PNG  IHDRX cHRMz&u0`:pQ<bKGD pHYsodtIME MeqIDATxw]Wug^Qd˶ 6`!N:!@xI~)%7%@Bh&`lnjVF29gΨ4E$|>cɚ{gk= %,a KX%,a KX%,a KX%,a KX%,a KX%,a KX%, b` ǟzeאfp]<!SJmɤY޲ڿ,%c ~ع9VH.!Ͳz&QynֺTkRR.BLHi٪:l;@(!MԴ=žI,:o&N'Kù\vRmJ雵֫AWic H@" !: Cé||]k-Ha oݜ:y F())u]aG7*JV@J415p=sZH!=!DRʯvɱh~V\}v/GKY$n]"X"}t@ xS76^[bw4dsce)2dU0 CkMa-U5tvLƀ~mlMwfGE/-]7XAƟ`׮g ewxwC4\[~7@O-Q( a*XGƒ{ ՟}$_y3tĐƤatgvێi|K=uVyrŲlLӪuܿzwk$m87k( `múcE)"@rK( z4$D; 2kW=Xb$V[Ru819קR~qloѱDyįݎ*mxw]y5e4K@ЃI0A D@"BDk_)N\8͜9dz"fK0zɿvM /.:2O{ Nb=M=7>??Zuo32 DLD@D| &+֎C #B8ַ`bOb $D#ͮҪtx]%`ES`Ru[=¾!@Od37LJ0!OIR4m]GZRJu$‡c=%~s@6SKy?CeIh:[vR@Lh | (BhAMy=݃  G"'wzn޺~8ԽSh ~T*A:xR[ܹ?X[uKL_=fDȊ؂p0}7=D$Ekq!/t.*2ʼnDbŞ}DijYaȲ(""6HA;:LzxQ‘(SQQ}*PL*fc\s `/d'QXW, e`#kPGZuŞuO{{wm[&NBTiiI0bukcA9<4@SӊH*؎4U/'2U5.(9JuDfrޱtycU%j(:RUbArLֺN)udA':uGQN"-"Is.*+k@ `Ojs@yU/ H:l;@yyTn}_yw!VkRJ4P)~y#)r,D =ě"Q]ci'%HI4ZL0"MJy 8A{ aN<8D"1#IJi >XjX֔#@>-{vN!8tRݻ^)N_╗FJEk]CT՟ YP:_|H1@ CBk]yKYp|og?*dGvzنzӴzjֺNkC~AbZƷ`.H)=!QͷVTT(| u78y֮}|[8-Vjp%2JPk[}ԉaH8Wpqhwr:vWª<}l77_~{s۴V+RCģ%WRZ\AqHifɤL36: #F:p]Bq/z{0CU6ݳEv_^k7'>sq*+kH%a`0ԣisqにtү04gVgW΂iJiS'3w.w}l6MC2uԯ|>JF5`fV5m`Y**Db1FKNttu]4ccsQNnex/87+}xaUW9y>ͯ骵G{䩓Գ3+vU}~jJ.NFRD7<aJDB1#ҳgSb,+CS?/ VG J?|?,2#M9}B)MiE+G`-wo߫V`fio(}S^4e~V4bHOYb"b#E)dda:'?}׮4繏`{7Z"uny-?ǹ;0MKx{:_pÚmFמ:F " .LFQLG)Q8qN q¯¯3wOvxDb\. BKD9_NN &L:4D{mm o^tֽ:q!ƥ}K+<"m78N< ywsard5+вz~mnG)=}lYݧNj'QJS{S :UYS-952?&O-:W}(!6Mk4+>A>j+i|<<|;ر^߉=HE|V#F)Emm#}/"y GII웻Jі94+v뾧xu~5C95~ūH>c@덉pʃ1/4-A2G%7>m;–Y,cyyaln" ?ƻ!ʪ<{~h~i y.zZB̃/,雋SiC/JFMmBH&&FAbϓO^tubbb_hZ{_QZ-sύodFgO(6]TJA˯#`۶ɟ( %$&+V'~hiYy>922 Wp74Zkq+Ovn錄c>8~GqܲcWꂎz@"1A.}T)uiW4="jJ2W7mU/N0gcqܗOO}?9/wìXžΏ0 >֩(V^Rh32!Hj5`;O28؇2#ݕf3 ?sJd8NJ@7O0 b־?lldщ̡&|9C.8RTWwxWy46ah嘦mh٤&l zCy!PY?: CJyв]dm4ǜҐR޻RլhX{FƯanшQI@x' ao(kUUuxW_Ñ줮[w8 FRJ(8˼)_mQ _!RJhm=!cVmm ?sFOnll6Qk}alY}; "baӌ~M0w,Ggw2W:G/k2%R,_=u`WU R.9T"v,<\Ik޽/2110Ӿxc0gyC&Ny޽JҢrV6N ``یeA16"J³+Rj*;BϜkZPJaÍ<Jyw:NP8/D$ 011z֊Ⱳ3ι֘k1V_"h!JPIΣ'ɜ* aEAd:ݺ>y<}Lp&PlRfTb1]o .2EW\ͮ]38؋rTJsǏP@芎sF\> P^+dYJLbJ C-xϐn> ι$nj,;Ǖa FU *择|h ~izť3ᤓ`K'-f tL7JK+vf2)V'-sFuB4i+m+@My=O҈0"|Yxoj,3]:cо3 $#uŘ%Y"y죯LebqtҢVzq¼X)~>4L׶m~[1_k?kxֺQ`\ |ٛY4Ѯr!)N9{56(iNq}O()Em]=F&u?$HypWUeB\k]JɩSع9 Zqg4ZĊo oMcjZBU]B\TUd34ݝ~:7ڶSUsB0Z3srx 7`:5xcx !qZA!;%͚7&P H<WL!džOb5kF)xor^aujƍ7 Ǡ8/p^(L>ὴ-B,{ۇWzֺ^k]3\EE@7>lYBȝR.oHnXO/}sB|.i@ɥDB4tcm,@ӣgdtJ!lH$_vN166L__'Z)y&kH;:,Y7=J 9cG) V\hjiE;gya~%ks_nC~Er er)muuMg2;֫R)Md) ,¶ 2-wr#F7<-BBn~_(o=KO㭇[Xv eN_SMgSҐ BS헃D%g_N:/pe -wkG*9yYSZS.9cREL !k}<4_Xs#FmҶ:7R$i,fi!~' # !6/S6y@kZkZcX)%5V4P]VGYq%H1!;e1MV<!ϐHO021Dp= HMs~~a)ަu7G^];git!Frl]H/L$=AeUvZE4P\.,xi {-~p?2b#amXAHq)MWǾI_r`S Hz&|{ +ʖ_= (YS(_g0a03M`I&'9vl?MM+m~}*xT۲(fY*V4x@29s{DaY"toGNTO+xCAO~4Ϳ;p`Ѫ:>Ҵ7K 3}+0 387x\)a"/E>qpWB=1 ¨"MP(\xp߫́A3+J] n[ʼnӼaTbZUWb={~2ooKױӰp(CS\S筐R*JغV&&"FA}J>G֐p1ٸbk7 ŘH$JoN <8s^yk_[;gy-;߉DV{c B yce% aJhDȶ 2IdйIB/^n0tNtџdcKj4϶v~- CBcgqx9= PJ) dMsjpYB] GD4RDWX +h{y`,3ꊕ$`zj*N^TP4L:Iz9~6s) Ga:?y*J~?OrMwP\](21sZUD ?ܟQ5Q%ggW6QdO+\@ ̪X'GxN @'4=ˋ+*VwN ne_|(/BDfj5(Dq<*tNt1х!MV.C0 32b#?n0pzj#!38}޴o1KovCJ`8ŗ_"]] rDUy޲@ Ȗ-;xџ'^Y`zEd?0„ DAL18IS]VGq\4o !swV7ˣι%4FѮ~}6)OgS[~Q vcYbL!wG3 7띸*E Pql8=jT\꘿I(z<[6OrR8ºC~ډ]=rNl[g|v TMTղb-o}OrP^Q]<98S¤!k)G(Vkwyqyr޽Nv`N/e p/~NAOk \I:G6]4+K;j$R:Mi #*[AȚT,ʰ,;N{HZTGMoּy) ]%dHء9Պ䠬|<45,\=[bƟ8QXeB3- &dҩ^{>/86bXmZ]]yޚN[(WAHL$YAgDKp=5GHjU&99v簪C0vygln*P)9^͞}lMuiH!̍#DoRBn9l@ xA/_v=ȺT{7Yt2N"4!YN`ae >Q<XMydEB`VU}u]嫇.%e^ánE87Mu\t`cP=AD/G)sI"@MP;)]%fH9'FNsj1pVhY&9=0pfuJ&gޤx+k:!r˭wkl03׼Ku C &ѓYt{.O.zҏ z}/tf_wEp2gvX)GN#I ݭ߽v/ .