From 5b67c504e4d01199e7b2b2559a95200595945720 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Wed, 8 Mar 2017 18:48:45 +0100 Subject: [PATCH 01/20] Be more careful about RubyGems directory ownership. And make this aligned with independent rubygems package. --- ruby.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ruby.spec b/ruby.spec index 1dbbcbd..6c7b523 100644 --- a/ruby.spec +++ b/ruby.spec @@ -905,7 +905,11 @@ make check TESTS="-v $DISABLE_TESTS" %files -n rubygems %{_bindir}/gem -%{rubygems_dir} +%dir %{rubygems_dir} +%{rubygems_dir}/rbconfig +%{rubygems_dir}/rubygems +%{rubygems_dir}/rubygems.rb +%{rubygems_dir}/ubygems.rb # Explicitly include only RubyGems directory strucure to avoid accidentally # packaged content. From 1798407d88c9017b499c3c902baf8fe319226b51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Mon, 3 Apr 2017 16:10:27 +0200 Subject: [PATCH 02/20] Update to Ruby 2.4.1. --- ruby-2.4.0-Prevent-GC-by-volatile.patch | 36 ------------------- ...nhelper.c-block-argument-at-tailcall.patch | 36 ------------------- ruby.spec | 21 +++++------ sources | 2 +- 4 files changed, 9 insertions(+), 86 deletions(-) delete mode 100644 ruby-2.4.0-Prevent-GC-by-volatile.patch delete mode 100644 ruby-2.4.0-vm_insnhelper.c-block-argument-at-tailcall.patch diff --git a/ruby-2.4.0-Prevent-GC-by-volatile.patch b/ruby-2.4.0-Prevent-GC-by-volatile.patch deleted file mode 100644 index 302f27b..0000000 --- a/ruby-2.4.0-Prevent-GC-by-volatile.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 7c1b30a602ab109d8d5388d7dfb3c5b180ba24e1 Mon Sep 17 00:00:00 2001 -From: naruse -Date: Mon, 23 Jan 2017 16:58:27 +0000 -Subject: [PATCH] Prevent GC by volatile [Bug #13150] - -test/ruby/test_marshal.rb test_context_switch (load) and test_gc (dump) -are failed on FreeBSD 10.3 and gcc7 (FreeBSD Ports Collection) 7.0.0 -20170115 (experimental); RB_GC_GUARD looks not worked well. - -git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57410 b2dd03c8-39d4-4d8f-98ff-823fe69b080e ---- - marshal.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/marshal.c b/marshal.c -index a9926ac..d628daa 100644 ---- a/marshal.c -+++ b/marshal.c -@@ -1024,7 +1024,7 @@ VALUE - rb_marshal_dump_limited(VALUE obj, VALUE port, int limit) - { - struct dump_arg *arg; -- VALUE wrapper; /* used to avoid memory leak in case of exception */ -+ volatile VALUE wrapper; /* used to avoid memory leak in case of exception */ - - wrapper = TypedData_Make_Struct(rb_cData, struct dump_arg, &dump_arg_data, arg); - arg->dest = 0; -@@ -2038,7 +2038,7 @@ rb_marshal_load_with_proc(VALUE port, VALUE proc) - { - int major, minor, infection = 0; - VALUE v; -- VALUE wrapper; /* used to avoid memory leak in case of exception */ -+ volatile VALUE wrapper; /* used to avoid memory leak in case of exception */ - struct load_arg *arg; - - v = rb_check_string_type(port); diff --git a/ruby-2.4.0-vm_insnhelper.c-block-argument-at-tailcall.patch b/ruby-2.4.0-vm_insnhelper.c-block-argument-at-tailcall.patch deleted file mode 100644 index cb8fe26..0000000 --- a/ruby-2.4.0-vm_insnhelper.c-block-argument-at-tailcall.patch +++ /dev/null @@ -1,36 +0,0 @@ -From ff3496b0116ed2ed589d000b7bfca3d8288b009c Mon Sep 17 00:00:00 2001 -From: nobu -Date: Mon, 9 Jan 2017 02:55:39 +0000 -Subject: [PATCH] vm_insnhelper.c: block argument at tailcall - -* vm_insnhelper.c (vm_call_iseq_setup_tailcall): check interrupts - after set up the new frame, not the passed block to be clobbered - by invoked finalizers and so on. [ruby-core:78981] [Bug #13107] - -git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@57293 b2dd03c8-39d4-4d8f-98ff-823fe69b080e ---- - vm_insnhelper.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/vm_insnhelper.c b/vm_insnhelper.c -index b580412..662a2d6 100644 ---- a/vm_insnhelper.c -+++ b/vm_insnhelper.c -@@ -1538,8 +1538,6 @@ vm_call_iseq_setup_tailcall(rb_thread_t *th, rb_control_frame_t *cfp, struct rb_ - vm_pop_frame(th, cfp, cfp->ep); - cfp = th->cfp; - -- RUBY_VM_CHECK_INTS(th); -- - sp_orig = sp = cfp->sp; - - /* push self */ -@@ -1558,6 +1556,8 @@ vm_call_iseq_setup_tailcall(rb_thread_t *th, rb_control_frame_t *cfp, struct rb_ - iseq->body->stack_max); - - cfp->sp = sp_orig; -+ RUBY_VM_CHECK_INTS(th); -+ - return Qundef; - } - diff --git a/ruby.spec b/ruby.spec index 6c7b523..82d5781 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ %global major_version 2 %global minor_version 4 -%global teeny_version 0 +%global teeny_version 1 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -21,7 +21,7 @@ %endif -%global release 78 +%global release 79 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -29,8 +29,8 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 2.6.8 -%global molinillo_version 0.5.3 +%global rubygems_version 2.6.11 +%global molinillo_version 0.5.7 # TODO: The IRB has strange versioning. Keep the Ruby's versioning ATM. # http://redmine.ruby-lang.org/issues/5313 @@ -42,7 +42,7 @@ %global json_version 2.0.2 %global minitest_version 5.10.1 %global net_telnet_version 0.1.1 -%global openssl_version 2.0.2 +%global openssl_version 2.0.3 %global power_assert_version 0.4.1 %global psych_version 2.2.2 %global rake_version 12.0.0 @@ -128,12 +128,6 @@ Patch7: ruby-2.2.3-Generate-preludes-using-miniruby.patch # hardening features of glibc (rhbz#1361037). # https://bugs.ruby-lang.org/issues/12666 Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch -# This fixed rubygem-mongo build failures and may be something else as well. -# https://bugs.ruby-lang.org/issues/13107 -Patch10: ruby-2.4.0-vm_insnhelper.c-block-argument-at-tailcall.patch -# Fix GCC 7.x compatibility (rhbz#1417590). -# https://bugs.ruby-lang.org/issues/13150 -Patch11: ruby-2.4.0-Prevent-GC-by-volatile.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} Suggests: rubypick @@ -513,8 +507,6 @@ rm -rf ext/fiddle/libffi* %patch6 -p1 %patch7 -p1 %patch9 -p1 -%patch10 -p1 -%patch11 -p1 # Provide an example of usage of the tapset: cp -a %{SOURCE3} . @@ -1029,6 +1021,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Mon Apr 03 2017 Vít Ondruch - 2.4.1-79 +- Update to Ruby 2.4.1. + * Thu Feb 23 2017 Vít Ondruch - 2.4.0-78 - Fix OpenSSL symlinks. diff --git a/sources b/sources index a541cc8..49ed326 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ruby-2.4.0.tar.xz) = 975a5388592adc038461e0acebb6c0efee242891b2ea8621476401458efe2bc0fdd317d3bf99beb745b0b3808410efdff33862da29c95c027f457943721e3ab6 +SHA512 (ruby-2.4.1.tar.xz) = e6fd290b6edd166348b70f0f1c56f7ed9d956c4c1eb91d97d0548041ca4196b9b75ec1ad35c745bdbfd4de195899093e7205d7f02b014ecf1c48e6f31cf25903 From 5620ffe088181cb529698a4fd84eb96a2fc29e41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Fri, 8 Sep 2017 14:10:33 +0200 Subject: [PATCH 03/20] Drop ruby-devel dependency on rubypick, which is pulled in transtitively. --- ruby.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/ruby.spec b/ruby.spec index 82d5781..638e743 100644 --- a/ruby.spec +++ b/ruby.spec @@ -21,7 +21,7 @@ %endif -%global release 79 +%global release 84 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -167,7 +167,8 @@ straight-forward, and extensible. Summary: A Ruby development environment Group: Development/Languages Requires: %{name}%{?_isa} = %{version}-%{release} -Requires: rubypick +# This would not be needed if ~50 packages depending on -devel used +# --disable-gems Requires: rubygems %description devel @@ -1021,6 +1022,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Fri Sep 08 2017 Vít Ondruch - 2.4.1-84 +- Drop ruby-devel dependency on rubypick, which is pulled in transtitively. + * Mon Apr 03 2017 Vít Ondruch - 2.4.1-79 - Update to Ruby 2.4.1. From 185a2073bc7035e40fbd8fa033999f2bbfcbbb46 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Mon, 18 Sep 2017 16:45:33 +0200 Subject: [PATCH 04/20] Update to Ruby 2.4.2. Patch10 and Patch11 subsumed. --- ruby.spec | 11 +++++++---- sources | 2 +- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/ruby.spec b/ruby.spec index 638e743..e2a202d 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ %global major_version 2 %global minor_version 4 -%global teeny_version 1 +%global teeny_version 2 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -29,7 +29,7 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 2.6.11 +%global rubygems_version 2.6.13 %global molinillo_version 0.5.7 # TODO: The IRB has strange versioning. Keep the Ruby's versioning ATM. @@ -39,10 +39,10 @@ %global bigdecimal_version 1.3.0 %global did_you_mean_version 1.1.0 %global io_console_version 0.4.6 -%global json_version 2.0.2 +%global json_version 2.0.4 %global minitest_version 5.10.1 %global net_telnet_version 0.1.1 -%global openssl_version 2.0.3 +%global openssl_version 2.0.5 %global power_assert_version 0.4.1 %global psych_version 2.2.2 %global rake_version 12.0.0 @@ -1022,6 +1022,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Mon Sep 18 2017 Pavel Valena - 2.4.2-84 +- Update to Ruby 2.4.2. + * Fri Sep 08 2017 Vít Ondruch - 2.4.1-84 - Drop ruby-devel dependency on rubypick, which is pulled in transtitively. diff --git a/sources b/sources index 49ed326..0ae2520 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ruby-2.4.1.tar.xz) = e6fd290b6edd166348b70f0f1c56f7ed9d956c4c1eb91d97d0548041ca4196b9b75ec1ad35c745bdbfd4de195899093e7205d7f02b014ecf1c48e6f31cf25903 +SHA512 (ruby-2.4.2.tar.xz) = c1d42272fb0d94b693452e703b0ea4942bf59cbd4b08ba83bf039f54be97ebc88511632413da0164970b4cf97bc302bccb88aab48edfa8fa147498e7ee741595 From 1915fe748eaf15caab7c4f65e7111805db5ba54b Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Tue, 19 Sep 2017 18:26:41 +0200 Subject: [PATCH 05/20] Apply patches cleanly. --- ...o-specify-additional-preludes-by-configuratio.patch | 2 +- ruby-2.1.0-Enable-configuration-of-archlibdir.patch | 2 +- ...