[PATCH] gnu: ruby: Update to 2.7.6 [security fixes].

  • Done
  • quality assurance status badge
Details
4 participants
  • Marius Bakke
  • Maxime Devos
  • Tobias Geerinckx-Rice
  • Remco van 't Veer
Owner
unassigned
Submitted by
Remco van 't Veer
Severity
normal
R
R
Remco van 't Veer wrote on 29 Jun 2022 17:55
(address . guix-patches@gnu.org)(name . Remco van 't Veer)(address . remco@remworks.net)
20220629155533.5224-1-remco@remworks.net
Includes fixes for: CVE-2022-28739, CVE-2021-41816, and CVE-2021-41817.

* gnu/packages/ruby.scm (ruby-2.7): Update to 2.7.6.
---
gnu/packages/ruby.scm | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

Toggle diff (34 lines)
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 5b65196c6c..9e1aff410f 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -28,6 +28,7 @@
;;; Copyright © 2021 EuAndreh <eu@euandre.org>
;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin@mailbox.org>
;;; Copyright © 2021 Giovanni Biscuolo <g@xelera.eu>
+;;; Copyright © 2022 Remco van 't Veer <remco@remworks.net>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -151,7 +152,7 @@ (define-public ruby-2.6
(define-public ruby-2.7
(package
(inherit ruby-2.6)
- (version "2.7.4")
+ (version "2.7.6")
(source
(origin
(inherit (package-source ruby-2.6))
@@ -160,7 +161,7 @@ (define-public ruby-2.7
"/ruby-" version ".tar.gz"))
(sha256
(base32
- "0nxwkxh7snmjqf787qsp4i33mxd1rbf9yzyfiky5k230i680jhrh"))))
+ "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
(arguments
`(#:test-target "test"
#:configure-flags '("--enable-shared") ; dynamic linking

base-commit: 4bc6888f5e475e06019790c76fd20caf4cc137f4
--
2.36.1
R
R
Remco van 't Veer wrote on 29 Jun 2022 17:58
Re: bug#56302: Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
(address . 56302@debbugs.gnu.org)
87a69vh377.fsf@remworks.net
Please note:

$ guix refresh --list-dependent ruby@2.7
Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ...

So this goes into core-updates.
T
T
Tobias Geerinckx-Rice wrote on 29 Jun 2022 18:04
Re: [bug#56302] Acknowledgement ([PATCH] gn u: ruby: Update to 2.7.6 [security fixes].)
5DF7A747-FFC0-4ABA-9F81-F5DCBCCA1FE0@tobias.gr
Right, but '[security fixes]' means we (also) need to graft on master.

Would you want to give that a try?

Thanks for the patch!

T G-R

Sent on the go. Excuse or enjoy my brevity.
M
M
Maxime Devos wrote on 29 Jun 2022 18:04
Re: [bug#56302] Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
975d34406b3e636414efdeb2ff1d7dbd4e95d944.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 17:58 [+0200]:
Toggle quote (7 lines)
> Please note:
>
>   $ guix refresh --list-dependent ruby@2.7
>   Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ...
>
> So this goes into core-updates.

core-updates probably won't be merged for a long time, so a graft might
be needed in the meantime.

Basically, what you need to do is:

* keep the old ruby@2.7.4 package definition
* add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...]))
* in ruby@2.7.4, add a field
(replacement ruby-2.7-fixed) ; security fixes

and verify that some Ruby-using dependents still seem to work.

That way, we can use a fixed ruby@2.7.6 on master.

(This assumes that ruby is graftable -- this assumes that ruby is
ABI-compatible, otherwise the grafted dependents won't work.)

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYrx4FRccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7pF2AP4nd5vGekUHj0J+E6sxWleN8HmL
nP8XZqpbziZAQiPaXAEA5iwoMwPacYHxwL0+kvnBY7CAgIWHRI5D/80mS/Tphwo=
=5aCT
-----END PGP SIGNATURE-----


R
R
Remco van 't Veer wrote on 29 Jun 2022 18:13
(name . Maxime Devos)(address . maximedevos@telenet.be)(address . 56302@debbugs.gnu.org)
875ykjh2h9.fsf@remworks.net
2022/06/29 18:04, Maxime Devos:

Toggle quote (3 lines)
> core-updates probably won't be merged for a long time, so a graft might
> be needed in the meantime.

So, keep this bug and make a new patch / bug for the graft?

Toggle quote (14 lines)
> Basically, what you need to do is:
>
> * keep the old ruby@2.7.4 package definition
> * add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...]))
> * in ruby@2.7.4, add a field
> (replacement ruby-2.7-fixed) ; security fixes
>
> and verify that some Ruby-using dependents still seem to work.
>
> That way, we can use a fixed ruby@2.7.6 on master.
>
> (This assumes that ruby is graftable -- this assumes that ruby is
> ABI-compatible, otherwise the grafted dependents won't work.)