& и(ZF{e"=V!{zW`, ]+LGz"(UJp|j( #V4, 8B 0 9OkRrlɱl94)'VH9=9W|>PS['G(*I1==C<5"Pg+x'K5EMd؞Af8lG ?D FtoB[je?{k3zQ vZ;%Ɠ,]E>KZ+T/ EJxOZ1i #T<@ I}q9/t'zi(EMqw`mYkU6;[t4DPeckeM;H}_g pMww}k6#H㶏+b8雡Sxp)&C $@'b,fPߑt$RbJ'vznuS ~8='72_`{q纶|Q)Xk}cPz9p7O:'|G~8wx(a 0QCko|0ASD>Ip=4Q, d|F8RcU"/KM opKle M3#i0c%<7׿p&pZq[TR"BpqauIp$ 8~Ĩ!8Սx\ւdT>>Z40ks7 z2IQ}ItԀ<-%S⍤};zIb$I 5K}Q͙D8UguWE$Jh )cu4N tZl+[]M4k8֦Zeq֮M7uIqG 1==tLtR,ƜSrHYt&QP윯Lg' I,3@P'}'R˪e/%-Auv·ñ\> vDJzlӾNv5:|K/Jb6KI9)Zh*ZAi`?S {aiVDԲuy5W7pWeQJk֤#5&V<̺@/GH?^τZL|IJNvI:'P=Ϛt"¨=cud S Q.Ki0 !cJy;LJR;G{BJy޺[^8fK6)=yʊ+(k|&xQ2`L?Ȓ2@Mf 0C`6-%pKpm')c$׻K5[J*U[/#hH!6acB JA _|uMvDyk y)6OPYjœ50VT K}cǻP[ $:]4MEA.y)|B)cf-A?(e|lɉ#P9V)[9t.EiQPDѠ3ϴ;E:+Օ t ȥ~|_N2,ZJLt4! %ա]u {+=p.GhNcŞQI?Nd'yeh n7zi1DB)1S | S#ًZs2|Ɛy$F SxeX{7Vl.Src3E℃Q>b6G ўYCmtկ~=K0f(=LrAS GN'ɹ9<\!a`)֕y[uՍ[09` 9 +57ts6}b4{oqd+J5fa/,97J#6yν99mRWxJyѡyu_TJc`~W>l^q#Ts#2"nD1%fS)FU w{ܯ R{ ˎ󅃏џDsZSQS;LV;7 Od1&1n$ N /.q3~eNɪ]E#oM~}v֯FڦwyZ=<<>Xo稯lfMFV6p02|*=tV!c~]fa5Y^Q_WN|Vs 0ҘދU97OI'N2'8N֭fgg-}V%y]U4 峧p*91#9U kCac_AFңĪy뚇Y_AiuYyTTYЗ-(!JFLt›17uTozc. S;7A&&<ԋ5y;Ro+:' *eYJkWR[@F %SHWP 72k4 qLd'J "zB6{AC0ƁA6U.'F3:Ȅ(9ΜL;D]m8ڥ9}dU "v!;*13Rg^fJyShyy5auA?ɩGHRjo^]׽S)Fm\toy 4WQS@mE#%5ʈfFYDX ~D5Ϡ9tE9So_aU4?Ѽm%&c{n>.KW1Tlb}:j uGi(JgcYj0qn+>) %\!4{LaJso d||u//P_y7iRJ߬nHOy) l+@$($VFIQ9%EeKʈU. ia&FY̒mZ=)+qqoQn >L!qCiDB;Y<%} OgBxB!ØuG)WG9y(Ą{_yesuZmZZey'Wg#C~1Cev@0D $a@˲(.._GimA:uyw֬%;@!JkQVM_Ow:P.s\)ot- ˹"`B,e CRtaEUP<0'}r3[>?G8xU~Nqu;Wm8\RIkբ^5@k+5(By'L&'gBJ3ݶ!/㮻w҅ yqPWUg<e"Qy*167΃sJ\oz]T*UQ<\FԎ`HaNmڜ6DysCask8wP8y9``GJ9lF\G g's Nn͵MLN֪u$| /|7=]O)6s !ĴAKh]q_ap $HH'\1jB^s\|- W1:=6lJBqjY^LsPk""`]w)󭃈,(HC ?䔨Y$Sʣ{4Z+0NvQkhol6C.婧/u]FwiVjZka&%6\F*Ny#8O,22+|Db~d ~Çwc N:FuuCe&oZ(l;@ee-+Wn`44AMK➝2BRՈt7g*1gph9N) *"TF*R(#'88pm=}X]u[i7bEc|\~EMn}P瘊J)K.0i1M6=7'_\kaZ(Th{K*GJyytw"IO-PWJk)..axӝ47"89Cc7ĐBiZx 7m!fy|ϿF9CbȩV 9V-՛^pV̌ɄS#Bv4-@]Vxt-Z, &ֺ*diؠ2^VXbs֔Ìl.jQ]Y[47gj=幽ex)A0ip׳ W2[ᎇhuE^~q흙L} #-b۸oFJ_QP3r6jr+"nfzRJTUqoaۍ /$d8Mx'ݓ= OՃ| )$2mcM*cЙj}f };n YG w0Ia!1Q.oYfr]DyISaP}"dIӗթO67jqR ҊƐƈaɤGG|h;t]䗖oSv|iZqX)oalv;۩meEJ\!8=$4QU4Xo&VEĊ YS^E#d,yX_> ۘ-e\ "Wa6uLĜZi`aD9.% w~mB(02G[6y.773a7 /=o7D)$Z 66 $bY^\CuP. (x'"J60׿Y:Oi;F{w佩b+\Yi`TDWa~|VH)8q/=9!g߆2Y)?ND)%?Ǐ`k/sn:;O299yB=a[Ng 3˲N}vLNy;*?x?~L&=xyӴ~}q{qE*IQ^^ͧvü{Huu=R|>JyUlZV, B~/YF!Y\u_ݼF{_C)LD]m {H 0ihhadd nUkf3oٺCvE\)QJi+֥@tDJkB$1!Đr0XQ|q?d2) Ӣ_}qv-< FŊ߫%roppVBwü~JidY4:}L6M7f٬F "?71<2#?Jyy4뷢<_a7_=Q E=S1И/9{+93֮E{ǂw{))?maÆm(uLE#lïZ  ~d];+]h j?!|$F}*"4(v'8s<ŏUkm7^7no1w2ؗ}TrͿEk>p'8OB7d7R(A 9.*Mi^ͳ; eeUwS+C)uO@ =Sy]` }l8^ZzRXj[^iUɺ$tj))<sbDJfg=Pk_{xaKo1:-uyG0M ԃ\0Lvuy'ȱc2Ji AdyVgVh!{]/&}}ċJ#%d !+87<;qN޼Nفl|1N:8ya  8}k¾+-$4FiZYÔXk*I&'@iI99)HSh4+2G:tGhS^繿 Kتm0 вDk}֚+QT4;sC}rՅE,8CX-e~>G&'9xpW,%Fh,Ry56Y–hW-(v_,? ; qrBk4-V7HQ;ˇ^Gv1JVV%,ik;D_W!))+BoS4QsTM;gt+ndS-~:11Sgv!0qRVh!"Ȋ(̦Yl.]PQWgٳE'`%W1{ndΗBk|Ž7ʒR~,lnoa&:ü$ 3<a[CBݮwt"o\ePJ=Hz"_c^Z.#ˆ*x z̝grY]tdkP*:97YľXyBkD4N.C_[;F9`8& !AMO c `@BA& Ost\-\NX+Xp < !bj3C&QL+*&kAQ=04}cC!9~820G'PC9xa!w&bo_1 Sw"ܱ V )Yl3+ס2KoXOx]"`^WOy :3GO0g;%Yv㐫(R/r (s } u B &FeYZh0y> =2<Ϟc/ -u= c&׭,.0"g"7 6T!vl#sc>{u/Oh Bᾈ)۴74]x7 gMӒ"d]U)}" v4co[ ɡs 5Gg=XR14?5A}D "b{0$L .\4y{_fe:kVS\\O]c^W52LSBDM! C3Dhr̦RtArx4&agaN3Cf<Ԉp4~ B'"1@.b_/xQ} _߃҉/gٓ2Qkqp0շpZ2fԫYz< 4L.Cyυι1t@鎫Fe sYfsF}^ V}N<_`p)alٶ "(XEAVZ<)2},:Ir*#m_YӼ R%a||EƼIJ,,+f"96r/}0jE/)s)cjW#w'Sʯ5<66lj$a~3Kʛy 2:cZ:Yh))+a߭K::N,Q F'qB]={.]h85C9cr=}*rk?vwV렵ٸW Rs%}rNAkDv|uFLBkWY YkX מ|)1!