Gem::Security::Policy#check_trust

# File tmp/rubies/ruby-3.4.1/lib/rubygems/security/policy.rb, line 149
def check_trust(chain, digester, trust_dir)
  raise Gem::Security::Exception, "missing signing chain" unless chain

  root = chain.first

  raise Gem::Security::Exception, "missing root certificate" unless root

  path = Gem::Security.trust_dir.cert_path root

  unless File.exist? path
    message = "root cert #{root.subject} is not trusted".dup

    message << " (root of signing cert #{chain.last.subject})" if
      chain.length > 1

    raise Gem::Security::Exception, message
  end

  save_cert = OpenSSL::X509::Certificate.new File.read path
  save_dgst = digester.digest save_cert.public_key.to_pem

  pkey_str = root.public_key.to_pem
  cert_dgst = digester.digest pkey_str

  raise Gem::Security::Exception,
        "trusted root certificate #{root.subject} checksum " \
        "does not match signing root certificate checksum" unless
    save_dgst == cert_dgst

  true
end