Bundler: Add post-quantum cryptography (PQC) support

[junaruga]

This ticket is a sub task of the https://bugs.ruby-lang.org/issues/22068.

Summary

This issue ticket is to manage Bundler specific things to add PQC support.
For RubyGems specific thing, you can see #9542.

Bundler has a HTTPS client feature to connect HTTPS RubyGems server. We need to test this part, and may modify the part.

Proof of concept

I prepared the proof-of-concept for Bundler in the following repository.

• https://github.com/junaruga/ruby-pqc-test/tree/main/bundler
• https://github.com/junaruga/ruby-pqc-test/blob/main/.github/workflows/bundler.yml

The testing matrix in the bundler.yml is below. For the explanation of each testnig case, you can check the #9542 - RubyGems server - Choice of the RubyGems server types

2. RubyGems HTTPS client => HTTPS Ruby OpenSSL reverse proxy => RubyGems HTTP server
3. RubyGems HTTPS client => HTTPS Nginx reverse proxy => RubyGems HTTP server

x

• a. PQC (single), non-PQC (single): Running a PQC server (ML-DSA-65 only) on port 18443 and a non-PQC server (RSA only) on port 18444 at the same time.

For Bundler to connect to the HTTPS PQC RubyGems server (https://pqc.rubygems.org), users need to set the following bundle config set commands. With the bundle config set mirror. setting, users can bypass the source 'https://rubygems.org/' written in Gemfile.

bundle config set --global ssl_ca_cert "/path/to/pqc_ca_file"
bundle config set --global mirror.https://rubygems.org https://pqc.rubygems.org

https://bundler.io/man/bundle-config.1.html - ssl_ca_cert
https://bundler.io/man/bundle-config.1.html#MIRRORS-OF-GEM-SOURCES

By the way, as bundle config set ssl_ca_cert didn't work, I am using OpenSSL's environment variable SSL_CERT_FILE in the testing script bundler/script/run_client.sh.

export SSL_CERT_FILE=/path/to/ca_file

https://docs.openssl.org/master/man7/openssl-env/ - SSL_CERT_FILE

Scope

• Full backward compatibility.
• bundle install and bundle update works for a RubyGems server with enabled key exchange ML-KEM, and signature algorithms: ML-DSA-44, ML-DSA-65, and ML-DSA-87.
• bundle install and bundle update works with bundle config set ssl_ca_cert and bundle config set ssl_client_cert for ML-DSA-44, ML-DSA-65, and ML-DSA-87 certificates.
• bundle install --trust-policy=TRUST-POLICY works with signed gems built from .gemspec file with s.cert_chain and s.signing_key by ML-DSA-44, ML-DSA-65, and ML-DSA-87.

Files to modify

Below is a list of the files that we may modify to support PQC.

lib/bundler/fetcher.rb
spec/bundler/fetcher_spec.rb
spec/support/builders.rb

Let me know what you think.

Bundler PQC related pull-requests

• Set Bundler.settings[:ssl_ca_cert] to download gems #9610
• bundler: Fix Bundler::Fetcher for PQC support, adding integration connection tests #9637

[junaruga]

By the way, as bundle config set ssl_ca_cert didn't work, I am using OpenSSL's environment variable SSL_CERT_FILE in the testing script bundler/script/run_client.sh.

This seems a bug. I sent the PR #9610 to fix it.

[junaruga]

I sent PR #9637 to fix Bundler::Fetcher#connection to support ML-DSA ssl_client_cert.

[hiSandog]

The scope would be easier to review if the first version defined a small acceptance contract for Bundler: Add post-quantum cryptography support. I would call out the default behavior, the migration/backwards-compatibility story, and one or two cases that are intentionally out of scope so the implementation does not grow beyond the original request.

[junaruga]

The scope would be easier to review if the first version defined a small acceptance contract for Bundler: Add post-quantum cryptography support. I would call out the default behavior, the migration/backwards-compatibility story, and one or two cases that are intentionally out of scope so the implementation does not grow beyond the original request.

@hiSandog Thanks for your feedback. I added the Scope section on the first comment of this issue page. What do you think?

[junaruga]

Note I removed the lib/bundler/shared_helpers.rb from "Files to modify" section. The reason why I added the file to the section before was because the lib/bundler/shared_helpers.rb has the method md5_available? to check if MD5 is available or not. That means Bundler uses MD5 somewhere. As for example, FIPS enabled environment forbids MD5, I wanted to investigate how MD5 was used in Bundler. However, the usage of MD5 is out of scope of PQC support. So, I removed the file from the section.

[junaruga]

As the PR #9697 to support ML-DSA baesd signed gem workflow in RubyGems was merged, I want to add the Bundler tests with RSA/ML-DSA signed gem workflows. This is the last task for this issue ticket in my mind. Feel free to take this task if you like.