[PATCH] gnu: ruby: Update to 2.7.6 [security fixes].

OpenSubmitted by Remco van 't Veer.
Details
3 participants
  • Maxime Devos
  • Tobias Geerinckx-Rice
  • Remco van 't Veer
Owner
unassigned
Severity
normal
R
R
Remco van 't Veer wrote on 29 Jun 17:55 +0200
(address . guix-patches@gnu.org)(name . Remco van 't Veer)(address . remco@remworks.net)
20220629155533.5224-1-remco@remworks.net
Includes fixes for: CVE-2022-28739, CVE-2021-41816, and CVE-2021-41817.

* gnu/packages/ruby.scm (ruby-2.7): Update to 2.7.6.
---
gnu/packages/ruby.scm | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

Toggle diff (34 lines)
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 5b65196c6c..9e1aff410f 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -28,6 +28,7 @@
 ;;; Copyright © 2021 EuAndreh <eu@euandre.org>
 ;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin@mailbox.org>
 ;;; Copyright © 2021 Giovanni Biscuolo <g@xelera.eu>
+;;; Copyright © 2022 Remco van 't Veer <remco@remworks.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -151,7 +152,7 @@ (define-public ruby-2.6
 (define-public ruby-2.7
   (package
     (inherit ruby-2.6)
-    (version "2.7.4")
+    (version "2.7.6")
     (source
      (origin
        (inherit (package-source ruby-2.6))
@@ -160,7 +161,7 @@ (define-public ruby-2.7
                            "/ruby-" version ".tar.gz"))
        (sha256
         (base32
-         "0nxwkxh7snmjqf787qsp4i33mxd1rbf9yzyfiky5k230i680jhrh"))))
+         "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
     (arguments
      `(#:test-target "test"
        #:configure-flags '("--enable-shared") ; dynamic linking

base-commit: 4bc6888f5e475e06019790c76fd20caf4cc137f4
-- 
2.36.1
R
R
Remco van 't Veer wrote on 29 Jun 17:58 +0200
Re: bug#56302: Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
(address . 56302@debbugs.gnu.org)
87a69vh377.fsf@remworks.net
Please note:

$ guix refresh --list-dependent ruby@2.7
Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ...

So this goes into core-updates.
T
T
Tobias Geerinckx-Rice wrote on 29 Jun 18:04 +0200
Re: [bug#56302] Acknowledgement ([PATCH] gn u: ruby: Update to 2.7.6 [security fixes].)
5DF7A747-FFC0-4ABA-9F81-F5DCBCCA1FE0@tobias.gr
Right, but '[security fixes]' means we (also) need to graft on master.

Would you want to give that a try?

Thanks for the patch!

T G-R

Sent on the go. Excuse or enjoy my brevity.
M
M
Maxime Devos wrote on 29 Jun 18:04 +0200
Re: [bug#56302] Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
975d34406b3e636414efdeb2ff1d7dbd4e95d944.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 17:58 [+0200]:
Toggle quote (7 lines)
> Please note:
>
>   $ guix refresh --list-dependent ruby@2.7
>   Building the following 2346 packages would ensure 6612 dependent packages are rebuilt: ...
>
> So this goes into core-updates.

core-updates probably won't be merged for a long time, so a graft might
be needed in the meantime.

Basically, what you need to do is:

* keep the old ruby@2.7.4 package definition
* add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...]))
* in ruby@2.7.4, add a field
(replacement ruby-2.7-fixed) ; security fixes

and verify that some Ruby-using dependents still seem to work.

That way, we can use a fixed ruby@2.7.6 on master.

(This assumes that ruby is graftable -- this assumes that ruby is
ABI-compatible, otherwise the grafted dependents won't work.)

