[ruby/rubygems] Forward security policy to old-format gems

The Gem::Package.new factory forwarded security_policy via super on the
normal path but dropped it on the old-format branch, so -P/--trust-policy
was silently ignored for MD5SUM gems and verify became a no-op.

ruby/rubygems@7cd3cdb6dd

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people

lib/rubygems/package.rb

@@ -161,7 +161,7 @@ def self.new(gem, security_policy = nil)
     return super unless gem.start
     return super unless gem.start.include? "MD5SUM ="
 
-    Gem::Package::Old.new gem
+    Gem::Package::Old.new gem, security_policy
   end
 
   ##

test/rubygems/test_gem_package.rb

@@ -33,6 +33,25 @@ def test_class_new_old_format
     assert package.spec
   end
 
+  def test_class_new_old_format_forwards_security_policy
+    pend "jruby can't require the simple_gem file" if Gem.java_platform?
+    pend "openssl is missing" unless Gem::HAVE_OPENSSL
+    require_relative "simple_gem"
+    File.open "old_format.gem", "wb" do |io|
+      io.write SIMPLE_GEM
+    end
+
+    package = Gem::Package.new "old_format.gem", Gem::Security::HighSecurity
+
+    e = assert_raise Gem::Security::Exception do
+      package.verify
+    end
+
+    assert_equal "old format gems do not contain signatures " \
+                 "and cannot be verified",
+                 e.message
+  end
+
   def test_add_checksums
     gem_io = StringIO.new