Gem::Commands::PushCommand#attest!

# File tmp/rubies/ruby-4.1.0-preview1/lib/rubygems/commands/push_command.rb, line 231
def attest!(name)
  require "open3"
  require "shellwords"
  require "tempfile"

  env = defined?(Bundler.unbundled_env) ? Bundler.unbundled_env : ENV.to_h

  Tempfile.create([File.basename(name, ".*"), ".sigstore.json"]) do |tempfile|
    tempfile.close
    bundle = tempfile.path

    # Gem.ruby is quoted if it contains whitespace, so split it into argv
    # elements to keep the quotes out of the spawned command.
    out, st = Open3.capture2e(
      env,
      *Shellwords.split(Gem.ruby), "-S", "gem", "exec", "--conservative",
      "sigstore-cli", "sign", name, "--bundle", bundle,
      unsetenv_others: true
    )
    raise Gem::Exception, "Failed to sign gem:\n\n#{out}" unless st.success?

    validate_attestation_json(Gem.read_binary(bundle), "generated by sigstore-cli")
  end
end