$#3%y?pF<@<Rr0}: }\J [5FRxY<9"SQdE(Q*Qʻ)q1E0B_O24[U'],lOb ]~WjHޏTQ5Syu wq)xnw8~)c 쫬gٲߠ H% k5dƝk> kEj,0% b"vi2Wس_CuK)K{n|>t{P1򨾜j>'kEkƗBg*H%'_aY6Bn!TL&ɌOb{c`'d^{t\i^[uɐ[}q0lM˕G:‚4kb祔c^:?bpg… +37stH:0}en6x˟%/<]BL&* 5&fK9Mq)/iyqtA%kUe[ڛKN]Ě^,"`/ s[EQQm?|XJ߅92m]G.E΃ח U*Cn.j_)Tѧj̿30ڇ!A0=͜ar I3$C^-9#|pk!)?7.x9 @OO;WƝZBFU keZ75F6Tc6"ZȚs2y/1 ʵ:u4xa`C>6Rb/Yм)^=+~uRd`/|_8xbB0?Ft||Z\##|K 0>>zxv8۴吅q 8ĥ)"6>~\8:qM}#͚'ĉ#p\׶ l#bA?)|g g9|8jP(cr,BwV (WliVxxᡁ@0Okn;ɥh$_ckCgriv}>=wGzβ KkBɛ[˪ !J)h&k2%07δt}!d<9;I&0wV/ v 0<H}L&8ob%Hi|޶o&h1L|u֦y~󛱢8fٲUsւ)0oiFx2}X[zVYr_;N(w]_4B@OanC?gĦx>мgx>ΛToZoOMp>40>V Oy V9iq!4 LN,ˢu{jsz]|"R޻&'ƚ{53ўFu(<٪9:΋]B;)B>1::8;~)Yt|0(pw2N%&X,URBK)3\zz&}ax4;ǟ(tLNg{N|Ǽ\G#C9g$^\}p?556]/RP.90 k,U8/u776s ʪ_01چ|\N 0VV*3H鴃J7iI!wG_^ypl}r*jɤSR 5QN@ iZ#1ٰy;_\3\BQQ x:WJv츟ٯ$"@6 S#qe딇(/P( Dy~TOϻ<4:-+F`0||;Xl-"uw$Цi󼕝mKʩorz"mϺ$F:~E'ҐvD\y?Rr8_He@ e~O,T.(ފR*cY^m|cVR[8 JҡSm!ΆԨb)RHG{?MpqrmN>߶Y)\p,d#xۆWY*,l6]v0h15M˙MS8+EdI='LBJIH7_9{Caз*Lq,dt >+~ّeʏ?xԕ4bBAŚjﵫ!'\Ը$WNvKO}ӽmSşذqsOy?\[,d@'73'j%kOe`1.g2"e =YIzS2|zŐƄa\U,dP;jhhhaxǶ?КZ՚.q SE+XrbOu%\GتX(H,N^~]JyEZQKceTQ]VGYqnah;y$cQahT&QPZ*iZ8UQQM.qo/T\7X"u?Mttl2Xq(IoW{R^ ux*SYJ! 4S.Jy~ BROS[V|žKNɛP(L6V^|cR7i7nZW1Fd@ Ara{詑|(T*dN]Ko?s=@ |_EvF]׍kR)eBJc" MUUbY6`~V޴dJKß&~'d3i WWWWWW
Current Directory: /opt/cpanel/ea-ruby24/root/usr/share/ri/system/Gem/Security
Viewing File: /opt/cpanel/ea-ruby24/root/usr/share/ri/system/Gem/Security/cdesc-Security.ri
U:RDoc::NormalModule[iI" Security:EFI"Gem::Security;T0o:RDoc::Markup::Document: @parts[o;;[lS:RDoc::Markup::Heading: leveli: textI"Signing gems;To:RDoc::Markup::BlankLineo:RDoc::Markup::Paragraph;[I"RThe Gem::Security implements cryptographic signatures for gems. The section ;TI"Pbelow is a step-by-step guide to using signed gems and generating your own.;T@S; ; i; I"Walkthrough;T@S; ; i; I"Building your certificate;T@o; ;[I"QIn order to start signing your gems, you'll need to build a private key and ;TI",a self-signed certificate. Here's how:;T@o:RDoc::Markup::Verbatim;[I"9# build a private key and certificate for yourself: ;TI"($ gem cert --build you@example.com ;T: @format0o; ;[ I"RThis could take anywhere from a few seconds to a minute or two, depending on ;TI"Jthe speed of your computer (public key algorithms aren't exactly the ;TI"Pspeediest crypto algorithms in the world). When it's finished, you'll see ;TI"Nthe files "gem-private_key.pem" and "gem-public_cert.pem" in the current ;TI"directory.;T@o; ;[I"OFirst things first: Move both files to ~/.gem if you don't already have a ;TI"Rkey and certificate in that directory. Ensure the file permissions make the ;TI"Fkey unreadable by others (by default the file is saved securely).;T@o; ;[I"RKeep your private key hidden; if it's compromised, someone can sign packages ;TI"Oas you (note: PKI has ways of mitigating the risk of stolen keys; more on ;TI"that later).;T@S; ; i; I"Signing Gems;T@o; ;[I"RIn RubyGems 2 and newer there is no extra work to sign a gem. RubyGems will ;TI"Pautomatically find your key and certificate in your home directory and use ;TI"&them to sign newly packaged gems.;T@o; ;[ I"OIf your certificate is not self-signed (signed by a third party) RubyGems ;TI"Owill attempt to load the certificate chain from the trusted certificates. ;TI"MUse <code>gem cert --add signing_cert.pem</code> to add your