Skip to content

Instantly share code, notes, and snippets.

@revans
Last active December 12, 2015 00:29
Show Gist options
  • Save revans/4684343 to your computer and use it in GitHub Desktop.
Save revans/4684343 to your computer and use it in GitHub Desktop.
If you have a copy of the original .gem file that you pushed to rubygems.org, you can verify a checksum of both files.
#!/usr/bin/env ruby
#
# Usage:
# ruby validate_original_gem.rb /path/to/gem/gemname.rb
require 'openssl'
require 'digest/sha1'
require 'zlib'
module Verify
class Gem
attr_reader :gem, :gem_basename, :rubygems_hash_file
def initialize(gem)
@gem = gem
@gem_basename = File.basename(gem)
@rubygems_hash_file = "rubygems-shas.txt"
end
def validate
raise "Gem not found" unless @gem_basename
fetch_shas("http://cl.ly/MYie/download/rubygems-shas.txt.gz")
verify_hashes
end
private
def fetch_shas(file)
return if File.exists?(rubygems_hash_file)
`wget #{file}`
Zlib::GzipReader.open(File.basename(file)) do |gz|
File.open(rubygems_hash_file, 'w') do |file|
file.write(gz.read)
end
end
end
def remote_hash
open(rubygems_hash_file) { |f| f.grep(/#{gem_basename}/) }.first.split(' ').first.strip
end
def local_hash
Digest::SHA512.file(gem).to_s
end
def verify_hashes
puts "Gem compared: #{gem_basename}"
puts " Remote hash: #{remote_hash}"
puts " Local hash: #{local_hash}"
if remote_hash == local_hash
puts "Overall result: #{passed}"
else
puts "Overall result: #{failed}"
failure_message
end
end
def passed
"\033[1;36mPASS\033[0m"
end
def failed
"\033[1;31mFAIL\033[0m"
end
def failure_message
puts "Try checking out the RubyGems incident Doc and use the unpack script"
puts "https://github.com/bradland/rubygems-incident-verifiers"
end
end
end
Verify::Gem.new(ARGV[0]).validate
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment