class Gem::Cooldown

Applies a cooldown period to remote gem versions as a supply chain attack mitigation. When a cooldown of N days is configured, gem versions published within the last N days are not considered for installation or update. Versions whose publish time is unknown are never excluded, so sources that do not provide publish times keep working.

The cooldown period comes from the --cooldown DAYS option when given, falling back to the :cooldown: setting in the gemrc file. A value of 0 disables the cooldown.

Attributes

days [R]

The cooldown period in days.

Public Class Methods

from_options (options)

Source

# File lib/rubygems/cooldown.rb, line 26
def self.from_options(options)
  new(options[:cooldown] || Gem.configuration.cooldown)
end

Creates a Cooldown from the command line options, preferring the –cooldown option over the :cooldown: gemrc setting.

new (days, now: Time.now)

Source

# File lib/rubygems/cooldown.rb, line 30
def initialize(days, now: Time.now)
  @days = days.to_i
  @now = now
end

output_skipped_summary (entries)

Source

# File lib/rubygems/cooldown.rb, line 69
def self.output_skipped_summary(entries)
  return if entries.nil? || entries.empty?

  newest = {}
  entries.each do |entry|
    current = newest[entry[:name]]
    newest[entry[:name]] = entry if current.nil? || entry[:version] > current[:version]
  end

  ui = Gem::DefaultUserInteraction.ui
  ui.say "The following gem versions were skipped by the cooldown setting:"
  newest.values.sort_by {|entry| entry[:name] }.each do |entry|
    days = entry[:available_in_days]
    ui.say "  * #{entry[:name]} #{entry[:version]} (available in #{days} #{days == 1 ? "day" : "days"}), resolved #{entry[:resolved]} instead"
  end
end

Reports, per gem, the newest version the cooldown kept out of a completed installation or update. entries are hashes with :name, :version, :resolved and :available_in_days keys; when several entries name the same gem only the newest version is shown.

warn_missing_created_at (source)

Source

# File lib/rubygems/cooldown.rb, line 90
def self.warn_missing_created_at(source)
  return if @warned
  @warned = true

  Gem::DefaultUserInteraction.ui.alert_warning \
    "#{source.uri} does not provide gem publish times, the cooldown period does not apply to gems from this source"
end

Warns once per process that source did not provide publish times, so the cooldown cannot be applied to gems from it.

Public Instance Methods

active? ()

Source

# File lib/rubygems/cooldown.rb, line 38
def active?
  @days > 0
end

True when a cooldown period is configured.

remaining_days (created_at)

Source

# File lib/rubygems/cooldown.rb, line 57
def remaining_days(created_at)
  remaining = @days * 86_400 - (@now - created_at)

  [(remaining / 86_400.0).ceil, 1].max
end

Number of days until a gem version published at created_at leaves the cooldown period, rounded up and at least 1.

skip? (created_at)

Source

# File lib/rubygems/cooldown.rb, line 46
def skip?(created_at)
  return false unless active?
  return false unless created_at

  (@now - created_at) < @days * 86_400
end

True when a gem version published at created_at must not be considered. Versions with an unknown publish time (nil) are kept.