signers as ;TI"Mtrusted certificates. See below for further information on certificate ;TI" chains.;T@o; ;[I"PIf you build your gem it will automatically be signed. If you peek inside ;TI"Eyour gem file, you'll see a couple of new files have been added:;T@o;;[ I"$ tar tf your-gem-1.0.gem ;TI"metadata.gz ;TI"metadata.gz.sum ;TI"*metadata.gz.sig # metadata signature ;TI"data.tar.gz ;TI"data.tar.gz.sum ;TI"&data.tar.gz.sig # data signature ;T;0S; ; i; I"Manually signing gems;T@o; ;[ I"PIf you wish to store your key in a separate secure location you'll need to ;TI"@set your gems up for signing by hand. To do this, set the ;TI"P<code>signing_key</code> and <code>cert_chain</code> in the gemspec before ;TI"packaging your gem:;T@o;;[I";s.signing_key = '/secure/path/to/gem-private_key.pem' ;TI"<s.cert_chain = %w[/secure/path/to/gem-public_cert.pem] ;T;0o; ;[I"RWhen you package your gem with these options set RubyGems will automatically ;TI"9load your key and certificate from the secure paths.;T@S; ; i; I"&Signed gems and security policies;T@o; ;[I"PNow let's verify the signature. Go ahead and install the gem, but add the ;TI"@following options: <code>-P HighSecurity</code>, like this:;T@o;;[I"E# install the gem with using the security policy "HighSecurity" ;TI"1$ sudo gem install your.gem -P HighSecurity ;T;0o; ;[I"NThe <code>-P</code> option sets your security policy -- we'll talk about ;TI"-that in just a minute. Eh, what's this?;T@o;;[I"4$ gem install -P HighSecurity your-gem-1.0.gem ;TI"@ERROR: While executing gem ... (Gem::Security::Exception) ;TI"5 root cert /CN=you/DC=example is not trusted ;T;0o; ;[ I"NThe culprit here is the security policy. RubyGems has several different ;TI"Ksecurity policies. Let's take a short break and go over the security ;TI"Npolicies. Here's a list of the available security policies, and a brief ;TI"description of each one:;T@o:RDoc::Markup::List: @type: BULLET: @items[ o:RDoc::Markup::ListItem: @label0;[o; ;[I"NNoSecurity - Well, no security at all. Signed packages are treated like ;TI"unsigned packages.;To;;0;[o; ;[ I"ILowSecurity - Pretty much no security. If a package is signed then ;TI"?RubyGems will make sure the signature matches the signing ;TI"Gcertificate, and that the signing certificate hasn't expired, but ;TI"Gthat's it. A malicious user could easily circumvent this kind of ;TI"security.;To;;0;[o; ;[I"HMediumSecurity - Better than LowSecurity and NoSecurity, but still ;TI"Bfallible. Package contents are verified against the signing ;TI"Gcertificate, and the signing certificate is checked for validity, ;TI"Iand checked against the rest of the certificate chain (if you don't ;TI"Gknow what a certificate chain is, stay tuned, we'll get to that). ;TI"EThe biggest improvement over LowSecurity is that MediumSecurity ;TI"Bwon't install packages that are signed by untrusted sources. ;TI"CUnfortunately, MediumSecurity still isn't totally secure -- a ;TI"Hmalicious user can still unpack the gem, strip the signatures, and ;TI"!distribute the gem unsigned.;To;;0;[o; ;[ I"BHighSecurity - Here's the bugger that got us into this mess. ;TI"HThe HighSecurity policy is identical to the MediumSecurity policy, ;TI"Dexcept that it does not allow unsigned gems. A malicious user ;TI"Edoesn't have a whole lot of options here; they can't modify