-duplicated-paths-when-empty-version-string-i.patch | 2 +- ruby-2.1.0-always-use-i386.patch | 2 +- ruby-2.1.0-custom-rubygems-location.patch | 4 ++-- ruby-2.3.0-ruby_version.patch | 10 +++++----- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch index af8b9a9..3e29d1b 100644 --- a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch +++ b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch @@ -39,7 +39,7 @@ diff --git a/configure.in b/configure.in index 0e371e2..d4f1dcb 100644 --- a/configure.in +++ b/configure.in -@@ -4536,6 +4536,13 @@ AC_SUBST(rubyarchhdrdir)dnl +@@ -4563,6 +4563,13 @@ AC_SUBST(rubyarchhdrdir)dnl AC_SUBST(sitearchhdrdir)dnl AC_SUBST(vendorarchhdrdir)dnl diff --git a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch index a4e6c28..bc75f5e 100644 --- a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch +++ b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 37d9a62..553d4d0 100644 --- a/configure.in +++ b/configure.in -@@ -3790,6 +3790,11 @@ if test ${multiarch+set}; then +@@ -3823,6 +3823,11 @@ if test ${multiarch+set}; then fi archlibdir='${libdir}/${arch}' diff --git a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch index e841569..489a1b8 100644 --- a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch +++ b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch @@ -14,7 +14,7 @@ diff --git a/configure.in b/configure.in index db37cd6..ce8d149 100644 --- a/configure.in +++ b/configure.in -@@ -4390,7 +4390,8 @@ AS_CASE(["$ruby_version_dir_name"], +@@ -4417,7 +4417,8 @@ AS_CASE(["$ruby_version_dir_name"], ruby_version_dir=/'${ruby_version_dir_name}' if test -z "${ruby_version_dir_name}"; then diff --git a/ruby-2.1.0-always-use-i386.patch b/ruby-2.1.0-always-use-i386.patch index ba358f3..238cd66 100644 --- a/ruby-2.1.0-always-use-i386.patch +++ b/ruby-2.1.0-always-use-i386.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 553d4d0..03a4152 100644 --- a/configure.in +++ b/configure.in -@@ -4454,6 +4454,8 @@ AC_SUBST(vendorarchdir)dnl +@@ -4481,6 +4481,8 @@ AC_SUBST(vendorarchdir)dnl AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl diff --git a/ruby-2.1.0-custom-rubygems-location.patch b/ruby-2.1.0-custom-rubygems-location.patch index 44fe4a7..1905381 100644 --- a/ruby-2.1.0-custom-rubygems-location.patch +++ b/ruby-2.1.0-custom-rubygems-location.patch @@ -15,7 +15,7 @@ diff --git a/configure.in b/configure.in index 03a4152..0e371e2 100644 --- a/configure.in +++ b/configure.in -@@ -4426,6 +4426,10 @@ AC_ARG_WITH(vendorarchdir, +@@ -4453,6 +4453,10 @@ AC_ARG_WITH(vendorarchdir, [vendorarchdir=$withval], [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}]) @@ -26,7 +26,7 @@ index 03a4152..0e371e2 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) RUBY_EXEC_PREFIX='' -@@ -4450,6 +4454,7 @@ AC_SUBST(sitearchdir)dnl +@@ -4477,6 +4481,7 @@ AC_SUBST(sitearchdir)dnl AC_SUBST(vendordir)dnl AC_SUBST(vendorlibdir)dnl AC_SUBST(vendorarchdir)dnl diff --git a/ruby-2.3.0-ruby_version.patch b/ruby-2.3.0-ruby_version.patch index b4d6f76..80be728 100644 --- a/ruby-2.3.0-ruby_version.patch +++ b/ruby-2.3.0-ruby_version.patch @@ -20,7 +20,7 @@ diff --git a/configure.in b/configure.in index db37cd6..6e73fae 100644 --- a/configure.in +++ b/configure.in -@@ -4341,9 +4341,6 @@ AS_CASE(["$target_os"], +@@ -4368,9 +4368,6 @@ AS_CASE(["$target_os"], rubyw_install_name='$(RUBYW_INSTALL_NAME)' ]) @@ -30,7 +30,7 @@ index db37cd6..6e73fae 100644 rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'} AC_ARG_WITH(rubyarchprefix, AS_HELP_STRING([--with-rubyarchprefix=DIR], -@@ -4366,56 +4363,62 @@ AC_ARG_WITH(ridir, +@@ -4393,56 +4390,62 @@ AC_ARG_WITH(ridir, AC_SUBST(ridir) AC_SUBST(RI_BASE_NAME) @@ -120,7 +120,7 @@ index db37cd6..6e73fae 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) -@@ -4432,6 +4435,7 @@ AC_SUBST(sitearchincludedir)dnl +@@ -4459,6 +4462,7 @@ AC_SUBST(sitearchincludedir)dnl AC_SUBST(arch)dnl AC_SUBST(sitearch)dnl AC_SUBST(ruby_version)dnl @@ -245,7 +245,7 @@ diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb index 0428bea..b6e090e 100644 --- a/test/rubygems/test_gem.rb +++ b/test/rubygems/test_gem.rb -@@ -1101,7 +1101,8 @@ def test_self_use_paths +@@ -1124,7 +1124,8 @@ def test_self_use_paths def test_self_user_dir parts = [@userhome, '.gem', Gem.ruby_engine] @@ -255,7 +255,7 @@ index 0428bea..b6e090e 100644 assert_equal File.join(parts), Gem.user_dir end -@@ -1228,7 +1229,7 @@ def test_self_user_home_user_drive_and_path +@@ -1251,7 +1252,7 @@ def test_self_user_home_user_drive_and_path def test_self_vendor_dir expected = File.join RbConfig::CONFIG['vendordir'], 'gems', From f32f8b055d90ea006d3d8fd43d96adb20742378a Mon Sep 17 00:00:00 2001 From: Jun Aruga Date: Thu, 19 Oct 2017 09:54:36 +0200 Subject: [PATCH 06/20] Add macros to remove systemtap, git and cmake dependencies. --- ruby.spec | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/ruby.spec b/ruby.spec index e2a202d..f2fa5ea 100644 --- a/ruby.spec +++ b/ruby.spec @@ -21,7 +21,7 @@ %endif -%global release 84 +%global release 85 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -62,6 +62,10 @@ %global with_rubypick 1 %endif +%bcond_without systemtap +%bcond_without git +%bcond_without cmake + Summary: An interpreter of object-oriented scripting language Name: ruby Version: %{ruby_version} @@ -144,10 +148,16 @@ BuildRequires: libyaml-devel BuildRequires: readline-devel # Needed to pass test_set_program_name(TestRubyOptions) BuildRequires: procps +%if %{with systemtap} BuildRequires: %{_bindir}/dtrace +%endif # RubyGems test suite optional dependencies. +%if %{with git} BuildRequires: git +%endif +%if %{with cmake} BuildRequires: %{_bindir}/cmake +%endif # Required to test hardening. BuildRequires: %{_bindir}/checksec BuildRequires: multilib-rpm-config @@ -705,8 +715,10 @@ touch abrt.rb # runruby, so re-enable them). make runruby TESTRUN_SCRIPT="--enable-gems %{SOURCE12}" +%if %{with systemtap} # Check if systemtap is supported. make runruby TESTRUN_SCRIPT=%{SOURCE13} +%endif DISABLE_TESTS="" @@ -1022,6 +1034,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Thu Oct 19 2017 Jun Aruga - 2.4.2-85 +- Add macros to remove systemtap, git and cmake dependencies. + * Mon Sep 18 2017 Pavel Valena - 2.4.2-84 - Update to Ruby 2.4.2. From acf8e2e3eaffcc7275d6ee6eda53aef8a71c55c6 Mon Sep 17 00:00:00 2001 From: Jun Aruga Date: Fri, 27 Oct 2017 12:56:54 +0200 Subject: [PATCH 07/20] Improve "with" conditional statement as inline. --- ruby.spec | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/ruby.spec b/ruby.spec index f2fa5ea..dc36b65 100644 --- a/ruby.spec +++ b/ruby.spec @@ -148,16 +148,10 @@ BuildRequires: libyaml-devel BuildRequires: readline-devel # Needed to pass test_set_program_name(TestRubyOptions) BuildRequires: procps -%if %{with systemtap} -BuildRequires: %{_bindir}/dtrace -%endif +%{?with_systemtap:BuildRequires: %{_bindir}/dtrace} # RubyGems test suite optional dependencies. -%if %{with git} -BuildRequires: git -%endif -%if %{with cmake} -BuildRequires: %{_bindir}/cmake -%endif +%{?with_git:BuildRequires: git} +%{?with_cmake:BuildRequires: %{_bindir}/cmake} # Required to test hardening. BuildRequires: %{_bindir}/checksec BuildRequires: multilib-rpm-config @@ -715,10 +709,8 @@ touch abrt.rb # runruby, so re-enable them). make runruby TESTRUN_SCRIPT="--enable-gems %{SOURCE12}" -%if %{with systemtap} # Check if systemtap is supported. -make runruby TESTRUN_SCRIPT=%{SOURCE13} -%endif +%{?with_systemtap:make runruby TESTRUN_SCRIPT=%{SOURCE13}} DISABLE_TESTS="" @@ -1034,6 +1026,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Fri Oct 27 2017 Jun Aruga - 2.4.2-86 +- Improve "with" conditional statement as inline. + * Thu Oct 19 2017 Jun Aruga - 2.4.2-85 - Add macros to remove systemtap, git and cmake dependencies. From 77c18cda969afaaae9265d0e1e03cd345691270a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Mon, 30 Oct 2017 16:40:19 +0100 Subject: [PATCH 08/20] Drop 'config.h' source. This source is not needed since c467007d. --- config.h | 61 ------------------------------------------------------- ruby.spec | 5 ----- 2 files changed, 66 deletions(-) delete mode 100644 config.h diff --git a/config.h b/config.h deleted file mode 100644 index b44f715..0000000 --- a/config.h +++ /dev/null @@ -1,61 +0,0 @@ -/* - * This config.h is a wrapper include file for the original ruby/config.h, - * which has been renamed to ruby/config-.h. There are conflicts for the - * original ruby/config.h on multilib systems, which result from arch-specific - * configuration options. Please do not use the arch-specific file directly. - */ - -/* - * This wrapped is addpated from SDL's one: - * http://pkgs.fedoraproject.org/cgit/SDL.git/tree/SDL_config.h - */ - -#ifdef ruby_config_wrapper_h -#error "ruby_config_wrapper_h should not be defined!" -#endif -#define ruby_config_wrapper_h - -#if defined(__i386__) -#include "ruby/config-i386.h" -#elif defined(__ia64__) -#include "ruby/config-ia64.h" -#elif defined(__powerpc64__) -#include -#if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__ -#include "ruby/config-ppc64.h" -#else -#include "ruby/config-ppc64le.h" -#endif -#elif defined(__powerpc__) -#include "ruby/config-ppc.h" -#elif defined(__s390x__) -#include "ruby/config-s390x.h" -#elif defined(__s390__) -#include "ruby/config-s390.h" -#elif defined(__x86_64__) -#include "ruby/config-x86_64.h" -#elif defined(__arm__) -#include "ruby/config-arm.h" -#elif defined(__alpha__) -#include "ruby/config-alpha.h" -#elif defined(__sparc__) && defined (__arch64__) -#include "ruby/config-sparc64.h" -#elif defined(__sparc__) -#include "ruby/config-sparc.h" -#elif defined(__aarch64__) -#include "ruby/config-aarch64.h" -#elif defined(__mips64) && defined(__MIPSEL__) -#include "ruby/config-mips64el.h" -#elif defined(__mips64) -#include "ruby/config-mips64.h" -#elif defined(__mips) && defined(__MIPSEL__) -#include "ruby/config-mipsel.h" -#elif defined(__mips) -#include "ruby/config-mips.h" -#elif defined(__riscv64) -#include "ruby/config-riscv64.h" -#else -#error "The ruby-devel package is not usable with the architecture." -#endif - -#undef ruby_config_wrapper_h diff --git a/ruby.spec b/ruby.spec index