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYrx4FRccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7pF2AP4nd5vGekUHj0J+E6sxWleN8HmL
nP8XZqpbziZAQiPaXAEA5iwoMwPacYHxwL0+kvnBY7CAgIWHRI5D/80mS/Tphwo=
=5aCT
-----END PGP SIGNATURE-----


R
R
Remco van 't Veer wrote on 29 Jun 18:13 +0200
(name . Maxime Devos)(address . maximedevos@telenet.be)(address . 56302@debbugs.gnu.org)
875ykjh2h9.fsf@remworks.net
2022/06/29 18:04, Maxime Devos:

Toggle quote (3 lines)
> core-updates probably won't be merged for a long time, so a graft might
> be needed in the meantime.

So, keep this bug and make a new patch / bug for the graft?

Toggle quote (14 lines)
> Basically, what you need to do is:
>
> * keep the old ruby@2.7.4 package definition
> * add a ruby@2.7.6 package (as (define-public ruby-2.7-fixed [...]))
> * in ruby@2.7.4, add a field
> (replacement ruby-2.7-fixed) ; security fixes
>
> and verify that some Ruby-using dependents still seem to work.
>
> That way, we can use a fixed ruby@2.7.6 on master.
>
> (This assumes that ruby is graftable -- this assumes that ruby is
> ABI-compatible, otherwise the grafted dependents won't work.)

Thanks for the explanation! I'll give it a try.

Cheers,
Remco
R
R
Remco van 't Veer wrote on 29 Jun 20:00 +0200
[PATCH v2] gnu: ruby: Update to 2.7.6 [security fixes].
(address . 56302@debbugs.gnu.org)
20220629180037.27919-1-remco@remworks.net
Includes fixes for: CVE-2022-28739, CVE-2021-41816, and CVE-2021-41817.

* gnu/packages/ruby.scm (ruby-2.7-fixed): New variable.
(ruby-2.7)[replacement]: Graft.
---
gnu/packages/ruby.scm | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

Toggle diff (43 lines)
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 68e5d8dfd6..0b6626bdf7 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -28,6 +28,7 @@
 ;;; Copyright © 2021 EuAndreh <eu@euandre.org>
 ;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin@mailbox.org>
 ;;; Copyright © 2021 Giovanni Biscuolo <g@xelera.eu>
+;;; Copyright © 2022 Remco van 't Veer <remco@remworks.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -152,6 +153,7 @@ (define-public ruby-2.7
   (package
     (inherit ruby-2.6)
     (version "2.7.4")
+    (replacement ruby-2.7-fixed) ; security fixes
     (source
      (origin
        (inherit (package-source ruby-2.6))
@@ -186,6 +188,20 @@ (define-public ruby-2.7
     (native-inputs
      (list autoconf))))
 
+(define ruby-2.7-fixed
+  (package
+    (inherit ruby-2.7)
+    (version "2.7.6")
+    (source
+     (origin
+       (inherit (package-source ruby-2.7))
+       (uri (string-append "https://cache.ruby-lang.org/pub/ruby/"
+                           (version-major+minor version)
+                           "/ruby-" version ".tar.gz"))
+       (sha256
+        (base32
+         "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))))
+
 (define-public ruby-3.0
   (package
     (inherit ruby-2.7)
-- 
2.36.1
M
M
Maxime Devos wrote on 29 Jun 20:18 +0200
Re: [bug#56302] Acknowledgement ([PATCH] gnu: ruby: Update to 2.7.6 [security fixes].)
(name . Remco van 't Veer)(address . remco@remworks.net)(address . 56302@debbugs.gnu.org)
c2c8209c614d12b7cec0c076ba81284b5e36774b.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 18:13 [+0200]:
Toggle quote (7 lines)
> 2022/06/29 18:04, Maxime Devos:
>
> > core-updates probably won't be merged for a long time, so a graft might
> > be needed in the meantime.
>
> So, keep this bug and make a new patch / bug for the graft?

I'd keep the 56302 to keep things orderly. FWIW, while they can be
reviewed and applied independently, the various Ruby update patches are
all about the same thing (updating Ruby), so they could have been done
together I think (separate patches, but a single series and single
debbugs number).

