| Message ID | 20220629155533.5224-1-remco@remworks.net |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [bug#56302] gnu: ruby: Update to 2.7.6 [security fixes]. | expand |
| Context | Check | Description |
|---|---|---|
| cbaines/comparison | success | View comparision |
| cbaines/git branch | success | View Git branch |
| cbaines/applying patch | success | View Laminar job |
| cbaines/issue | success | View issue |
Please note: $ guix refresh --list-dependent ruby@2.7 Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ... So this goes into core-updates.
Right, but '[security fixes]' means we (also) need to graft on master. Would you want to give that a try? Thanks for the patch! T G-R Sent on the go. Excuse or enjoy my brevity.
Remco van 't Veer schreef op wo 29-06-2022 om 17:58 [+0200]: > Please note: > > $ guix refresh --list-dependent ruby@2.7 > Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ... > > So this goes into core-updates. core-updates probably won't be merged for a long time, so a graft might be needed in the meantime. Basically, what you need to do is: * keep the old ruby@2.7.4 package definition * add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...])) * in ruby@2.7.4, add a field (replacement ruby-2.7-fixed) ; security fixes and verify that some Ruby-using dependents still seem to work. That way, we can use a fixed ruby@2.7.6 on master. (This assumes that ruby is graftable -- this assumes that ruby is ABI-compatible, otherwise the grafted dependents won't work.) Greetings, Maxime
2022/06/29 18:04, Maxime Devos: > core-updates probably won't be merged for a long time, so a graft might > be needed in the meantime. So, keep this bug and make a new patch / bug for the graft? > Basically, what you need to do is: > > * keep the old ruby@2.7.4 package definition > * add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...])) > * in ruby@2.7.4, add a field > (replacement ruby-2.7-fixed) ; security fixes > > and verify that some Ruby-using dependents still seem to work. > > That way, we can use a fixed ruby@2.7.6 on master. > > (This assumes that ruby is graftable -- this assumes that ruby is > ABI-compatible, otherwise the grafted dependents won't work.) Thanks for the explanation! I'll give it a try. Cheers, Remco
Remco van 't Veer schreef op wo 29-06-2022 om 18:13 [+0200]: > 2022/06/29 18:04, Maxime Devos: > > > core-updates probably won't be merged for a long time, so a graft might > > be needed in the meantime. > > So, keep this bug and make a new patch / bug for the graft? I'd keep the 56302 to keep things orderly. FWIW, while they can be reviewed and applied independently, the various Ruby update patches are all about the same thing (updating Ruby), so they could have been done together I think (separate patches, but a single series and single debbugs number). TBC: to keep things orderly, let's not make a new issue with a patch series, it's more a thing I would recommend for the future. Greetings, Maxime
Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
> + "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
This matches with a local
$ guix download https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’
and with all the hashes from <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>.
I'll try diffing (*) it with the old tarball for ‘suspiciousness’
(e.g.: obvious malware, new bundling, ???).
Greetings,
Maxime
(*) diffoscope can be useful, albeit a bit slow at time.
Maxime Devos schreef op wo 29-06-2022 om 20:29 [+0200]: > Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]: > > + > "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877")))) > > This matches with a local > > $ guix download > https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’ > > and with all the hashes from > <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>. > > I'll try diffing (*) it with the old tarball for ‘suspiciousness’ > (e.g.: obvious malware, new bundling, ???). When scrolling through the diff, nothing looked ‘suspect’ at first glance. However, I did notice something else: some parts are not under the Ruby License, but under 2-clause BSD: │ ├── +++ ruby-2.7.4/gems/xmlrpc-0.3.0/LICENSE.txt │ │┄ Files 26% similar despite different names │ │ @@ -1,13 +1,10 @@ │ │ -test-unit is copyrighted free software by Kouhei Sutou │ │ -<kou@cozmixng.org>, Ryan Davis <ryand-ruby@zenspider.com> │ │ -and Nathaniel Talbott <nathaniel@talbott.ws>. │ │ - │ │ -You can redistribute it and/or modify it under either the terms of the GPL │ │ -version 2 (see the file GPL), or the conditions below: │ │ +Ruby is copyrighted free software by Yukihiro Matsumoto <matz@netlab.jp>. │ │ +You can redistribute it and/or modify it under either the terms of the │ │ +2-clause BSDL (see the file BSDL), or the conditions below: so it maybe be good to add ‘2-clause BSDL’ to the license field as well (though given that it's an old issue, bringing the new version of ruby in Guix has priority). Also, looks like it bundles some autoconf scripts (config.guess), which is not in line with <https://lists.gnu.org/archive/html/guix-devel/2022-04/msg00065.html>, but also not priority given the security fix. Greetings, Maxime
Maxime Devos <maximedevos@telenet.be> skriver: > Maxime Devos schreef op wo 29-06-2022 om 20:29 [+0200]: >> Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]: >> > + >> "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877")))) >> >> This matches with a local >> >> $ guix download >> https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’ >> >> and with all the hashes from >> <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>. >> >> I'll try diffing (*) it with the old tarball for ‘suspiciousness’ >> (e.g.: obvious malware, new bundling, ???). > > When scrolling through the diff, nothing looked ‘suspect’ at first > glance. However, I did notice something else: some parts are not > under the Ruby License, but under 2-clause BSD: > > │ ├── +++ ruby-2.7.4/gems/xmlrpc-0.3.0/LICENSE.txt > │ │┄ Files 26% similar despite different names > │ │ @@ -1,13 +1,10 @@ > │ │ -test-unit is copyrighted free software by Kouhei Sutou > │ │ -<kou@cozmixng.org>, Ryan Davis <ryand-ruby@zenspider.com> > │ │ -and Nathaniel Talbott <nathaniel@talbott.ws>. > │ │ - > │ │ -You can redistribute it and/or modify it under either the terms of > the GPL > │ │ -version 2 (see the file GPL), or the conditions below: > │ │ +Ruby is copyrighted free software by Yukihiro Matsumoto > <matz@netlab.jp>. > │ │ +You can redistribute it and/or modify it under either the terms of > the > │ │ +2-clause BSDL (see the file BSDL), or the conditions below: > > so it maybe be good to add ‘2-clause BSDL’ to the license field as well > (though given that it's an old issue, bringing the new version of ruby > in Guix has priority). It would be good to do a proper license audit of the bundled gems in Ruby. I see the previous version was not the Ruby license either, but GPL, and it's not listed among the licenses.
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm index 5b65196c6c..9e1aff410f 100644 --- a/gnu/packages/ruby.scm +++ b/gnu/packages/ruby.scm @@ -28,6 +28,7 @@ ;;; Copyright © 2021 EuAndreh <eu@euandre.org> ;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin@mailbox.org> ;;; Copyright © 2021 Giovanni Biscuolo <g@xelera.eu> +;;; Copyright © 2022 Remco van 't Veer <remco@remworks.net> ;;; ;;; This file is part of GNU Guix. ;;; @@ -151,7 +152,7 @@ (define-public ruby-2.6 (define-public ruby-2.7 (package (inherit ruby-2.6) - (version "2.7.4") + (version "2.7.6") (source (origin (inherit (package-source ruby-2.6)) @@ -160,7 +161,7 @@ (define-public ruby-2.7 "/ruby-" version ".tar.gz")) (sha256 (base32 - "0nxwkxh7snmjqf787qsp4i33mxd1rbf9yzyfiky5k230i680jhrh")))) + "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877")))) (arguments `(#:test-target "test" #:configure-flags '("--enable-shared") ; dynamic linking