the ;TI"Ipackage contents without invalidating the signature, and they can't ;TI"Emodify or remove signature or the signing certificate chain, or ;TI"IRubyGems will simply refuse to install the package. Oh well, maybe ;TI"Ithey'll have better luck causing problems for CPAN users instead :).;T@o; ;[I"RThe reason RubyGems refused to install your shiny new signed gem was because ;TI"Rit was from an untrusted source. Well, your code is infallible (naturally), ;TI"5so you need to add yourself as a trusted source:;T@o;;[I"# add trusted certificate ;TI"/gem cert --add ~/.gem/gem-public_cert.pem ;T;0o; ;[I"PYou've now added your public certificate as a trusted source. Now you can ;TI"Pinstall packages signed by your private key without any hassle. Let's try ;TI"%the install command above again:;T@o;;[ I"I# install the gem with using the HighSecurity policy (and this time ;TI" # without any shenanigans) ;TI"4$ gem install -P HighSecurity your-gem-1.0.gem ;TI")Successfully installed your-gem-1.0 ;TI"1 gem installed ;T;0o; ;[I"MThis time RubyGems will accept your signed package and begin installing.;T@o; ;[I"RWhile you're waiting for RubyGems to work it's magic, have a look at some of ;TI"Gthe other security commands by running <code>gem help cert</code>:;T@o;;[I"Options: ;TI"C -a, --add CERT Add a trusted certificate. ;TI"L -l, --list [FILTER] List trusted certificates where the ;TI"@ subject contains FILTER ;TI"N -r, --remove FILTER Remove trusted certificates where the ;TI"@ subject contains FILTER ;TI"J -b, --build EMAIL_ADDR Build private key and self-signed ;TI"C certificate for EMAIL_ADDR ;TI"G -C, --certificate CERT Signing certificate for --sign ;TI"B -K, --private-key KEY Key for --sign or --build ;TI"H -s, --sign CERT Signs CERT with the key from -K ;TI"D and the certificate from -C ;T;0o; ;[ I"DWe've already covered the <code>--build</code> option, and the ;TI"Q<code>--add</code>, <code>--list</code>, and <code>--remove</code> commands ;TI"Nseem fairly straightforward; they allow you to add, list, and remove the ;TI"Jcertificates in your trusted certificate list. But what's with this ;TI" <code>--sign</code> option?;T@S; ; i; I"Certificate chains;T@o; ;[ I"KTo answer that question, let's take a look at "certificate chains", a ;TI"Gconcept I mentioned earlier. There are a couple of problems with ;TI"Rself-signed certificates: first of all, self-signed certificates don't offer ;TI"Ra whole lot of security. Sure, the certificate says Yukihiro Matsumoto, but ;TI"Rhow do I know it was actually generated and signed by matz himself unless he ;TI"'gave me the certificate in person?;T@o; ;[ I"QThe second problem is scalability. Sure, if there are 50 gem authors, then ;TI"LI have 50 trusted certificates, no problem. What if there are 500 gem ;TI"Mauthors? 1000? Having to constantly add new trusted certificates is a ;TI"Mpain, and it actually makes the trust system less secure by encouraging ;TI"6RubyGems users to blindly trust new certificates.;T@o; ;[ I"RHere's where certificate chains come in. A certificate chain establishes an ;TI"Parbitrarily long chain of trust between an issuing certificate and a child ;TI"Qcertificate. So instead of trusting certificates on a per-developer basis, ;TI"Rwe use the PKI concept of certificate chains to build a logical hierarchy of ;TI"Ptrust. Here's a hypothetical example of a trust hierarchy based (roughly) ;TI"on geography:;T@o;;[I"4 -------------------------- ;TI"3 | rubygems@rubygems.org | ;TI"4 -------------------------- ;TI"' | ;TI"7 ----------------------------------- ;TI"7 | | ;TI"E ---------------------------- ----------------------------- ;TI"E | seattlerb@seattlerb.org | | dcrubyists@richkilmer.com | ;TI"E ---------------------------- ----------------------------- ;TI"? | | | | ;TI"G--------------- ---------------- ----------- -------------- ;TI"G| drbrain | | zenspider | | pabs@dc | | tomcope@dc | ;TI"G--------------- ---------------- ----------- -------------- ;T;0o; ;[I"QNow, rather than having 4 trusted certificates (one for drbrain, zenspider, ;TI"Fpabs@dc, and tomecope@dc), a user could actually get by with one ;TI":certificate, the "rubygems@rubygems.org" certificate.;T@o; ;[I"Here's how it works:;T@o; ;[ I"QI install "rdoc-3.12.gem", a package signed by "drbrain". I've never heard ;TI"Fof "drbrain", but his certificate has a valid signature from the ;TI"Q"seattle.rb@seattlerb.org" certificate, which in turn has a valid signature ;TI"Pfrom the "rubygems@rubygems.org" certificate. Voila! At this point, it's ;TI"Qmuch more reasonable for me to trust a package signed by "drbrain", because ;TI"JI can establish a chain to "rubygems@rubygems.org", which I do trust.;T@S; ; i; I"Signing certificates;T@o; ;[ I"LThe <code>--sign</code> option allows all this to happen. A developer ;TI"Pcreates their build certificate with the <code>--build</code> option, then ;TI"Phas their certificate signed by taking it with them to their next regional ;TI"MRuby meetup (in our hypothetical example), and it's signed there by the ;TI"Rperson holding the regional RubyGems signing certificate, which is signed at ;TI"Pthe next RubyConf by the holder of the top-level RubyGems certificate. At ;TI"1each point the issuer runs the same command:;T@o;;[ I"A# sign a certificate with the specified key and certificate ;TI"2# (note that this modifies client_cert.pem!) ;TI"J$ gem cert -K /mnt/floppy/issuer-priv_key.pem -C issuer-pub_cert.pem ;TI" --sign client_cert.pem ;T;0o; ;[ I"QThen the holder of issued certificate (in this case, your buddy "drbrain"), ;TI"Ocan start using this signed certificate to sign RubyGems. By the way, in ;TI"Morder to let everyone else know about his new fancy signed certificate, ;TI":"drbrain" would save his newly signed certificate as ;TI",<code>~/.gem/gem-public_cert.pem</code>;T@o; ;[ I"OObviously this RubyGems trust infrastructure doesn't exist yet. Also, in ;TI"Nthe "real world", issuers actually generate the child certificate from a ;TI"Mcertificate request, rather than sign an existing certificate. And our ;TI"Mhypothetical infrastructure is missing a certificate revocation system. ;TI"1These are that can be fixed in the future...;T@o; ;[I"NAt this point you should know how to do all of these new and interesting ;TI" things:;T@o;;;;[ o;;0;[o; ;[I",build a gem signing key and certificate;To;;0;[o; ;[I" adjust your security policy;To;;0;[o; ;[I")modify your trusted certificate list;To;;0;[o; ;[I"sign a certificate;T@S; ; i; I""Manually verifying signatures;T@o; ;[I"MIn case you don't trust RubyGems you can verify gem signatures manually:;T@o;;: NUMBER;[ o;;0;[o; ;[I"Fetch