dc36b65..7a1b494 100644 --- a/ruby.spec +++ b/ruby.spec @@ -85,11 +85,6 @@ Source3: ruby-exercise.stp Source4: macros.ruby Source5: macros.rubygems Source6: abrt_prelude.rb -# This wrapper fixes https://bugzilla.redhat.com/show_bug.cgi?id=977941 -# Hopefully, it will get removed soon: -# https://fedorahosted.org/fpc/ticket/312 -# https://bugzilla.redhat.com/show_bug.cgi?id=977941 -Source7: config.h # RPM dependency generators. Source8: rubygems.attr Source9: rubygems.req From b0fc019125350ee55c96da5809cc3d5bf523e2e7 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Thu, 21 Dec 2017 15:25:10 +0100 Subject: [PATCH 09/20] Update to Ruby 2.4.3. --- ruby.spec | 9 ++++++--- sources | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ruby.spec b/ruby.spec index 7a1b494..a944bb5 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ %global major_version 2 %global minor_version 4 -%global teeny_version 2 +%global teeny_version 3 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -21,7 +21,7 @@ %endif -%global release 85 +%global release 86 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -29,7 +29,7 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 2.6.13 +%global rubygems_version 2.6.14 %global molinillo_version 0.5.7 # TODO: The IRB has strange versioning. Keep the Ruby's versioning ATM. @@ -1021,6 +1021,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Thu Dec 21 2017 Pavel Valena - 2.4.3-86 +- Update to Ruby 2.4.3. + * Fri Oct 27 2017 Jun Aruga - 2.4.2-86 - Improve "with" conditional statement as inline. diff --git a/sources b/sources index 0ae2520..0c74d1b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ruby-2.4.2.tar.xz) = c1d42272fb0d94b693452e703b0ea4942bf59cbd4b08ba83bf039f54be97ebc88511632413da0164970b4cf97bc302bccb88aab48edfa8fa147498e7ee741595 +SHA512 (ruby-2.4.3.tar.xz) = 8bcf60c994a96787da5d743c66f5609a5a6d834d6d61243cdea7fd059197c3b10da43c99e5649be85e2f2329eedcbb1dd76e89ce3ac586be9056348f7449ed09 From d69aee08ce60d5ffa4bdcd2849bab388927bf0a0 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Thu, 21 Dec 2017 17:19:13 +0100 Subject: [PATCH 10/20] Fix Command injection in lib/resolv.rb:lazy_initialize() https://bugzilla.redhat.com/show_bug.cgi?id=1528226 --- ...ection-in-lib-resolv-lazy_initialize.patch | 29 +++++++++++++++++++ ruby.spec | 5 ++++ 2 files changed, 34 insertions(+) create mode 100644 ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch diff --git a/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch b/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch new file mode 100644 index 0000000..451b3cd --- /dev/null +++ b/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch @@ -0,0 +1,29 @@ +From e7464561b5151501beb356fc750d5dd1a88014f7 Mon Sep 17 00:00:00 2001 +From: nobu +Date: Wed, 20 Dec 2017 04:18:31 +0000 +Subject: [PATCH] Fixed command Injection + +* resolv.rb (Resolv::Hosts#lazy_initialize): fixed potential + command Injection in Hosts::new() by use of Kernel#open. + [Fix GH-1777] [ruby-core:84347] [Bug #14205] + +From: Drigg3r + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61349 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + lib/resolv.rb | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/resolv.rb b/lib/resolv.rb +index 1044b95e6810..56183b837d81 100644 +--- a/lib/resolv.rb ++++ b/lib/resolv.rb +@@ -188,7 +188,7 @@ def lazy_initialize # :nodoc: + unless @initialized + @name2addr = {} + @addr2name = {} +- open(@filename, 'rb') {|f| ++ File.open(@filename, 'rb') {|f| + f.each {|line| + line.sub!(/#.*/, '') + addr, hostname, *aliases = line.split(/\s+/) diff --git a/ruby.spec b/ruby.spec index a944bb5..7cc8774 100644 --- a/ruby.spec +++ b/ruby.spec @@ -127,6 +127,10 @@ Patch7: ruby-2.2.3-Generate-preludes-using-miniruby.patch # hardening features of glibc (rhbz#1361037). # https://bugs.ruby-lang.org/issues/12666 Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch +# Fix: Command injection in lib/resolv.rb:lazy_initialize() +# https://bugzilla.redhat.com/show_bug.cgi?id=1528226 +# https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7 +Patch10: ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} Suggests: rubypick @@ -1023,6 +1027,7 @@ make check TESTS="-v $DISABLE_TESTS" %changelog * Thu Dec 21 2017 Pavel Valena - 2.4.3-86 - Update to Ruby 2.4.3. +- Fix: Command injection in lib/resolv.rb:lazy_initialize() (rhbz#1528226) * Fri Oct 27 2017 Jun Aruga - 2.4.2-86 - Improve "with" conditional statement as inline. From 5b348c3b4b5ca7c9e5be3f613926d21b2493a8ff Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Wed, 21 Feb 2018 18:34:48 +0100 Subject: [PATCH 11/20] Fix commit 66fa4364ea88fb0cb9ebafbbe2a1df25862259b0 --- ruby.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ruby.spec b/ruby.spec index 7cc8774..04f7fba 100644 --- a/ruby.spec +++ b/ruby.spec @@ -511,6 +511,7 @@ rm -rf ext/fiddle/libffi* %patch6 -p1 %patch7 -p1 %patch9 -p1 +%patch10 -p1 # Provide an example of usage of the tapset: cp -a %{SOURCE3} . From 7f73127ecf1c08ba411af254e9afc590fab56460 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Wed, 21 Feb 2018 18:32:04 +0100 Subject: [PATCH 12/20] Fix: Multiple vulnerabilities in RubyGems https://bugzilla.redhat.com/show_bug.cgi?id=1547431 https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/ * rubygems-2.4.3-multiple-vulnerabilities.patch --- ruby.spec | 14 +- rubygems-2.4.3-multiple-vulnerabilities.patch | 605 ++++++++++++++++++ 2 files changed, 617 insertions(+), 2 deletions(-) create mode 100644 rubygems-2.4.3-multiple-vulnerabilities.patch diff --git a/ruby.spec b/ruby.spec index 04f7fba..447135e 100644 --- a/ruby.spec +++ b/ruby.spec @@ -21,7 +21,7 @@ %endif -%global release 86 +%global release 87 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -29,7 +29,7 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 2.6.14 +%global rubygems_version 2.6.14.1 %global molinillo_version 0.5.7 # TODO: The IRB has strange versioning. Keep the Ruby's versioning ATM. @@ -131,6 +131,10 @@ Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1528226 # https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7 Patch10: ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch +# Fix: Multiple vulnerabilities in RubyGems +# https://bugzilla.redhat.com/show_bug.cgi?id=1547431 +# https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/ +Patch11: rubygems-2.4.3-multiple-vulnerabilities.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} Suggests: rubypick @@ -512,6 +516,7 @@ rm -rf ext/fiddle/libffi* %patch7 -p1 %patch9 -p1 %patch10 -p1 +%patch11 -p0 # Provide an example of usage of the tapset: cp -a %{SOURCE3} . @@ -1026,6 +1031,11 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Wed Feb 21 2018 Pavel Valena - 2.4.3-87 +- Fix: Multiple vulnerabilities in RubyGems + https://bugzilla.redhat.com/show_bug.cgi?id=1547431 + https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/ + * Thu Dec 21 2017 Pavel Valena - 2.4.3-86 - Update to Ruby 2.4.3. - Fix: Command injection in lib/resolv.rb:lazy_initialize() (rhbz#1528226) diff --git a/rubygems-2.4.3-multiple-vulnerabilities.patch b/rubygems-2.4.3-multiple-vulnerabilities.patch new file mode 100644 index 0000000..c9464fa --- /dev/null +++ b/rubygems-2.4.3-multiple-vulnerabilities.patch @@ -0,0 +1,605 @@ +diff --git lib/rubygems.rb lib/rubygems.rb +index 0685bcb3c6..a5a9202e56 100644 +--- lib/rubygems.rb ++++ lib/rubygems.rb +@@ -10,7 +10,7 @@ + require 'thread' + + module Gem +- VERSION = "2.6.14" ++ VERSION = "2.6.14.1" + end + + # Must be first since it unloads the prelude from 1.9.2 +diff --git lib/rubygems/commands/owner_command.rb lib/rubygems/commands/owner_command.rb +index 4b99434e87..2ee7f84462 100644 +--- lib/rubygems/commands/owner_command.rb ++++ lib/rubygems/commands/owner_command.rb +@@ -62,7 +62,7 @@ def show_owners name + end + + with_response response do |resp| +- owners = YAML.load resp.body ++ owners = Gem::SafeYAML.load resp.body + + say "Owners for gem: #{name}" + owners.each do |owner| +diff --git lib/rubygems/package.rb lib/rubygems/package.rb +index 77811ed5ec..b5a5fe2a26 100644 +--- lib/rubygems/package.rb ++++ lib/rubygems/package.rb +@@ -378,7 +378,7 @@ def extract_tar_gz io, destination_dir, pattern = "*" # :nodoc: + File.dirname destination + end + +- FileUtils.mkdir_p mkdir, mkdir_options ++ mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name + + open destination, 'wb' do |out| + out.write entry.read +@@ -416,20 +416,35 @@ def install_location filename, destination_dir # :nodoc: + raise Gem::Package::PathError.new(filename, destination_dir) if + filename.start_with? '/' + +- destination_dir = File.realpath destination_dir if +- File.respond_to? :realpath ++ destination_dir = realpath destination_dir + destination_dir = File.expand_path destination_dir + + destination = File.join destination_dir, filename + destination = File.expand_path destination + + raise Gem::Package::PathError.new(destination, destination_dir) unless +- destination.start_with? destination_dir ++ destination.start_with? destination_dir + '/' + + destination.untaint + destination + end + ++ def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name ++ destination_dir = realpath File.expand_path(destination_dir) ++ parts = mkdir.split(File::SEPARATOR) ++ parts.reduce do |path, basename| ++ path = realpath path unless path == "" ++ path = File.expand_path(path + File::SEPARATOR + basename) ++ lstat = File.lstat path rescue nil ++ if !lstat || !lstat.directory? ++ unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false) ++ raise Gem::Package::PathError.new(file_name, destination_dir) ++ end ++ end ++ path ++ end ++ end ++ + ## + # Loads a Gem::Specification from the TarEntry +entry+ + +@@ -603,6 +618,10 @@ def verify_files gem + raise Gem::Package::FormatError.new \ + 'package content (data.tar.gz) is missing', @gem + end ++ ++ if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any? ++ raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})" ++ end + end + + ## +@@ -616,6 +635,16 @@ def verify_gz entry # :nodoc: + raise Gem::Package::FormatError.new(e.message, entry.full_name) + end + ++ if File.respond_to? :realpath ++ def realpath file ++ File.realpath file ++ end ++ else ++ def realpath file ++ file ++ end ++ end ++ + end + + require 'rubygems/package/digest_io' +diff --git lib/rubygems/package/tar_header.rb lib/rubygems/package/tar_header.rb +index c54bd14d57..d557357114 100644 +--- lib/rubygems/package/tar_header.rb ++++ lib/rubygems/package/tar_header.rb +@@ -104,25 +104,30 @@ def self.from(stream) + fields = header.unpack UNPACK_FORMAT + + new :name => fields.shift, +- :mode => fields.shift.oct, +- :uid => fields.shift.oct, +- :gid => fields.shift.oct, +- :size => fields.shift.oct, +- :mtime => fields.shift.oct, +- :checksum => fields.shift.oct, ++ :mode => strict_oct(fields.shift), ++ :uid => strict_oct(fields.shift), ++ :gid => strict_oct(fields.shift), ++ :size => strict_oct(fields.shift), ++ :mtime => strict_oct(fields.shift), ++ :checksum => strict_oct(fields.shift), + :typeflag => fields.shift, + :linkname => fields.shift, + :magic => fields.shift, +- :version => fields.shift.oct, ++ :version => strict_oct(fields.shift), + :uname => fields.shift, + :gname => fields.shift, +- :devmajor => fields.shift.oct, +- :devminor => fields.shift.oct, ++ :devmajor => strict_oct(fields.shift), ++ :devminor => strict_oct(fields.shift), + :prefix => fields.shift, + + :empty => empty + end + ++ def self.strict_oct(str) ++ return str.oct if str =~ /\A[0-7]*\z/ ++ raise ArgumentError, "#{str.inspect} is not an octal string" ++ end ++ + ## + # Creates a new TarHeader using +vals+ + +diff --git lib/rubygems/package/tar_writer.rb lib/rubygems/package/tar_writer.rb +index f68b8d4c5e..390f7851a3 100644 +--- lib/rubygems/package/tar_writer.rb ++++ lib/rubygems/package/tar_writer.rb +@@ -196,6 +196,8 @@ def add_file_signed name, mode, signer + digest_name == signer.digest_name + end + ++ raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest ++ + if signer.key then + signature = signer.sign signature_digest.digest + +diff --git lib/rubygems/server.rb lib/rubygems/server.rb +index df4eb566d3..a7b5243ba0 100644 +--- lib/rubygems/server.rb ++++ lib/rubygems/server.rb +@@ -631,6 +631,18 @@ def root(req, res) + executables = nil if executables.empty? + executables.last["is_last"] = true if executables + ++ # Pre-process spec homepage for safety reasons ++ begin ++ homepage_uri = URI.parse(spec.homepage) ++ if [URI::HTTP, URI::HTTPS].member? homepage_uri.class ++ homepage_uri = spec.homepage ++ else ++ homepage_uri = "." ++ end ++ rescue URI::InvalidURIError ++ homepage_uri = "." ++ end ++ + specs << { + "authors" => spec.authors.sort.join(", "), + "date" => spec.date.to_s, +@@ -640,7 +652,7 @@ def root(req, res) + "only_one_executable" => (executables && executables.size == 1), + "full_name" => spec.full_name, + "has_deps" => !deps.empty?, +- "homepage" => spec.homepage, ++ "homepage" => homepage_uri, + "name" => spec.name, + "rdoc_installed" => Gem::RDoc.new(spec).rdoc_installed?, + "ri_installed" => Gem::RDoc.new(spec).ri_installed?, +diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb +index 40e3a70d47..0a154b9001 100644 +--- lib/rubygems/specification.rb ++++ lib/rubygems/specification.rb +@@ -15,6 +15,7 @@ + require 'rubygems/stub_specification' + require 'rubygems/util/list' + require 'stringio' ++require 'uri' + + ## + # The Specification class contains the information for a Gem. Typically +@@ -2813,10 +2814,16 @@ def validate packaging = true + raise Gem::InvalidSpecificationException, "#{lazy} is not a summary" + end + +- if homepage and not homepage.empty? and +- homepage !~ /\A[a-z][a-z\d+.-]*:/i then +- raise Gem::InvalidSpecificationException, +- "\"#{homepage}\" is not a URI" ++ # Make sure a homepage is valid HTTP/HTTPS URI ++ if homepage and not homepage.empty? ++ begin ++ homepage_uri = URI.parse(homepage) ++ unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class ++ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" ++ end ++ rescue URI::InvalidURIError ++ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" ++ end + end + + # Warnings +diff --git test/rubygems/test_gem_commands_owner_command.rb test/rubygems/test_gem_commands_owner_command.rb +index 44652c1093..53cac4ce87 100644 +--- test/rubygems/test_gem_commands_owner_command.rb ++++ test/rubygems/test_gem_commands_owner_command.rb +@@ -43,6 +43,31 @@ def test_show_owners + assert_match %r{- 4}, @ui.output + end + ++ def test_show_owners_dont_load_objects ++ skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass) ++ ++ response = <xsshomepagegem 1 ++ # ++ # ++ # [rdoc] ++ # ++ # ++ # ++ # [www] ++ # ++ # Variant #2 - rdoc installed ++ # ++ # xsshomepagegem 1 ++ # ++ # ++ # \[rdoc\]<\/a> ++ # ++ # ++ # ++ # [www] ++ regex_match = /xsshomepagegem 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ ++ assert_match regex_match, @res.body ++ end ++ ++ def test_invalid_homepage ++ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" ++ dir = "#{@gemhome}2" ++ ++ spec = util_spec 'invalidhomepagegem', 1 ++ spec.homepage = "notavalidhomepageurl" ++ ++ specs_dir = File.join dir, 'specifications' ++ FileUtils.mkdir_p specs_dir ++ ++ open File.join(specs_dir, spec.spec_name), 'w' do |io| ++ io.write spec.to_ruby ++ end ++ ++ server = Gem::Server.new dir, process_based_port, false ++ ++ @req.parse data ++ ++ server.root @req, @res ++ ++ assert_equal 200, @res.status ++ assert_match 'invalidhomepagegem 1', @res.body ++ ++ # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a ++ # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here, ++ # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be ++ # validated in future versions of Gem::Specification. ++ # ++ # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex: ++ # ++ # Variant #1 - rdoc not installed ++ # ++ # invalidhomepagegem 1 ++ # ++ # ++ # [rdoc] ++ # ++ # ++ # ++ # [www] ++ # ++ # Variant #2 - rdoc installed ++ # ++ # invalidhomepagegem 1 ++ # ++ # ++ # \[rdoc\]<\/a> ++ # ++ # ++ # ++ # [www] ++ regex_match = /invalidhomepagegem 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ ++ assert_match regex_match, @res.body ++ end ++ ++ def test_valid_homepage_http ++ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" ++ dir = "#{@gemhome}2" ++ ++ spec = util_spec 'validhomepagegemhttp', 1 ++ spec.homepage = "http://rubygems.org" ++ ++ specs_dir = File.join dir, 'specifications' ++ FileUtils.mkdir_p specs_dir ++ ++ open File.join(specs_dir, spec.spec_name), 'w' do |io| ++ io.write spec.to_ruby ++ end ++ ++ server = Gem::Server.new dir, process_based_port, false ++ ++ @req.parse data ++ ++ server.root @req, @res ++ ++ assert_equal 200, @res.status ++ assert_match 'validhomepagegemhttp 1', @res.body ++ ++ regex_match = /validhomepagegemhttp 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ ++ assert_match regex_match, @res.body ++ end ++ ++ def test_valid_homepage_https ++ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" ++ dir = "#{@gemhome}2" ++ ++ spec = util_spec 'validhomepagegemhttps', 1 ++ spec.homepage = "https://rubygems.org" ++ ++ specs_dir = File.join dir, 'specifications' ++ FileUtils.mkdir_p specs_dir ++ ++ open File.join(specs_dir, spec.spec_name), 'w' do |io| ++ io.write spec.to_ruby ++ end ++ ++ server = Gem::Server.new dir, process_based_port, false ++ ++ @req.parse data ++ ++ server.root @req, @res ++ ++ assert_equal 200, @res.status ++ assert_match 'validhomepagegemhttps 1', @res.body ++ ++ regex_match = /validhomepagegemhttps 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ ++ assert_match regex_match, @res.body ++ end ++ + def test_specs + data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n" + @req.parse data +diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb +index 0fcc11e78f..1c68826fb3 100644 +--- test/rubygems/test_gem_specification.rb ++++ test/rubygems/test_gem_specification.rb +@@ -2890,7 +2890,22 @@ def test_validate_homepage + @a1.validate + end + +- assert_equal '"over at my cool site" is not a URI', e.message ++ assert_equal '"over at my cool site" is not a valid HTTP URI', e.message ++ ++ @a1.homepage = 'ftp://rubygems.org' ++ ++ e = assert_raises Gem::InvalidSpecificationException do ++ @a1.validate ++ end ++ ++ assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message ++ ++ @a1.homepage = 'http://rubygems.org' ++ assert_equal true, @a1.validate ++ ++ @a1.homepage = 'https://rubygems.org' ++ assert_equal true, @a1.validate ++ + end + end + From c8a3347e088e9f0d3630ca5261094d2c6c24577b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Tue, 13 Feb 2018 14:43:58 +0100 Subject: [PATCH 13/20] Disable Tokyo TZ tests. They are broken by recen tzdata update. --- ruby-2.5.0-Disable-Tokyo-TZ-tests.patch | 30 +++++++++++++++++++++++++ ruby.spec | 4 ++++ 2 files changed, 34 insertions(+) create mode 100644 ruby-2.5.0-Disable-Tokyo-TZ-tests.patch diff --git a/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch b/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch new file mode 100644 index 0000000..01632eb --- /dev/null +++ b/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch @@ -0,0 +1,30 @@ +diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb +index 20a57fe7dd..5b9e5a8bde 100644 +--- a/test/ruby/test_time_tz.rb ++++ b/test/ruby/test_time_tz.rb +@@ -126,8 +126,8 @@ def test_asia_singapore + + def test_asia_tokyo + with_tz(tz="Asia/Tokyo") { +- assert_time_constructor(tz, "1951-05-06 03:00:00 +1000", :local, [1951,5,6,2,0,0]) +- assert_time_constructor(tz, "1951-05-06 03:59:59 +1000", :local, [1951,5,6,2,59,59]) ++# assert_time_constructor(tz, "1951-05-06 03:00:00 +1000", :local, [1951,5,6,2,0,0]) ++# assert_time_constructor(tz, "1951-05-06 03:59:59 +1000", :local, [1951,5,6,2,59,59]) + assert_time_constructor(tz, "2010-06-10 06:13:28 +0900", :local, [2010,6,10,6,13,28]) + } + end +@@ -329,10 +329,10 @@ def self.gen_zdump_test(data) + Asia/Singapore