Class: Gem::Guardian::ChecksumProvider::Url

Inherits:
Object
  • Object
show all
Defined in:
lib/gem/guardian/checksum_provider.rb

Overview

Reads checksum metadata from a publisher-controlled checksum URL.

This is intentionally generic. Commercial or self-hosted publishers can expose a stable checksum file without implementing RubyGems.org metadata APIs. For example, a publisher could host:

https://example.com/checksums/mammoth-pro-1.0.0.gem.sha256

The template supports these placeholders:

  • +name+
  • +version+
  • +platform+
  • +filename+

The response body may contain either a bare SHA256 or a line such as:

Constant Summary collapse

SHA256_PATTERN = 
/\b([a-fA-F0-9]{64})\b/
OPEN_TIMEOUT = 
10
READ_TIMEOUT = 
30

Instance Method Summary collapse

Constructor Details

#initialize(template:, http: Net::HTTP, provider_name: "url") ⇒ Url

Returns a new instance of Url.

Parameters:

  • template (String) —

    URL template containing dependency placeholders such as +filename+

  • http (#get_response) (defaults to: Net::HTTP) —

    HTTP client, mainly for tests. When omitted, +Net::HTTP+ is used with explicit timeouts.

  • provider_name (String) (defaults to: "url") —

    provider label used in reports and JSON output



131
132
133
134
135
 
# File 'lib/gem/guardian/checksum_provider.rb', line 131

def initialize(template:, http: Net::HTTP, provider_name: "url")
  @template = template
  @http = http
  @provider_name = provider_name
end

Instance Method Details

#checksum_for(dependency, client:) ⇒ Result?

Returns provider result when the configured URL returns a parseable SHA256, otherwise +nil+.

Parameters:

  • dependency (Dependency) —

    dependency whose checksum should be looked up

  • client (RubygemsClient) —

    client used to sanitize the verification URI

Returns:

  • (Result, nil) —

    provider result when the configured URL returns a parseable SHA256, otherwise +nil+



140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
 
# File 'lib/gem/guardian/checksum_provider.rb', line 140

def checksum_for(dependency, client:)
  uri = URI(expand_template(dependency))
  response = http_get(uri)
  return unless response.is_a?(Net::HTTPSuccess)

  sha256 = response.body.to_s[SHA256_PATTERN, 1]
  return unless sha256

  Result.new(
    sha256: sha256.downcase,
    source: :publisher,
    provider: @provider_name,
    verification_uri: client.sanitize_uri(uri)
  )
rescue StandardError
  nil
end