and unpack the gem;T@o;;[I"gem fetch some_signed_gem ;TI"%tar -xf some_signed_gem-1.0.gem ;T;0o;;0;[o; ;[I")Grab the public key from the gemspec;T@o;;[I"5gem spec some_signed_gem-1.0.gem cert_chain | \ ;TI"J ruby -ryaml -e 'puts YAML.load_documents($stdin)' > public_key.crt ;T;0o;;0;[o; ;[I",Generate a SHA1 hash of the data.tar.gz;T@o;;[I"0openssl dgst -sha1 < data.tar.gz > my.hash ;T;0o;;0;[o; ;[I"Verify the signature;T@o;;[I"<openssl rsautl -verify -inkey public_key.crt -certin \ ;TI"+ -in data.tar.gz.sig > verified.hash ;T;0o;;0;[o; ;[I"+Compare your hash to the verified hash;T@o;;[I"#diff -s verified.hash my.hash ;T;0o;;0;[o; ;[I"$Repeat 5 and 6 with metadata.gz;T@S; ; i; I"OpenSSL Reference;T@o; ;[I"MThe .pem files generated by --build and --sign are PEM files. Here's a ;TI"=couple of useful OpenSSL commands for manipulating them:;T@o;;[ I"># convert a PEM format X509 certificate into DER format: ;TI"F# (note: Windows .cer files are X509 certificates in DER format) ;TI"?$ openssl x509 -in input.pem -outform der -out output.der ;TI" ;TI"=# print out the certificate in a human-readable format: ;TI"/$ openssl x509 -in input.pem -noout -text ;T;0o; ;[I"EAnd you can do the same thing with the private key file as well:;T@o;;[ I"5# convert a PEM format RSA key into DER format: ;TI"F$ openssl rsa -in input_key.pem -outform der -out output_key.der ;TI" ;TI"5# print out the key in a human readable format: ;TI"2$ openssl rsa -in input_key.pem -noout -text ;T;0S; ; i; I"Bugs/TODO;T@o;;;;[o;;0;[o; ;[I"7There's no way to define a system-wide trust list.;To;;0;[o; ;[I"5custom security policies (from a YAML file, etc);To;;0;[o; ;[I";Simple method to generate a signed certificate request;To;;0;[o; ;[I"KSupport for OCSP, SCVP, CRLs, or some other form of cert status check ;TI"%(list is in order of preference);To;;0;[o; ;[I"'Support for encrypted private keys;To;;0;[o; ;[I"KSome sort of semi-formal trust hierarchy (see long-winded explanation ;TI" above);To;;0;[o; ;[ I"NPath discovery (for gem certificate chains that don't have a self-signed ;TI"Proot) -- by the way, since we don't have this, THE ROOT OF THE CERTIFICATE ;TI"PCHAIN MUST BE SELF SIGNED if Policy#verify_root is true (and it is for the ;TI".MediumSecurity and HighSecurity policies);To;;0;[o; ;[I"GBetter explanation of X509 naming (ie, we don't have to use email ;TI"addresses);To;;0;[o; ;[I"0Honor AIA field (see note about OCSP above);To;;0;[o; ;[I"!Honor extension restrictions;To;;0;[o; ;[I"KMight be better to store the certificate chain as a PKCS#7 or PKCS#12 ;TI"8file, instead of an array embedded in the metadata.;To;;0;[o; ;[I"KFlexible signature and key algorithms, not hard-coded to RSA and SHA1.;T@S; ; i; I"Original author;T@o; ;[I"&Paul Duncan <pabs@pablotron.org> ;TI"http://pablotron.org/;T: @fileI"lib/rubygems/security.rb;T:0@omit_headings_from_table_of_contents_below0o;;[;I"&lib/rubygems/security/policies.rb;T;0;0;0[[U:RDoc::Constant[iI"DIGEST_ALGORITHM;FI"$Gem::Security::DIGEST_ALGORITHM;T00o;;[o; ;[I"'Digest algorithm used to sign gems;T;@�;0@�@cRDoc::NormalModule0U;[iI"KEY_ALGORITHM;FI"!Gem::Security::KEY_ALGORITHM;T00o;;[o; ;[I":Algorithm for creating the key pair used to sign gems;T;@�;0@�@@�0U;[iI"KEY_LENGTH;FI"Gem::Security::KEY_LENGTH;T00o;;[o; ;[I",Length of keys created by