Report the Ruby OpenSSL floor when ML-DSA certificate signing fails

Signing a certificate for an ML-DSA key passes a nil digest, which Ruby
OpenSSL rejects with a bare TypeError before 3.3. On Ruby 3.2 or 3.3 with
OpenSSL >= 3.5 the key generates and only `gem cert --build` breaks, so
the message has to name the missing piece.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/security.rb

@@ -638,6 +638,12 @@ def self.sign(certificate, signing_key, signing_cert, age = ONE_YEAR, extensions
     rescue OpenSSL::PKey::PKeyError, ArgumentError
       raise Gem::Security::Exception,
         "incorrect signing key for signing"
+    # Ruby OpenSSL only accepts the nil digest ML-DSA needs from 3.3 on.
+    rescue TypeError
+      raise if digest_name
+
+      raise Gem::Security::Exception,
+        "certificate signing failed: ML-DSA requires Ruby OpenSSL >= 3.3."
     end
   end
 

test/rubygems/helper.rb

@@ -1702,6 +1702,11 @@ def omit_unless_support_ml_dsa_cert
       Gem::PQCUtilities.support_ml_dsa_cert?
   end
 
+  def omit_if_support_ml_dsa_cert
+    omit "Ruby OpenSSL can sign a certificate with an ML-DSA key" if
+      Gem::PQCUtilities.support_ml_dsa_cert?
+  end
+
   def omit_if_support_ml_dsa_key
     omit "OpenSSL supports ML-DSA" if Gem::PQCUtilities.support_ml_dsa_key?
   end

test/rubygems/test_gem_security.rb

@@ -85,6 +85,18 @@ def test_class_create_cert_email
     assert_equal 59, key_ident.value.length
   end
 
+  def test_class_create_cert_email_ml_dsa_65_without_cert_support
+    omit_unless_support_ml_dsa_key
+    omit_if_support_ml_dsa_cert
+
+    e = assert_raise Gem::Security::Exception do
+      Gem::Security.create_cert_email "nobody@example",
+                                      ML_DSA_65_PRIVATE_KEY, 60
+    end
+
+    assert_match(/^certificate signing failed: /, e.message)
+  end
+
   def test_class_create_key
     key = Gem::Security.create_key "rsa"