TBC: to keep things orderly, let's not make a new issue with a patch
series, it's more a thing I would recommend for the future.

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYryXihccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7o+YAQDGBZ9A4Q5/3ImgYs8H64sOOnEb
mFwrfcnXqngsKho5aAD/WVkr9bUua/89o0tcGbW1SkHPExSz8LPAinPNmoBWvws=
=He4u
-----END PGP SIGNATURE-----


M
M
Maxime Devos wrote on 29 Jun 20:29 +0200
Re: [bug#56302] [PATCH] gnu: ruby: Update to 2.7.6 [security fixes].
3edebb176b620a66a47b013a332c9683322e1a8d.camel@telenet.be
Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
Toggle quote (2 lines)
> +         "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))

This matches with a local



I'll try diffing (*) it with the old tarball for ‘suspiciousness’
(e.g.: obvious malware, new bundling, ???).

Greetings,
Maxime

(*) diffoscope can be useful, albeit a bit slow at time.
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYryaGBccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7pJdAPkBEb6u180e28+wRZgfp9hTuiAt
i+CYetjqnvQU8xO1xAD/e0yv/ccix6gGCRgH6cEz9SJJyR3T8U+Ylg07NrVDAQM=
=rgOc
-----END PGP SIGNATURE-----


M
M
Maxime Devos wrote on 29 Jun 20:57 +0200
e7cff471ceddf9b590998305321c6daebfab6f82.camel@telenet.be
Maxime Devos schreef op wo 29-06-2022 om 20:29 [+0200]:
Toggle quote (15 lines)
> Remco van 't Veer schreef op wo 29-06-2022 om 17:55 [+0200]:
> > +        
> "042xrdk7hsv4072bayz3f8ffqh61i8zlhvck10nfshllq063n877"))))
>
> This matches with a local
>
> $ guix download
> https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.6.tar.gz’
>
> and with all the hashes from
> <https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/>.
>
> I'll try diffing (*) it with the old tarball for ‘suspiciousness’
> (e.g.: obvious malware, new bundling, ???).

When scrolling through the diff, nothing looked ‘suspect’ at first
glance. However, I did notice something else: some parts are not
under the Ruby License, but under 2-clause BSD:

│ ├── +++ ruby-2.7.4/gems/xmlrpc-0.3.0/LICENSE.txt
│ │┄ Files 26% similar despite different names
│ │ @@ -1,13 +1,10 @@
│ │ -test-unit is copyrighted free software by Kouhei Sutou
│ │ -<kou@cozmixng.org>, Ryan Davis <ryand-ruby@zenspider.com>
│ │ -and Nathaniel Talbott <nathaniel@talbott.ws>.
│ │ -
│ │ -You can redistribute it and/or modify it under either the terms of
the GPL
│ │ -version 2 (see the file GPL), or the conditions below:
│ │ +Ruby is copyrighted free software by Yukihiro Matsumoto
<matz@netlab.jp>.
│ │ +You can redistribute it and/or modify it under either the terms of
the
│ │ +2-clause BSDL (see the file BSDL), or the conditions below:

so it maybe be good to add ‘2-clause BSDL’ to the license field as well
(though given that it's an old issue, bringing the new version of ruby
in Guix has priority).

Also, looks like it bundles some autoconf scripts (config.guess), which
is not in line with
but also not priority given the security fix.

Greetings,
Maxime
-----BEGIN PGP SIGNATURE-----

iI0EABYKADUWIQTB8z7iDFKP233XAR9J4+4iGRcl7gUCYrygqhccbWF4aW1lZGV2
b3NAdGVsZW5ldC5iZQAKCRBJ4+4iGRcl7j9OAQDduKt3FLpWZ75WJJgk4UI/8a9m
P6F02FvopBGaZmEh+wEA+Co9x/lVo9VQZzM2QFtZZ/W81PR8RBY66M1kn5qdvAU=
=qXke
-----END PGP SIGNATURE-----


?