Last active
December 12, 2015 00:29
-
-
Save revans/4684343 to your computer and use it in GitHub Desktop.
If you have a copy of the original .gem file that you pushed to rubygems.org, you can verify a checksum of both files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env ruby | |
# | |
# Usage: | |
# ruby validate_original_gem.rb /path/to/gem/gemname.rb | |
require 'openssl' | |
require 'digest/sha1' | |
require 'zlib' | |
module Verify | |
class Gem | |
attr_reader :gem, :gem_basename, :rubygems_hash_file | |
def initialize(gem) | |
@gem = gem | |
@gem_basename = File.basename(gem) | |
@rubygems_hash_file = "rubygems-shas.txt" | |
end | |
def validate | |
raise "Gem not found" unless @gem_basename | |
fetch_shas("http://cl.ly/MYie/download/rubygems-shas.txt.gz") | |
verify_hashes | |
end | |
private | |
def fetch_shas(file) | |
return if File.exists?(rubygems_hash_file) | |
`wget #{file}` | |
Zlib::GzipReader.open(File.basename(file)) do |gz| | |
File.open(rubygems_hash_file, 'w') do |file| | |
file.write(gz.read) | |
end | |
end | |
end | |
def remote_hash | |
open(rubygems_hash_file) { |f| f.grep(/#{gem_basename}/) }.first.split(' ').first.strip | |
end | |
def local_hash | |
Digest::SHA512.file(gem).to_s | |
end | |
def verify_hashes | |
puts "Gem compared: #{gem_basename}" | |
puts " Remote hash: #{remote_hash}" | |
puts " Local hash: #{local_hash}" | |
if remote_hash == local_hash | |
puts "Overall result: #{passed}" | |
else | |
puts "Overall result: #{failed}" | |
failure_message | |
end | |
end | |
def passed | |
"\033[1;36mPASS\033[0m" | |
end | |
def failed | |
"\033[1;31mFAIL\033[0m" | |
end | |
def failure_message | |
puts "Try checking out the RubyGems incident Doc and use the unpack script" | |
puts "https://github.com/bradland/rubygems-incident-verifiers" | |
end | |
end | |
end | |
Verify::Gem.new(ARGV[0]).validate |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment