Bundler: Add post-quantum cryptography (PQC) support

This ticket is a sub task of the https://bugs.ruby-lang.org/issues/22068.

Summary

This issue ticket is to manage Bundler specific things to add PQC support.
For RubyGems specific thing, you can see https://github.com/ruby/rubygems/issues/9542.

Bundler has a HTTPS client feature to connect HTTPS RubyGems server. We need to test this part, and may modify the part.

Proof of concept

I prepared the proof-of-concept for Bundler in the following repository.

• https://github.com/junaruga/ruby-pqc-test/tree/main/bundler
• https://github.com/junaruga/ruby-pqc-test/blob/main/.github/workflows/bundler.yml

The testing matrix in the bundler.yml is below. For the explanation of each testnig case, you can check the #9542 - RubyGems server - Choice of the RubyGems server types

2. RubyGems HTTPS client => HTTPS Ruby OpenSSL reverse proxy => RubyGems HTTP server
3. RubyGems HTTPS client => HTTPS Nginx reverse proxy => RubyGems HTTP server

x

• a. PQC (single), non-PQC (single): Running a PQC server (ML-DSA-65 only) on port 18443 and a non-PQC server (RSA only) on port 18444 at the same time.

For Bundler to connect to the HTTPS PQC RubyGems server (https://pqc.rubygems.org), users need to set the following bundle config set commands. With the bundle config set mirror. setting, users can bypass the source 'https://rubygems.org/' written in Gemfile.

bundle config set --global ssl_ca_cert "/path/to/pqc_ca_file"
bundle config set --global mirror.https://rubygems.org https://pqc.rubygems.org

https://bundler.io/man/bundle-config.1.html - ssl_ca_cert
https://bundler.io/man/bundle-config.1.html#MIRRORS-OF-GEM-SOURCES

By the way, as bundle config set ssl_ca_cert didn't work, I am using OpenSSL's environment variable SSL_CERT_FILE in the testing script bundler/script/run_client.sh.

export SSL_CERT_FILE=/path/to/ca_file

https://docs.openssl.org/master/man7/openssl-env/ - SSL_CERT_FILE

Scope

• Full backward compatibility.
• bundle install and bundle update works for a RubyGems server with enabled key exchange ML-KEM, and signature algorithms: ML-DSA-44, ML-DSA-65, and ML-DSA-87.
• bundle install and bundle update works with bundle config set ssl_ca_cert and bundle config set ssl_client_cert for ML-DSA-44, ML-DSA-65, and ML-DSA-87 certificates.
• bundle install --trust-policy=TRUST-POLICY works with signed gems built from .gemspec file with s.cert_chain and s.signing_key by ML-DSA-44, ML-DSA-65, and ML-DSA-87.

Files to modify

Below is a list of the files that we may modify to support PQC.

lib/bundler/fetcher.rb
spec/bundler/fetcher_spec.rb
spec/support/builders.rb

Let me know what you think.

Bundler PQC related pull-requests

• https://github.com/ruby/rubygems/pull/9610
• https://github.com/ruby/rubygems/pull/9637