ruby: fix +openssl & +readline variants (#6935)

* ruby: fix +openssl & +readline variants

Fix "unqualified variable spec['openssl']" error in the ruby package
that arises when trying to install the `+openssl` variant by
referencing the `spec` field in the `Ruby` class. A similar error
arises when trying to install the `+readline` variant; this error is
also fixed by this patch.

* ruby: make +openssl variant default to on

Ruby's gem command will fetch gems from HTTPS resources by default
(e.g., gem install bundler). Without openssl, request to fetch gems
bounce back with the error

```
ERROR:  While executing gem ... (Gem::Exception)
    Unable to require openssl, install OpenSSL and rebuild ruby (preferred) or use non-HTTPS sources
```

Without the ability to install gems -- required for some spack
packages -- the ruby installation has limited utility for many users.

* ruby: update rubygems ssl cert to fix ssl errors

The SSL certificate bundled with Ruby 2.2.0 is outdated, so e.g., `gem
install erubis` will fail with an SSL certificate error. This commit
installs the updated SSL certificate to the proper directory so that
gems can be downloaded and installed from RubyGems.

var/spack/repos/builtin/packages/ruby/package.py

@@ -34,7 +34,7 @@ class Ruby(AutotoolsPackage):
 
     version('2.2.0', 'cd03b28fd0b555970f5c4fd481700852')
 
-    variant('openssl', default=False, description="Enable OpenSSL support")
+    variant('openssl', default=True, description="Enable OpenSSL support")
     variant('readline', default=False, description="Enable Readline support")
 
     extendable = True
@@ -47,12 +47,23 @@ class Ruby(AutotoolsPackage):
     depends_on('openssl', when='+openssl')
     depends_on('readline', when='+readline')
 
+    resource(
+        name='rubygems-updated-ssl-cert',
+        url='https://raw.githubusercontent.com/rubygems/rubygems/master/lib/rubygems/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem',
+        sha256='df68841998b7fd098a9517fe971e97890be0fc93bbe1b2a1ef63ebdea3111c80',
+        when='+openssl',
+        destination='',
+        placement='rubygems-updated-ssl-cert',
+        expand=False
+    )
+
     def configure_args(self):
         args = []
         if '+openssl' in self.spec:
-            args.append("--with-openssl-dir=%s" % spec['openssl'].prefix)
+            args.append("--with-openssl-dir=%s" % self.spec['openssl'].prefix)
         if '+readline' in self.spec:
-            args.append("--with-readline-dir=%s" % spec['readline'].prefix)
+            args.append("--with-readline-dir=%s"
+                        % self.spec['readline'].prefix)
         args.append('--with-tk=%s' % self.spec['tk'].prefix)
         return args
 
@@ -80,3 +91,21 @@ def setup_dependent_package(self, module, dependent_spec):
         # Ruby extension builds have global ruby and gem functions
         module.ruby = Executable(join_path(self.spec.prefix.bin, 'ruby'))
         module.gem = Executable(join_path(self.spec.prefix.bin, 'gem'))
+
+    @run_after('install')
+    def post_install(self):
+        """ RubyGems updated their SSL certificates at some point, so
+        new certificates must be installed after Ruby is installed
+        in order to download gems; see
+        http://guides.rubygems.org/ssl-certificate-update/
+        for details.
+        """
+        rubygems_updated_cert_path = join_path(self.stage.source_path,
+                                               'rubygems-updated-ssl-cert',
+                                               'GlobalSignRootCA.pem')
+        rubygems_certs_path = join_path(self.spec.prefix.lib,
+                                        'ruby',
+                                        '{0}'.format(self.spec.version.dotted),
+                                        'rubygems',
+                                        'ssl_certs')
+        install(rubygems_updated_cert_path, rubygems_certs_path)