KEY_ALGORITHM;T;@�;0@�@@�0U;[iI"KEY_CIPHER;FI"Gem::Security::KEY_CIPHER;T00o;;[o; ;[I"<Cipher used to encrypt the key pair used to sign gems. ;TI"<Must be in the list returned by OpenSSL::Cipher.ciphers;T;@�;0@�@@�0U;[iI" ONE_YEAR;FI"Gem::Security::ONE_YEAR;T00o;;[o; ;[I"One year in seconds;T;@�;0@�@@�0U;[iI"EXTENSIONS;FI"Gem::Security::EXTENSIONS;T00o;;[o; ;[I"'The default set of extensions are:;T@o;;;;[o;;0;[o; ;[I"3The certificate is not a certificate authority;To;;0;[o; ;[I"KThe key for the certificate may be used for key and data encipherment ;TI"and digital signatures;To;;0;[o; ;[I"6The certificate contains a subject key identifier;T;@�;0@�@@�0U;[iI"NoSecurity;FI"Gem::Security::NoSecurity;T00o;;[o; ;[I"CNo security policy: all package signature checks are disabled.;T;@�;0@�@@�0U;[iI"AlmostNoSecurity;FI"$Gem::Security::AlmostNoSecurity;T00o;;[o; ;[I"OAlmostNo security policy: only verify that the signing certificate is the ;TI"Oone that actually signed the data. Make no attempt to verify the signing ;TI"certificate chain.;T@o; ;[I"MThis policy is basically useless. better than nothing, but can still be ;TI",easily spoofed, and is not recommended.;T;@�;0@�@@�0U;[iI"LowSecurity;FI"Gem::Security::LowSecurity;T00o;;[o; ;[I"OLow security policy: only verify that the signing certificate is actually ;TI"?the gem signer, and that the signing certificate is valid.;T@o; ;[I"NThis policy is better than nothing, but can still be easily spoofed, and ;TI"is not recommended.;T;@�;0@�@@�0U;[iI"MediumSecurity;FI""Gem::Security::MediumSecurity;T00o;;[o; ;[I"PMedium security policy: verify the signing certificate, verify the signing ;TI"Pcertificate chain all the way to the root certificate, and only trust root ;TI"<certificates that we have explicitly allowed trust for.;T@o; ;[I"OThis security policy is reasonable, but it allows unsigned packages, so a ;TI"Mmalicious person could simply delete the package signature and pass the ;TI"gem off as unsigned.;T;@�;0@�@@�0U;[iI"HighSecurity;FI" Gem::Security::HighSecurity;T00o;;[o; ;[ I"NHigh security policy: only allow signed gems to be installed, verify the ;TI"Nsigning certificate, verify the signing certificate chain all the way to ;TI"Ithe root certificate, and only trust root certificates that we have ;TI""explicitly allowed trust for.;T@o; ;[I"PThis security policy is significantly more difficult to bypass, and offers ;TI"Oa reasonable guarantee that the contents of the gem have not been altered.;T;@�;0@�@@�0U;[iI"SigningPolicy;FI"!Gem::Security::SigningPolicy;T00o;;[o; ;[I"CPolicy used to verify a certificate and key when signing a gem;T;@�;0@�@@�0U;[iI" Policies;FI"Gem::Security::Policies;T00o;;[o; ;[I")Hash of configured security policies;T;@�;0@�@@�0[[[I" class;T[[: public[[I"alt_name_or_x509_entry;FI"lib/rubygems/security.rb;T[I"create_cert;F@�[I"create_cert_email;F@�[I"create_cert_self_signed;F@�[I"create_key;F@�[I"email_to_name;F@�[I" re_sign;F@�[I" reset;F@�[I" sign;F@�[I"trust_dir;F@�[I"trusted_certificates;F@�[I" write;F@�[:protected[[: private[[I" instance;T[[;[[;[[;[[[U:RDoc::Context::Section[i0o;;[;0;0[ I"+lib/rubygems/install_update_options.rb;TI"lib/rubygems/package.rb;TI" lib/rubygems/package/old.rb;T@�@�I"$lib/rubygems/security/policy.rb;TI"$lib/rubygems/security/signer.rb;TI"'lib/rubygems/security/trust_dir.rb;TI"Gem;F@