omit "PQC test requires Ruby OpenSSL >= 4.0" unless
-      Gem::Version.new(OpenSSL::VERSION) >= Gem::Version.new("4.0")
+    omit "PQC is not supported" unless pqc_supported?
   end
 end if Gem::HAVE_OPENSSL