Thanks for the explanation! I'll give it a try.

Cheers,
Remco
R
R
Remco van 't Veer wrote on 29 Jun 2022 20:00
[PATCH v2] gnu: ruby: Update to 2.7.6 [security fixes].
(address . 56302@debbugs.gnu.org)
20220629180037.27919-1-remco@remworks.net
Includes fixes for: CVE-2022-28739, CVE-2021-41816, and CVE-2021-41817.

* gnu/packages/ruby.scm (ruby-2.7-fixed): New variable.
(ruby-2.7)[replacement]: Graft.
---
gnu/packages/ruby.scm | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

Toggle diff (43 lines)
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 68e5d8dfd6..0b6626bdf7 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -28,6 +28,7 @@
;;; Copyright © 2021 EuAndreh <eu@euandre.org>
;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin@mailbox.org>
;;; Copyright © 2021 Giovanni Biscuolo <g@xelera.eu>
+;;; Copyright © 2022 Remco van 't Veer <remco@remworks.net>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -152,6 +153,7 @@ (define-public ruby-2.7
(package
(inherit ruby-2.6)
(version "2.7.4")
+ (replacement ruby-2.7-fixed) ; security fixes
(source
(origin
(inherit (package-source ruby-2.6))
@@ -186,6 +188,20 @@ (define-public ruby-2.7
(native-inputs
(list autoconf))))
+(define ruby-2.7-fixed
+ (package
+ (inherit ruby-2.7)
+ (version "2.7.6")
+ (source
+ (origin
+ (inherit (package-source ruby-2.7))
+ (uri (string-append "https://cache.ruby-lang.org/pub/ruby/"
+ (version-major+minor version)
+ "/ruby-" version ".tar.gz"))
+ (sha256
+ (base32
+ "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))))
+
(define-public ruby-3.0
(package
(inherit ruby-2.7)
--
2.36.1
M
M
Maxime Devos wrote on 29 Jun 2022 20:18
Re: [bug#56302] Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
(name . Remco van 't Veer)(address . remco@remworks.net)(address . 56302@debbugs.gnu.org)
c2c8209c614d12b7cec0c076ba81284b5e36774b.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 18:13 [+0200]:
Toggle quote (7 lines)
> 2022/06/29 18:04, Maxime Devos:
>
> > core-updates probably won't be merged for a long time, so a graft might
> > be needed in the meantime.
>
> So, keep this bug and make a new patch / bug for the graft?

I'd keep the 56302 to keep things orderly. FWIW, while they can be
reviewed and applied independently, the various Ruby update patches are
all about the same thing (updating Ruby), so they could have been done
together I think (separate patches, but a single series and single
debbugs number).

TBC: to keep things orderly, let's not make a new issue with a patch
series, it's more a thing I would recommend for the future.

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYryXihccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7o+YAQDGBZ9A4Q5/3ImgYs8H64sOOnEb
mFwrfcnXqngsKho5aAD/WVkr9bUua/89o0tcGbW1SkHPExSz8LPAinPNmoBWvws=
=He4u
-----END PGP SIGNATURE-----


M
M
Maxime Devos wrote on 29 Jun 2022 20:29
Re: [bug#56302] [PATCH] gnu: ruby: Update to 2.7.6 [security fixes].
3edebb176b620a66a47b013a332c9683322e1a8d.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
Toggle quote (2 lines)
> +         "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))

This matches with a local



I'll try diffing (*) it with the old tarball for ‘suspiciousness’
(e.g.: obvious malware, new bundling, ???).

Greetings,
Maxime

(*) diffoscope can be useful, albeit a bit slow at time.
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYryaGBccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7pJdAPkBEb6u180e28+wRZgfp9hTuiAt
i+CYetjqnvQU8xO1xAD/e0yv/ccix6gGCRgH6cEz9SJJyR3T8U+Ylg07NrVDAQM=
=rgOc
-----END PGP SIGNATURE-----


M
M
Maxime Devos wrote on 29 Jun 2022 20:57
e7cff471ceddf9b590998305321c6daebfab6f82.camel@telenet.be
Maxime Devos schreef op wo 29-06-2022 om 20:29 [+0200]:
Toggle quote (15 lines)
> Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
> > +        
> "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
>
> This matches with a local
>
> $ guix download
> https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’
>
> and with all the hashes from
> <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>.
>
> I'll try diffing (*) it with the old tarball for ‘suspiciousness’
> (e.g.: obvious malware, new bundling, ???).