Sun Aug 8 16:30:00 1965 UTC = Mon Aug 9 00:00:00 1965 SGT isdst=0 gmtoff=27000 + Asia/Singapore Thu Dec 31 16:29:59 1981 UTC = Thu Dec 31 23:59:59 1981 SGT isdst=0 gmtoff=27000 + Asia/Singapore Thu Dec 31 16:30:00 1981 UTC = Fri Jan 1 00:30:00 1982 SGT isdst=0 gmtoff=28800 +-Asia/Tokyo Sat May 5 16:59:59 1951 UTC = Sun May 6 01:59:59 1951 JST isdst=0 gmtoff=32400 +-Asia/Tokyo Sat May 5 17:00:00 1951 UTC = Sun May 6 03:00:00 1951 JDT isdst=1 gmtoff=36000 +-Asia/Tokyo Fri Sep 7 15:59:59 1951 UTC = Sat Sep 8 01:59:59 1951 JDT isdst=1 gmtoff=36000 +-Asia/Tokyo Fri Sep 7 16:00:00 1951 UTC = Sat Sep 8 01:00:00 1951 JST isdst=0 gmtoff=32400 ++#Asia/Tokyo Sat May 5 16:59:59 1951 UTC = Sun May 6 01:59:59 1951 JST isdst=0 gmtoff=32400 ++#Asia/Tokyo Sat May 5 17:00:00 1951 UTC = Sun May 6 03:00:00 1951 JDT isdst=1 gmtoff=36000 ++#Asia/Tokyo Fri Sep 7 15:59:59 1951 UTC = Sat Sep 8 01:59:59 1951 JDT isdst=1 gmtoff=36000 ++#Asia/Tokyo Fri Sep 7 16:00:00 1951 UTC = Sat Sep 8 01:00:00 1951 JST isdst=0 gmtoff=32400 + America/St_Johns Sun Mar 11 03:30:59 2007 UTC = Sun Mar 11 00:00:59 2007 NST isdst=0 gmtoff=-12600 + America/St_Johns Sun Mar 11 03:31:00 2007 UTC = Sun Mar 11 01:01:00 2007 NDT isdst=1 gmtoff=-9000 + America/St_Johns Sun Nov 4 02:30:59 2007 UTC = Sun Nov 4 00:00:59 2007 NDT isdst=1 gmtoff=-9000 diff --git a/ruby.spec b/ruby.spec index 447135e..2ece109 100644 --- a/ruby.spec +++ b/ruby.spec @@ -135,6 +135,9 @@ Patch10: ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1547431 # https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/ Patch11: rubygems-2.4.3-multiple-vulnerabilities.patch +# Recent tzdata change breaks Ruby test suite. +# https://bugs.ruby-lang.org/issues/14438 +Patch12: ruby-2.5.0-Disable-Tokyo-TZ-tests.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} Suggests: rubypick @@ -517,6 +520,7 @@ rm -rf ext/fiddle/libffi* %patch9 -p1 %patch10 -p1 %patch11 -p0 +%patch12 -p1 # Provide an example of usage of the tapset: cp -a %{SOURCE3} . From 7cfc7ee74f4a387832ace33b86b2bd1f9692f977 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Fri, 23 Feb 2018 17:26:11 +0100 Subject: [PATCH 14/20] Apply patches cleanly. --- ...low-to-specify-additional-preludes-by-configuratio.patch | 2 +- ruby-2.1.0-Enable-configuration-of-archlibdir.patch | 2 +- ...event-duplicated-paths-when-empty-version-string-i.patch | 2 +- ruby-2.1.0-always-use-i386.patch | 2 +- ruby-2.1.0-custom-rubygems-location.patch | 4 ++-- ruby-2.3.0-ruby_version.patch | 6 +++--- ...ix-Command-injection-in-lib-resolv-lazy_initialize.patch | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch index 3e29d1b..3379869 100644 --- a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch +++ b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch @@ -39,7 +39,7 @@ diff --git a/configure.in b/configure.in index 0e371e2..d4f1dcb 100644 --- a/configure.in +++ b/configure.in -@@ -4563,6 +4563,13 @@ AC_SUBST(rubyarchhdrdir)dnl +@@ -4565,6 +4565,13 @@ AC_SUBST(rubyarchhdrdir)dnl AC_SUBST(sitearchhdrdir)dnl AC_SUBST(vendorarchhdrdir)dnl diff --git a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch index bc75f5e..5639c18 100644 --- a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch +++ b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 37d9a62..553d4d0 100644 --- a/configure.in +++ b/configure.in -@@ -3823,6 +3823,11 @@ if test ${multiarch+set}; then +@@ -3825,6 +3825,11 @@ if test ${multiarch+set}; then fi archlibdir='${libdir}/${arch}' diff --git a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch index 489a1b8..a06d8a7 100644 --- a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch +++ b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch @@ -14,7 +14,7 @@ diff --git a/configure.in b/configure.in index db37cd6..ce8d149 100644 --- a/configure.in +++ b/configure.in -@@ -4417,7 +4417,8 @@ AS_CASE(["$ruby_version_dir_name"], +@@ -4419,7 +4419,8 @@ AS_CASE(["$ruby_version_dir_name"], ruby_version_dir=/'${ruby_version_dir_name}' if test -z "${ruby_version_dir_name}"; then diff --git a/ruby-2.1.0-always-use-i386.patch b/ruby-2.1.0-always-use-i386.patch index 238cd66..21265fd 100644 --- a/ruby-2.1.0-always-use-i386.patch +++ b/ruby-2.1.0-always-use-i386.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 553d4d0..03a4152 100644 --- a/configure.in +++ b/configure.in -@@ -4481,6 +4481,8 @@ AC_SUBST(vendorarchdir)dnl +@@ -4483,6 +4483,8 @@ AC_SUBST(vendorarchdir)dnl AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl diff --git a/ruby-2.1.0-custom-rubygems-location.patch b/ruby-2.1.0-custom-rubygems-location.patch index 1905381..3019ad5 100644 --- a/ruby-2.1.0-custom-rubygems-location.patch +++ b/ruby-2.1.0-custom-rubygems-location.patch @@ -15,7 +15,7 @@ diff --git a/configure.in b/configure.in index 03a4152..0e371e2 100644 --- a/configure.in +++ b/configure.in -@@ -4453,6 +4453,10 @@ AC_ARG_WITH(vendorarchdir, +@@ -4455,6 +4455,10 @@ AC_ARG_WITH(vendorarchdir, [vendorarchdir=$withval], [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}]) @@ -26,7 +26,7 @@ index 03a4152..0e371e2 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) RUBY_EXEC_PREFIX='' -@@ -4477,6 +4481,7 @@ AC_SUBST(sitearchdir)dnl +@@ -4479,6 +4483,7 @@ AC_SUBST(sitearchdir)dnl AC_SUBST(vendordir)dnl AC_SUBST(vendorlibdir)dnl AC_SUBST(vendorarchdir)dnl diff --git a/ruby-2.3.0-ruby_version.patch b/ruby-2.3.0-ruby_version.patch index 80be728..1db4c64 100644 --- a/ruby-2.3.0-ruby_version.patch +++ b/ruby-2.3.0-ruby_version.patch @@ -20,7 +20,7 @@ diff --git a/configure.in b/configure.in index db37cd6..6e73fae 100644 --- a/configure.in +++ b/configure.in -@@ -4368,9 +4368,6 @@ AS_CASE(["$target_os"], +@@ -4370,9 +4370,6 @@ AS_CASE(["$target_os"], rubyw_install_name='$(RUBYW_INSTALL_NAME)' ]) @@ -30,7 +30,7 @@ index db37cd6..6e73fae 100644 rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'} AC_ARG_WITH(rubyarchprefix, AS_HELP_STRING([--with-rubyarchprefix=DIR], -@@ -4393,56 +4390,62 @@ AC_ARG_WITH(ridir, +@@ -4395,56 +4392,62 @@ AC_ARG_WITH(ridir, AC_SUBST(ridir) AC_SUBST(RI_BASE_NAME) @@ -120,7 +120,7 @@ index db37cd6..6e73fae 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) -@@ -4459,6 +4462,7 @@ AC_SUBST(sitearchincludedir)dnl +@@ -4461,6 +4464,7 @@ AC_SUBST(sitearchincludedir)dnl AC_SUBST(arch)dnl AC_SUBST(sitearch)dnl AC_SUBST(ruby_version)dnl diff --git a/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch b/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch index 451b3cd..4099e09 100644 --- a/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch +++ b/ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch @@ -18,7 +18,7 @@ diff --git a/lib/resolv.rb b/lib/resolv.rb index 1044b95e6810..56183b837d81 100644 --- a/lib/resolv.rb +++ b/lib/resolv.rb -@@ -188,7 +188,7 @@ def lazy_initialize # :nodoc: +@@ -189,7 +189,7 @@ def lazy_initialize # :nodoc: unless @initialized @name2addr = {} @addr2name = {} From 6e392fbfacbdb6bc5664d0508ce01eefbbebc321 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Thu, 29 Mar 2018 15:25:06 +0200 Subject: [PATCH 15/20] Update to Ruby 2.4.4. --- ...-additional-preludes-by-configuratio.patch | 2 +- ...0-Enable-configuration-of-archlibdir.patch | 2 +- ...ed-paths-when-empty-version-string-i.patch | 2 +- ruby-2.1.0-always-use-i386.patch | 2 +- ruby-2.1.0-custom-rubygems-location.patch | 4 +- ruby-2.3.0-ruby_version.patch | 6 +- ruby-2.5.0-Disable-Tokyo-TZ-tests.patch | 30 - ...-test-failures-Kiritimati-and-Lisbon.patch | 115 ++++ ruby.spec | 22 +- rubygems-2.4.3-multiple-vulnerabilities.patch | 605 ------------------ 10 files changed, 134 insertions(+), 656 deletions(-) delete mode 100644 ruby-2.5.0-Disable-Tokyo-TZ-tests.patch create mode 100644 ruby-2.5.1-TestTimeTZ-test-failures-Kiritimati-and-Lisbon.patch delete mode 100644 rubygems-2.4.3-multiple-vulnerabilities.patch diff --git a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch index 3379869..119d101 100644 --- a/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch +++ b/ruby-2.1.0-Allow-to-specify-additional-preludes-by-configuratio.patch @@ -39,7 +39,7 @@ diff --git a/configure.in b/configure.in index 0e371e2..d4f1dcb 100644 --- a/configure.in +++ b/configure.in -@@ -4565,6 +4565,13 @@ AC_SUBST(rubyarchhdrdir)dnl +@@ -4571,6 +4571,13 @@ AC_SUBST(rubyarchhdrdir)dnl AC_SUBST(sitearchhdrdir)dnl AC_SUBST(vendorarchhdrdir)dnl diff --git a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch index 5639c18..65ca94c 100644 --- a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch +++ b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 37d9a62..553d4d0 100644 --- a/configure.in +++ b/configure.in -@@ -3825,6 +3825,11 @@ if test ${multiarch+set}; then +@@ -3831,6 +3831,11 @@ if test ${multiarch+set}; then fi archlibdir='${libdir}/${arch}' diff --git a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch index a06d8a7..7ee9c42 100644 --- a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch +++ b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch @@ -14,7 +14,7 @@ diff --git a/configure.in b/configure.in index db37cd6..ce8d149 100644 --- a/configure.in +++ b/configure.in -@@ -4419,7 +4419,8 @@ AS_CASE(["$ruby_version_dir_name"], +@@ -4425,7 +4425,8 @@ AS_CASE(["$ruby_version_dir_name"], ruby_version_dir=/'${ruby_version_dir_name}' if test -z "${ruby_version_dir_name}"; then diff --git a/ruby-2.1.0-always-use-i386.patch b/ruby-2.1.0-always-use-i386.patch index 21265fd..2549c50 100644 --- a/ruby-2.1.0-always-use-i386.patch +++ b/ruby-2.1.0-always-use-i386.patch @@ -11,7 +11,7 @@ diff --git a/configure.in b/configure.in index 553d4d0..03a4152 100644 --- a/configure.in +++ b/configure.in -@@ -4483,6 +4483,8 @@ AC_SUBST(vendorarchdir)dnl +@@ -4489,6 +4489,8 @@ AC_SUBST(vendorarchdir)dnl AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl diff --git a/ruby-2.1.0-custom-rubygems-location.patch b/ruby-2.1.0-custom-rubygems-location.patch index 3019ad5..171f7cf 100644 --- a/ruby-2.1.0-custom-rubygems-location.patch +++ b/ruby-2.1.0-custom-rubygems-location.patch @@ -15,7 +15,7 @@ diff --git a/configure.in b/configure.in index 03a4152..0e371e2 100644 --- a/configure.in +++ b/configure.in -@@ -4455,6 +4455,10 @@ AC_ARG_WITH(vendorarchdir, +@@ -4461,6 +4461,10 @@ AC_ARG_WITH(vendorarchdir, [vendorarchdir=$withval], [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}]) @@ -26,7 +26,7 @@ index 03a4152..0e371e2 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) RUBY_EXEC_PREFIX='' -@@ -4479,6 +4483,7 @@ AC_SUBST(sitearchdir)dnl +@@ -4485,6 +4489,7 @@ AC_SUBST(sitearchdir)dnl AC_SUBST(vendordir)dnl AC_SUBST(vendorlibdir)dnl AC_SUBST(vendorarchdir)dnl diff --git a/ruby-2.3.0-ruby_version.patch b/ruby-2.3.0-ruby_version.patch index 1db4c64..de929a8 100644 --- a/ruby-2.3.0-ruby_version.patch +++ b/ruby-2.3.0-ruby_version.patch @@ -20,7 +20,7 @@ diff --git a/configure.in b/configure.in index db37cd6..6e73fae 100644 --- a/configure.in +++ b/configure.in -@@ -4370,9 +4370,6 @@ AS_CASE(["$target_os"], +@@ -4376,9 +4376,6 @@ AS_CASE(["$target_os"], rubyw_install_name='$(RUBYW_INSTALL_NAME)' ]) @@ -30,7 +30,7 @@ index db37cd6..6e73fae 100644 rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'} AC_ARG_WITH(rubyarchprefix, AS_HELP_STRING([--with-rubyarchprefix=DIR], -@@ -4395,56 +4392,62 @@ AC_ARG_WITH(ridir, +@@ -4401,56 +4398,62 @@ AC_ARG_WITH(ridir, AC_SUBST(ridir) AC_SUBST(RI_BASE_NAME) @@ -120,7 +120,7 @@ index db37cd6..6e73fae 100644 if test "${LOAD_RELATIVE+set}"; then AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) -@@ -4461,6 +4464,7 @@ AC_SUBST(sitearchincludedir)dnl +@@ -4467,6 +4470,7 @@ AC_SUBST(sitearchincludedir)dnl AC_SUBST(arch)dnl AC_SUBST(sitearch)dnl AC_SUBST(ruby_version)dnl diff --git a/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch b/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch deleted file mode 100644 index 01632eb..0000000 --- a/ruby-2.5.0-Disable-Tokyo-TZ-tests.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb -index 20a57fe7dd..5b9e5a8bde 100644 ---- a/test/ruby/test_time_tz.rb -+++ b/test/ruby/test_time_tz.rb -@@ -126,8 +126,8 @@ def test_asia_singapore - - def test_asia_tokyo - with_tz(tz="Asia/Tokyo") { -- assert_time_constructor(tz, "1951-05-06 03:00:00 +1000", :local, [1951,5,6,2,0,0]) -- assert_time_constructor(tz, "1951-05-06 03:59:59 +1000", :local, [1951,5,6,2,59,59]) -+# assert_time_constructor(tz, "1951-05-06 03:00:00 +1000", :local, [1951,5,6,2,0,0]) -+# assert_time_constructor(tz, "1951-05-06 03:59:59 +1000", :local, [1951,5,6,2,59,59]) - assert_time_constructor(tz, "2010-06-10 06:13:28 +0900", :local, [2010,6,10,6,13,28]) - } - end -@@ -329,10 +329,10 @@ def self.gen_zdump_test(data) - Asia/Singapore Sun Aug 8 16:30:00 1965 UTC = Mon Aug 9 00:00:00 1965 SGT isdst=0 gmtoff=27000 - Asia/Singapore Thu Dec 31 16:29:59 1981 UTC = Thu Dec 31 23:59:59 1981 SGT isdst=0 gmtoff=27000 - Asia/Singapore Thu Dec 31 16:30:00 1981 UTC = Fri Jan 1 00:30:00 1982 SGT isdst=0 gmtoff=28800 --Asia/Tokyo Sat May 5 16:59:59 1951 UTC = Sun May 6 01:59:59 1951 JST isdst=0 gmtoff=32400 --Asia/Tokyo Sat May 5 17:00:00 1951 UTC = Sun May 6 03:00:00 1951 JDT isdst=1 gmtoff=36000 --Asia/Tokyo Fri Sep 7 15:59:59 1951 UTC = Sat Sep 8 01:59:59 1951 JDT isdst=1 gmtoff=36000 --Asia/Tokyo Fri Sep 7 16:00:00 1951 UTC = Sat Sep 8 01:00:00 1951 JST isdst=0 gmtoff=32400 -+#Asia/Tokyo Sat May 5 16:59:59 1951 UTC = Sun May 6 01:59:59 1951 JST isdst=0 gmtoff=32400 -+#Asia/Tokyo Sat May 5 17:00:00 1951 UTC = Sun May 6 03:00:00 1951 JDT isdst=1 gmtoff=36000 -+#Asia/Tokyo Fri Sep 7 15:59:59 1951 UTC = Sat Sep 8 01:59:59 1951 JDT isdst=1 gmtoff=36000 -+#Asia/Tokyo Fri Sep 7 16:00:00 1951 UTC = Sat Sep 8 01:00:00 1951 JST isdst=0 gmtoff=32400 - America/St_Johns Sun Mar 11 03:30:59 2007 UTC = Sun Mar 11 00:00:59 2007 NST isdst=0 gmtoff=-12600 - America/St_Johns Sun Mar 11 03:31:00 2007 UTC = Sun Mar 11 01:01:00 2007 NDT isdst=1 gmtoff=-9000 - America/St_Johns Sun Nov 4 02:30:59 2007 UTC = Sun Nov 4 00:00:59 2007 NDT isdst=1 gmtoff=-9000 diff --git a/ruby-2.5.1-TestTimeTZ-test-failures-Kiritimati-and-Lisbon.patch b/ruby-2.5.1-TestTimeTZ-test-failures-Kiritimati-and-Lisbon.patch new file mode 100644 index 0000000..fa5ad3e --- /dev/null +++ b/ruby-2.5.1-TestTimeTZ-test-failures-Kiritimati-and-Lisbon.patch @@ -0,0 +1,115 @@ +From 584b5929f9b769c4d0b03e322a9fddf2b2dd3454 Mon Sep 17 00:00:00 2001 +From: nobu +Date: Sun, 1 Apr 2018 13:02:11 +0000 +Subject: [PATCH] test_time_tz.rb: Kiritimati tzdata fix + +* test/ruby/test_time_tz.rb (gen_zdump_test): fix the expected + data at the Kiritimati's skip of New Year's Eve 1994. + [Bug #14655] + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63055 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + test/ruby/test_time_tz.rb | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb +index dfe139033ed3..ac5f81892878 100644 +--- a/test/ruby/test_time_tz.rb ++++ b/test/ruby/test_time_tz.rb +@@ -364,9 +364,18 @@ def self.gen_zdump_test(data) + Europe/London Sun Aug 10 01:00:00 1947 UTC = Sun Aug 10 02:00:00 1947 BST isdst=1 gmtoff=3600 + Europe/London Sun Nov 2 01:59:59 1947 UTC = Sun Nov 2 02:59:59 1947 BST isdst=1 gmtoff=3600 + Europe/London Sun Nov 2 02:00:00 1947 UTC = Sun Nov 2 02:00:00 1947 GMT isdst=0 gmtoff=0 ++End ++ if CORRECT_KIRITIMATI_SKIP_1994 ++ gen_zdump_test <<'End' ++Pacific/Kiritimati Sat Dec 31 09:59:59 1994 UTC = Fri Dec 30 23:59:59 1994 LINT isdst=0 gmtoff=-36000 ++Pacific/Kiritimati Sat Dec 31 10:00:00 1994 UTC = Sun Jan 1 00:00:00 1995 LINT isdst=0 gmtoff=50400 ++End ++ else ++ gen_zdump_test <<'End' + Pacific/Kiritimati Sun Jan 1 09:59:59 1995 UTC = Sat Dec 31 23:59:59 1994 LINT isdst=0 gmtoff=-36000 + Pacific/Kiritimati Sun Jan 1 10:00:00 1995 UTC = Mon Jan 2 00:00:00 1995 LINT isdst=0 gmtoff=50400 + End ++ end + gen_zdump_test <<'End' if has_right_tz + right/America/Los_Angeles Fri Jun 30 23:59:60 1972 UTC = Fri Jun 30 16:59:60 1972 PDT isdst=1 gmtoff=-25200 + right/America/Los_Angeles Wed Dec 31 23:59:60 2008 UTC = Wed Dec 31 15:59:60 2008 PST isdst=0 gmtoff=-28800 +-- + +From 2965c2d4df78e6f5acf8759f84c88ce14a4e70f1 Mon Sep 17 00:00:00 2001 +From: nobu +Date: Sun, 1 Apr 2018 02:00:36 +0000 +Subject: [PATCH] test_time_tz.rb: Kiritimati tzdata fix + +* test/ruby/test_time_tz.rb (TestTimeTZ#test_pacific_kiritimati): + fix the expected data at the skip of New Year's Eve 1994. + [Bug #14655] + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63054 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + test/ruby/test_time_tz.rb | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb +index 39b830d28a3d..dfe139033ed3 100644 +--- a/test/ruby/test_time_tz.rb ++++ b/test/ruby/test_time_tz.rb +@@ -89,6 +89,9 @@ def group_by(e, &block) + Time.local(1951, 5, 6, 1, 0, 0).dst? # DST with fixed tzdata + end + } ++ CORRECT_KIRITIMATI_SKIP_1994 = with_tz("Pacific/Kiritimati") { ++ Time.local(1994, 12, 31, 0, 0, 0).year == 1995 ++ } + + def time_to_s(t) + t.to_s +@@ -178,9 +181,17 @@ def test_europe_lisbon + + def test_pacific_kiritimati + with_tz(tz="Pacific/Kiritimati") { +- assert_time_constructor(tz, "1994-12-31 23:59:59 -1000", :local, [1994,12,31,23,59,59]) +- assert_time_constructor(tz, "1995-01-02 00:00:00 +1400", :local, [1995,1,1,0,0,0]) +- assert_time_constructor(tz, "1995-01-02 23:59:59 +1400", :local, [1995,1,1,23,59,59]) ++ assert_time_constructor(tz, "1994-12-30 00:00:00 -1000", :local, [1994,12,30,0,0,0]) ++ assert_time_constructor(tz, "1994-12-30 23:59:59 -1000", :local, [1994,12,30,23,59,59]) ++ if CORRECT_KIRITIMATI_SKIP_1994 ++ assert_time_constructor(tz, "1995-01-01 00:00:00 +1400", :local, [1994,12,31,0,0,0]) ++ assert_time_constructor(tz, "1995-01-01 23:59:59 +1400", :local, [1994,12,31,23,59,59]) ++ assert_time_constructor(tz, "1995-01-01 00:00:00 +1400", :local, [1995,1,1,0,0,0]) ++ else ++ assert_time_constructor(tz, "1994-12-31 23:59:59 -1000", :local, [1994,12,31,23,59,59]) ++ assert_time_constructor(tz, "1995-01-02 00:00:00 +1400", :local, [1995,1,1,0,0,0]) ++ assert_time_constructor(tz, "1995-01-02 23:59:59 +1400", :local, [1995,1,1,23,59,59]) ++ end + assert_time_constructor(tz, "1995-01-02 00:00:00 +1400", :local, [1995,1,2,0,0,0]) + } + end +-- + +From a0e6607a8172f9eaf9a15f03065736deb2035771 Mon Sep 17 00:00:00 2001 +From: nobu +Date: Sun, 1 Apr 2018 13:16:14 +0000 +Subject: [PATCH] test_time_tz.rb: Lisbon tzdata fix + +* test/ruby/test_time_tz.rb (gen_variational_zdump_test): Update + Lisbon zdump data, which fixed the 1912-01-01 transition for + Portugual and its colonies. [Bug #14655] + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63056 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + test/ruby/test_time_tz.rb | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb +index ac5f81892878..b32caff9c539 100644 +--- a/test/ruby/test_time_tz.rb ++++ b/test/ruby/test_time_tz.rb +@@ -434,5 +434,6 @@ def self.gen_variational_zdump_test(hint, data) + gen_variational_zdump_test "lisbon", <<'End' if has_lisbon_tz + Europe/Lisbon Mon Jan 1 00:36:31 1912 UTC = Sun Dec 31 23:59:59 1911 LMT isdst=0 gmtoff=-2192 + Europe/Lisbon Mon Jan 1 00:36:44 1912 UT = Sun Dec 31 23:59:59 1911 LMT isdst=0 gmtoff=-2205 ++Europe/Lisbon Sun Dec 31 23:59:59 1911 UT = Sun Dec 31 23:23:14 1911 LMT isdst=0 gmtoff=-2205 + End + end diff --git a/ruby.spec b/ruby.spec index 2ece109..0fca1c3 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ %global major_version 2 %global minor_version 4 -%global teeny_version 3 +%global teeny_version 4 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -36,13 +36,13 @@ # http://redmine.ruby-lang.org/issues/5313 %global irb_version %{ruby_version} -%global bigdecimal_version 1.3.0 +%global bigdecimal_version 1.3.2 %global did_you_mean_version 1.1.0 %global io_console_version 0.4.6 %global json_version 2.0.4 %global minitest_version 5.10.1 %global net_telnet_version 0.1.1 -%global openssl_version 2.0.5 +%global openssl_version 2.0.7 %global power_assert_version 0.4.1 %global psych_version 2.2.2 %global rake_version 12.0.0 @@ -131,13 +131,9 @@ Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1528226 # https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7 Patch10: ruby-2.4.3-Fix-Command-injection-in-lib-resolv-lazy_initialize.patch -# Fix: Multiple vulnerabilities in RubyGems -# https://bugzilla.redhat.com/show_bug.cgi?id=1547431 -# https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/ -Patch11: rubygems-2.4.3-multiple-vulnerabilities.patch -# Recent tzdata change breaks Ruby test suite. -# https://bugs.ruby-lang.org/issues/14438 -Patch12: ruby-2.5.0-Disable-Tokyo-TZ-tests.patch +# TestTimeTZ test failures Kiritimati and Lisbon +# https://bugs.ruby-lang.org/issues/14655 +Patch13: ruby-2.5.1-TestTimeTZ-test-failures-Kiritimati-and-Lisbon.patch Requires: %{name}-libs%{?_isa} = %{version}-%{release} Suggests: rubypick @@ -519,8 +515,7 @@ rm -rf ext/fiddle/libffi* %patch7 -p1 %patch9 -p1 %patch10 -p1 -%patch11 -p0 -%patch12 -p1 +%patch13 -p1 # Provide an example of usage of the tapset: cp -a %{SOURCE3} . @@ -1035,6 +1030,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Mon Apr 16 2018 Pavel Valena - 2.4.4-88 +- Update to Ruby 2.4.4. + * Wed Feb 21 2018 Pavel Valena - 2.4.3-87 - Fix: Multiple vulnerabilities in RubyGems https://bugzilla.redhat.com/show_bug.cgi?id=1547431 diff --git a/rubygems-2.4.3-multiple-vulnerabilities.patch b/rubygems-2.4.3-multiple-vulnerabilities.patch deleted file mode 100644 index c9464fa..0000000 --- a/rubygems-2.4.3-multiple-vulnerabilities.patch +++ /dev/null @@ -1,605 +0,0 @@ -diff --git lib/rubygems.rb lib/rubygems.rb -index 0685bcb3c6..a5a9202e56 100644 ---- lib/rubygems.rb -+++ lib/rubygems.rb -@@ -10,7 +10,7 @@ - require 'thread' - - module Gem -- VERSION = "2.6.14" -+ VERSION = "2.6.14.1" - end - - # Must be first since it unloads the prelude from 1.9.2 -diff --git lib/rubygems/commands/owner_command.rb lib/rubygems/commands/owner_command.rb -index 4b99434e87..2ee7f84462 100644 ---- lib/rubygems/commands/owner_command.rb -+++ lib/rubygems/commands/owner_command.rb -@@ -62,7 +62,7 @@ def show_owners name - end - - with_response response do |resp| -- owners = YAML.load resp.body -+ owners = Gem::SafeYAML.load resp.body - - say "Owners for gem: #{name}" - owners.each do |owner| -diff --git lib/rubygems/package.rb lib/rubygems/package.rb -index 77811ed5ec..b5a5fe2a26 100644 ---- lib/rubygems/package.rb -+++ lib/rubygems/package.rb -@@ -378,7 +378,7 @@ def extract_tar_gz io, destination_dir, pattern = "*" # :nodoc: - File.dirname destination - end - -- FileUtils.mkdir_p mkdir, mkdir_options -+ mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name - - open destination, 'wb' do |out| - out.write entry.read -@@ -416,20 +416,35 @@ def install_location filename, destination_dir # :nodoc: - raise Gem::Package::PathError.new(filename, destination_dir) if - filename.start_with? '/' - -- destination_dir = File.realpath destination_dir if -- File.respond_to? :realpath -+ destination_dir = realpath destination_dir - destination_dir = File.expand_path destination_dir - - destination = File.join destination_dir, filename - destination = File.expand_path destination - - raise Gem::Package::PathError.new(destination, destination_dir) unless -- destination.start_with? destination_dir -+ destination.start_with? destination_dir + '/' - - destination.untaint - destination - end - -+ def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name -+ destination_dir = realpath File.expand_path(destination_dir) -+ parts = mkdir.split(File::SEPARATOR) -+ parts.reduce do |path, basename| -+ path = realpath path unless path == "" -+ path = File.expand_path(path + File::SEPARATOR + basename) -+ lstat = File.lstat path rescue nil -+ if !lstat || !lstat.directory? -+ unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false) -+ raise Gem::Package::PathError.new(file_name, destination_dir) -+ end -+ end -+ path -+ end -+ end -+ - ## - # Loads a Gem::Specification from the TarEntry +entry+ - -@@ -603,6 +618,10 @@ def verify_files gem - raise Gem::Package::FormatError.new \ - 'package content (data.tar.gz) is missing', @gem - end -+ -+ if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any? -+ raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})" -+ end - end - - ## -@@ -616,6 +635,16 @@ def verify_gz entry # :nodoc: - raise Gem::Package::FormatError.new(e.message, entry.full_name) - end - -+ if File.respond_to? :realpath -+ def realpath file -+ File.realpath file -+ end -+ else -+ def realpath file -+ file -+ end -+ end -+ - end - - require 'rubygems/package/digest_io' -diff --git lib/rubygems/package/tar_header.rb lib/rubygems/package/tar_header.rb -index c54bd14d57..d557357114 100644 ---- lib/rubygems/package/tar_header.rb -+++ lib/rubygems/package/tar_header.rb -@@ -104,25 +104,30 @@ def self.from(stream) - fields = header.unpack UNPACK_FORMAT - - new :name => fields.shift, -- :mode => fields.shift.oct, -- :uid => fields.shift.oct, -- :gid => fields.shift.oct, -- :size => fields.shift.oct, -- :mtime => fields.shift.oct, -- :checksum => fields.shift.oct, -+ :mode => strict_oct(fields.shift), -+ :uid => strict_oct(fields.shift), -+ :gid => strict_oct(fields.shift), -+ :size => strict_oct(fields.shift), -+ :mtime => strict_oct(fields.shift), -+ :checksum => strict_oct(fields.shift), - :typeflag => fields.shift, - :linkname => fields.shift, - :magic => fields.shift, -- :version => fields.shift.oct, -+ :version => strict_oct(fields.shift), - :uname => fields.shift, - :gname => fields.shift, -- :devmajor => fields.shift.oct, -- :devminor => fields.shift.oct, -+ :devmajor => strict_oct(fields.shift), -+ :devminor => strict_oct(fields.shift), - :prefix => fields.shift, - - :empty => empty - end - -+ def self.strict_oct(str) -+ return str.oct if str =~ /\A[0-7]*\z/ -+ raise ArgumentError, "#{str.inspect} is not an octal string" -+ end -+ - ## - # Creates a new TarHeader using +vals+ - -diff --git lib/rubygems/package/tar_writer.rb lib/rubygems/package/tar_writer.rb -index f68b8d4c5e..390f7851a3 100644 ---- lib/rubygems/package/tar_writer.rb -+++ lib/rubygems/package/tar_writer.rb -@@ -196,6 +196,8 @@ def add_file_signed name, mode, signer - digest_name == signer.digest_name - end - -+ raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest -+ - if signer.key then - signature = signer.sign signature_digest.digest - -diff --git lib/rubygems/server.rb lib/rubygems/server.rb -index df4eb566d3..a7b5243ba0 100644 ---- lib/rubygems/server.rb -+++ lib/rubygems/server.rb -@@ -631,6 +631,18 @@ def root(req, res) - executables = nil if executables.empty? - executables.last["is_last"] = true if executables - -+ # Pre-process spec homepage for safety reasons -+ begin -+ homepage_uri = URI.parse(spec.homepage) -+ if [URI::HTTP, URI::HTTPS].member? homepage_uri.class -+ homepage_uri = spec.homepage -+ else -+ homepage_uri = "." -+ end -+ rescue URI::InvalidURIError -+ homepage_uri = "." -+ end -+ - specs << { - "authors" => spec.authors.sort.join(", "), - "date" => spec.date.to_s, -@@ -640,7 +652,7 @@ def root(req, res) - "only_one_executable" => (executables && executables.size == 1), - "full_name" => spec.full_name, - "has_deps" => !deps.empty?, -- "homepage" => spec.homepage, -+ "homepage" => homepage_uri, - "name" => spec.name, - "rdoc_installed" => Gem::RDoc.new(spec).rdoc_installed?, - "ri_installed" => Gem::RDoc.new(spec).ri_installed?, -diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb -index 40e3a70d47..0a154b9001 100644 ---- lib/rubygems/specification.rb -+++ lib/rubygems/specification.rb -@@ -15,6 +15,7 @@ - require 'rubygems/stub_specification' - require 'rubygems/util/list' - require 'stringio' -+require 'uri' - - ## - # The Specification class contains the information for a Gem. Typically -@@ -2813,10 +2814,16 @@ def validate packaging = true - raise Gem::InvalidSpecificationException, "#{lazy} is not a summary" - end - -- if homepage and not homepage.empty? and -- homepage !~ /\A[a-z][a-z\d+.-]*:/i then -- raise Gem::InvalidSpecificationException, -- "\"#{homepage}\" is not a URI" -+ # Make sure a homepage is valid HTTP/HTTPS URI -+ if homepage and not homepage.empty? -+ begin -+ homepage_uri = URI.parse(homepage) -+ unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class -+ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" -+ end -+ rescue URI::InvalidURIError -+ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" -+ end - end - - # Warnings -diff --git test/rubygems/test_gem_commands_owner_command.rb test/rubygems/test_gem_commands_owner_command.rb -index 44652c1093..53cac4ce87 100644 ---- test/rubygems/test_gem_commands_owner_command.rb -+++ test/rubygems/test_gem_commands_owner_command.rb -@@ -43,6 +43,31 @@ def test_show_owners - assert_match %r{- 4}, @ui.output - end - -+ def test_show_owners_dont_load_objects -+ skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass) -+ -+ response = <xsshomepagegem 1 -+ # -+ # -+ # [rdoc] -+ # -+ # -+ # -+ # [www] -+ # -+ # Variant #2 - rdoc installed -+ # -+ # xsshomepagegem 1 -+ # -+ # -+ # \[rdoc\]<\/a> -+ # -+ # -+ # -+ # [www] -+ regex_match = /xsshomepagegem 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ -+ assert_match regex_match, @res.body -+ end -+ -+ def test_invalid_homepage -+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" -+ dir = "#{@gemhome}2" -+ -+ spec = util_spec 'invalidhomepagegem', 1 -+ spec.homepage = "notavalidhomepageurl" -+ -+ specs_dir = File.join dir, 'specifications' -+ FileUtils.mkdir_p specs_dir -+ -+ open File.join(specs_dir, spec.spec_name), 'w' do |io| -+ io.write spec.to_ruby -+ end -+ -+ server = Gem::Server.new dir, process_based_port, false -+ -+ @req.parse data -+ -+ server.root @req, @res -+ -+ assert_equal 200, @res.status -+ assert_match 'invalidhomepagegem 1', @res.body -+ -+ # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a -+ # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here, -+ # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be -+ # validated in future versions of Gem::Specification. -+ # -+ # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex: -+ # -+ # Variant #1 - rdoc not installed -+ # -+ # invalidhomepagegem 1 -+ # -+ # -+ # [rdoc] -+ # -+ # -+ # -+ # [www] -+ # -+ # Variant #2 - rdoc installed -+ # -+ # invalidhomepagegem 1 -+ # -+ # -+ # \[rdoc\]<\/a> -+ # -+ # -+ # -+ # [www] -+ regex_match = /invalidhomepagegem 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ -+ assert_match regex_match, @res.body -+ end -+ -+ def test_valid_homepage_http -+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" -+ dir = "#{@gemhome}2" -+ -+ spec = util_spec 'validhomepagegemhttp', 1 -+ spec.homepage = "http://rubygems.org" -+ -+ specs_dir = File.join dir, 'specifications' -+ FileUtils.mkdir_p specs_dir -+ -+ open File.join(specs_dir, spec.spec_name), 'w' do |io| -+ io.write spec.to_ruby -+ end -+ -+ server = Gem::Server.new dir, process_based_port, false -+ -+ @req.parse data -+ -+ server.root @req, @res -+ -+ assert_equal 200, @res.status -+ assert_match 'validhomepagegemhttp 1', @res.body -+ -+ regex_match = /validhomepagegemhttp 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ -+ assert_match regex_match, @res.body -+ end -+ -+ def test_valid_homepage_https -+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n" -+ dir = "#{@gemhome}2" -+ -+ spec = util_spec 'validhomepagegemhttps', 1 -+ spec.homepage = "https://rubygems.org" -+ -+ specs_dir = File.join dir, 'specifications' -+ FileUtils.mkdir_p specs_dir -+ -+ open File.join(specs_dir, spec.spec_name), 'w' do |io| -+ io.write spec.to_ruby -+ end -+ -+ server = Gem::Server.new dir, process_based_port, false -+ -+ @req.parse data -+ -+ server.root @req, @res -+ -+ assert_equal 200, @res.status -+ assert_match 'validhomepagegemhttps 1', @res.body -+ -+ regex_match = /validhomepagegemhttps 1<\/b>[\n\s]+(\[rdoc\]<\/span>|\[rdoc\]<\/a>)[\n\s]+\[www\]<\/a>/ -+ assert_match regex_match, @res.body -+ end -+ - def test_specs - data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n" - @req.parse data -diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb -index 0fcc11e78f..1c68826fb3 100644 ---- test/rubygems/test_gem_specification.rb -+++ test/rubygems/test_gem_specification.rb -@@ -2890,7 +2890,22 @@ def test_validate_homepage - @a1.validate - end - -- assert_equal '"over at my cool site" is not a URI', e.message -+ assert_equal '"over at my cool site" is not a valid HTTP URI', e.message -+ -+ @a1.homepage = 'ftp://rubygems.org' -+ -+ e = assert_raises Gem::InvalidSpecificationException do -+ @a1.validate -+ end -+ -+ assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message -+ -+ @a1.homepage = 'http://rubygems.org' -+ assert_equal true, @a1.validate -+ -+ @a1.homepage = 'https://rubygems.org' -+ assert_equal true, @a1.validate -+ - end - end - From c6218ab6d625424c5750277468b395648e5ec36d Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Wed, 18 Apr 2018 18:15:40 +0200 Subject: [PATCH 16/20] Update sources file. --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 0c74d1b..ae3d69a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ruby-2.4.3.tar.xz) = 8bcf60c994a96787da5d743c66f5609a5a6d834d6d61243cdea7fd059197c3b10da43c99e5649be85e2f2329eedcbb1dd76e89ce3ac586be9056348f7449ed09 +SHA512 (ruby-2.4.4.tar.xz) = 4dc112a149273d4221484ccbf1260c6c5fcad7e0a6e4bc91e4ef69cbc093d3191f7abd71420f80d680f8ea5d111e6803ba2af32166aa501913639e6d5696fde0 From 7cb65d71c9eb57c005c75089ee2d0c757bb544c3 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Thu, 19 Apr 2018 14:24:23 +0200 Subject: [PATCH 17/20] Bump release. --- ruby.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ruby.spec b/ruby.spec index 0fca1c3..8069167 100644 --- a/ruby.spec +++ b/ruby.spec @@ -21,7 +21,7 @@ %endif -%global release 87 +%global release 88 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the From 95f30efb6f56836adda03b455f2ac09c545b7126 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Wed, 2 May 2018 17:00:36 +0200 Subject: [PATCH 18/20] Make %gemspec_{add,remove}_dep modify .gemspec provided by %setup macro. The macros need to be udpated, since RPM 4.14+ can expand .gem files and also also provide %{gem_name}.gemspec file used to rebuild the gem. However, the .gemspec file is not in current directory, but directly in %{_builddir}. --- macros.rubygems | 4 ++-- ruby.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/macros.rubygems b/macros.rubygems index 0652ec6..2cb96a6 100644 --- a/macros.rubygems +++ b/macros.rubygems @@ -60,7 +60,7 @@ gem install \\\ # %gemspec_add_dep(g:s:d) \ read -d '' gemspec_add_dep_script << 'EOR' || : \ - gemspec_file = '%{-s*}%{!?-s:./%{gem_name}.gemspec}' \ + gemspec_file = '%{-s*}%{!?-s:%{_builddir}/%{gem_name}-%{version}.gemspec}' \ \ name = '%{-g*}' \ requirements = %{*}%{!?1:nil} \ @@ -97,7 +97,7 @@ unset -v gemspec_add_dep_script \ # %gemspec_remove_dep(g:s:d) \ read -d '' gemspec_remove_dep_script << 'EOR' || : \ - gemspec_file = '%{-s*}%{!?-s:./%{gem_name}.gemspec}' \ + gemspec_file = '%{-s*}%{!?-s:%{_builddir}/%{gem_name}-%{version}.gemspec}' \ \ name = '%{-g*}' \ requirements = %{*}%{!?1:nil} \ diff --git a/ruby.spec b/ruby.spec index 8069167..f100c11 100644 --- a/ruby.spec +++ b/ruby.spec @@ -21,7 +21,7 @@ %endif -%global release 88 +%global release 89 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory three, since the @@ -1030,6 +1030,9 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Wed May 02 2018 Vít Ondruch - 2.4.4-89 +- Make %%gemspec_{add,remove}_dep modify .gemspec provided by %%setup macro. + * Mon Apr 16 2018 Pavel Valena - 2.4.4-88 - Update to Ruby 2.4.4. From db9bad6107ed6f3878381737838cefe824096122 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Thu, 3 May 2018 15:16:00 +0200 Subject: [PATCH 19/20] Fix typos in macro description. --- macros.rubygems | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/macros.rubygems b/macros.rubygems index 2cb96a6..b4dfc92 100644 --- a/macros.rubygems +++ b/macros.rubygems @@ -42,8 +42,8 @@ gem install \\\ } -# The 'read' command in gemspec_add _depand gemspec_remove_dep macros is not -# essential, but it is usefull to make the sript appear in build log. +# The 'read' command in gemspec_add_dep and gemspec_remove_dep macros is not +# essential, but it is usefull to make the script appear in build log. # %gemspec_add_dep - Add dependency into .gemspec. From 1a20dc4f09de87150fc276252609886551f14e31 Mon Sep 17 00:00:00 2001 From: Pavel Valena Date: Thu, 3 May 2018 14:53:28 +0200 Subject: [PATCH 20/20] Add macros to edit files lists in .gemspec %gemspec_add_file and %gemspec_remove_file. --- macros.rubygems | 69 +++++++++++++++++++++++++++++++++++++++++++++++-- ruby.spec | 4 +++ 2 files changed, 71 insertions(+), 2 deletions(-) diff --git a/macros.rubygems b/macros.rubygems index b4dfc92..d2e8514 100644 --- a/macros.rubygems +++ b/macros.rubygems @@ -42,8 +42,8 @@ gem install \\\ } -# The 'read' command in gemspec_add_dep and gemspec_remove_dep macros is not -# essential, but it is usefull to make the script appear in build log. +# The 'read' command in %%gemspec_* macros is not essential, but it is usefull +# to make the sript appear in build log. # %gemspec_add_dep - Add dependency into .gemspec. @@ -128,3 +128,68 @@ EOR\ echo "$gemspec_remove_dep_script" | ruby \ unset -v gemspec_remove_dep_script \ %{nil} + + +# %%gemspec_add_file - Add files to various files lists in .gemspec. +# +# Usage: %%gemspec_add_file [options] +# +# Add files to .gemspec file. is expected to be valid Ruby code. +# Path to file is expected. Does not check real files in any way. +# By default, `files` list is edited. +# +# -s Overrides the default .gemspec location. +# -t Edit test_files only. +# -r Edit extra_rdoc_files only. +# +%gemspec_add_file(s:tr) \ +read -d '' gemspec_add_file_script << 'EOR' || : \ + gemspec_file = '%{-s*}%{!?-s:%{_builddir}/%{gem_name}-%{version}.gemspec}' \ + \ + abort("gemspec_add_file: Use only one '-t' or '-r' at a time.") if "%{?-t}%{?-r}" == "-t-r" \ + \ + filenames = %{*}%{!?1:nil} \ + filenames = Array(filenames) \ + \ + spec = Gem::Specification.load(gemspec_file) \ + abort("#{gemspec_file} is not accessible.") unless spec \ + \ + spec.%{?-t:test_}%{?-r:extra_rdoc_}files += filenames \ + File.write gemspec_file, spec.to_ruby \ +EOR\ +echo "$gemspec_add_file_script" | ruby \ +unset -v gemspec_add_file_script \ +%{nil} + + +# %%gemspec_remove_file - Remove files from various files lists in .gemspec. +# +# Usage: %%gemspec_remove_file [options] +# +# Remove files from .gemspec file. is expected to be valid Ruby code. +# Path to file is expected. Does not check/remove real files in any way. +# By default, `files` list is edited. File has to be removed from `test_files` +# first in order to be removable from `files`. +# +# -s Overrides the default .gemspec location. +# -t Edit test_files only. +# -r Edit extra_rdoc_files only. +# +%gemspec_remove_file(s:tr) \ +read -d '' gemspec_remove_file_script << 'EOR' || : \ + gemspec_file = '%{-s*}%{!?-s:%{_builddir}/%{gem_name}-%{version}.gemspec}' \ + \ + abort("gemspec_remove_file: Use only one '-t' or '-r' at a time.") if "%{?-t}%{?-r}" == "-t-r" \ + \ + filenames = %{*}%{!?1:nil} \ + filenames = Array(filenames) \ + \ + spec = Gem::Specification.load(gemspec_file) \ + abort("#{gemspec_file} is not accessible.") unless spec \ + \ + spec.%{?-t:test_}%{?-r:extra_rdoc_}files -= filenames \ + File.write gemspec_file, spec.to_ruby \ +EOR\ +echo "$gemspec_remove_file_script" | ruby \ +unset -v gemspec_remove_file_script \ +%{nil} diff --git a/ruby.spec b/ruby.spec index f100c11..61fc3ab 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1030,6 +1030,10 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Thu May 10 2018 Pavel Valena - 2.4.4-89 +- Add macros to edit files lists in .gemspec + (gemspec_add_file and gemspec_remove_file). + * Wed May 02 2018 Vít Ondruch - 2.4.4-89 - Make %%gemspec_{add,remove}_dep modify .gemspec provided by %%setup macro.