When scrolling through the diff, nothing looked ‘suspect’ at first
glance. However, I did notice something else: some parts are not
under the Ruby License, but under 2-clause BSD:

? ??? +++ ruby-2.7.4/gems/xmlrpc-0.3.0/LICENSE.txt
? ?? Files 26% similar despite different names
? ? @@ -1,13 +1,10 @@
? ? -test-unit is copyrighted free software by Kouhei Sutou
? ? -<kou@cozmixng.org>, Ryan Davis <ryand-ruby@zenspider.com>
? ? -and Nathaniel Talbott <nathaniel@talbott.ws>.
? ? -
? ? -You can redistribute it and/or modify it under either the terms of
the GPL
? ? -version 2 (see the file GPL), or the conditions below:
? ? +Ruby is copyrighted free software by Yukihiro Matsumoto
<matz@netlab.jp>.
? ? +You can redistribute it and/or modify it under either the terms of
the
? ? +2-clause BSDL (see the file BSDL), or the conditions below:

so it maybe be good to add ‘2-clause BSDL’ to the license field as well
(though given that it's an old issue, bringing the new version of ruby
in Guix has priority).

Also, looks like it bundles some autoconf scripts (config.guess), which
is not in line with
but also not priority given the security fix.

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYrygqhccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7j9OAQDduKt3FLpWZ75WJJgk4UI/8a9m
P6F02FvopBGaZmEh+wEA+Co9x/lVo9VQZzM2QFtZZ/W81PR8RBY66M1kn5qdvAU=
=qXke
-----END PGP SIGNATURE-----


M
M
Marius Bakke wrote on 29 Aug 2022 16:48
Re: [bug#56302] [PATCH v2] gnu: ruby: Update to 2.7.6 [security fixes].
87ler7ds19.fsf@gnu.org
Remco van 't Veer <remco@remworks.net> skriver:

Toggle quote (5 lines)
> Includes fixes for: CVE-2022-28739, CVE-2021-41816, and CVE-2021-41817.
>
> * gnu/packages/ruby.scm (ruby-2.7-fixed): New variable.
> (ruby-2.7)[replacement]: Graft.

Applied, thanks!
-----BEGIN PGP SIGNATURE-----

iIUEARYKAC0WIQRNTknu3zbaMQ2ddzTocYulkRQQdwUCYwzR0w8cbWFyaXVzQGdu
dS5vcmcACgkQ6HGLpZEUEHcUqwD/f7w31C08DINoEmGZ+EMTtNOA+AmeMT45l7/g
yjsYiQUA/iZTPfqCyPh/a6j8nNzDiqp61wCNUPPc8e+7BpKWxswL
=0PPU
-----END PGP SIGNATURE-----

Closed
M
M
Marius Bakke wrote on 29 Aug 2022 16:51
Re: [bug#56302] [PATCH] gnu: ruby: Update to 2.7.6 [security fixes].
87fshfdrwc.fsf@gnu.org
Maxime Devos <maximedevos@telenet.be> skriver:

Toggle quote (40 lines)
> Maxime Devos schreef op wo 29-06-2022 om 20:29 [+0200]:
>> Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
>> > +        
>> "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
>>
>> This matches with a local
>>
>> $ guix download
>> https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’
>>
>> and with all the hashes from
>> <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>.
>>
>> I'll try diffing (*) it with the old tarball for ‘suspiciousness’
>> (e.g.: obvious malware, new bundling, ???).
>
> When scrolling through the diff, nothing looked ‘suspect’ at first
> glance. However, I did notice something else: some parts are not
> under the Ruby License, but under 2-clause BSD:
>
> ? ??? +++ ruby-2.7.4/gems/xmlrpc-0.3.0/LICENSE.txt
> ? ?? Files 26% similar despite different names
> ? ? @@ -1,13 +1,10 @@
> ? ? -test-unit is copyrighted free software by Kouhei Sutou
> ? ? -<kou@cozmixng.org>, Ryan Davis <ryand-ruby@zenspider.com>
> ? ? -and Nathaniel Talbott <nathaniel@talbott.ws>.
> ? ? -
> ? ? -You can redistribute it and/or modify it under either the terms of
> the GPL
> ? ? -version 2 (see the file GPL), or the conditions below:
> ? ? +Ruby is copyrighted free software by Yukihiro Matsumoto
> <matz@netlab.jp>.
> ? ? +You can redistribute it and/or modify it under either the terms of
> the
> ? ? +2-clause BSDL (see the file BSDL), or the conditions below:
>
> so it maybe be good to add ‘2-clause BSDL’ to the license field as well
> (though given that it's an old issue, bringing the new version of ruby
> in Guix has priority).

It would be good to do a proper license audit of the bundled gems in
Ruby. I see the previous version was not the Ruby license either, but
GPL, and it's not listed among the licenses.
-----BEGIN PGP SIGNATURE-----

iIUEARYKAC0WIQRNTknu3zbaMQ2ddzTocYulkRQQdwUCYwzSgw8cbWFyaXVzQGdu
dS5vcmcACgkQ6HGLpZEUEHf3ygEAyt0NjB3RfsVng+6/u8Cc0UxZ/dU9/drBASEg
2pXDlBIBAJkhMYemLaOGvGnzoi93+C7cLaHt4lYNudv+7PhdveQA
=/cQq
-----END PGP SIGNATURE-----

?