summaryrefslogtreecommitdiff
path: root/lib/rubygems/package.rb
AgeCommit message (Collapse)Author
2024-05-03[rubygems/rubygems] Remove `Gem::Specification#mark_version`David Rodriguez
This gets in the middle if we ever start allowing to build as if using a different RubyGems version than the one being run. This could be useful to make `gem rebuild` a little more usable, and it's already done by Bundler specs which already make this method a noop when they need this. I'm not sure forcefully setting this, even if user explicitly specified something else is helpful. Since this could potentially prevent gems explicitly setting a constant RubyGems version from building, I changed the error of incorrect RubyGems version from a hard error to a warning, since it will start happening in those cases if we stop overwriting the version. https://github.com/rubygems/rubygems/commit/45676af80d
2024-04-30[rubygems/rubygems] Update lib/rubygems/package.rbSamuel Giddins
https://github.com/rubygems/rubygems/commit/c4e75b9f74
2024-04-30[rubygems/rubygems] Add a limit to the size of the metadata and checksums ↵Samuel Giddins
files in a gem package. This is to prevent a malicious gem from causing a denial of service by including a very large metadata or checksums file, which is then read into memory in its entirety just by opening the gem package. This is guaranteed to limit the amount of memory needed, since gzips (which use deflate streams for compression) have a maximum compression ratio of 1032:1, so the uncompressed size of the metadata or checksums file will be at most 1032 times the size of the (limited) amount of data read. This prevents a gem from causing 500GB of memory to be allocated to read a 500MB metadata file. https://github.com/rubygems/rubygems/commit/a596e3c5ec
2024-04-29[rubygems/rubygems] Fix circular require warningDavid Rodríguez
https://github.com/rubygems/rubygems/commit/241d0aafcd
2024-03-28Allow FormatError to take either String or Gem for sourceJake Zimmerman
Most of the calls to `FormatError.new` pass `@gem` for the second argument, which has a `path` method. But in one case—on package.rb:691 in `verify_gz`, the `source` argument is a `String`. So if there's ever a GZip decode error when attempting to read the contents of the `data.tar.gz` file, instead of reporting the underlying GZip error (which might be something like "unexpected end of file"), we would report instead a NoMethodError coming from package.rb ``` Exception while verifying sorbet-0.5.11301.gem ERROR: While executing gem ... (NoMethodError) undefined method `path' for "data.tar.gz":String @path = source.path ^^^^^ ``` There are two ways to fix this: 1. Make `FormatError#initialize` aware of the fact that `source` might sometimes be a `String` 2. Make the call to `FormatError.new` in `verify_gz` pass `@gem` instead of `entry.full_name`. I've chosen 1 because I think it's more useful to see "unexpected end of file in data.tar.gz" instead of "unexpected end of file in sorbet-0.5.11301.gem." The end of file **is actually** in data.tar.gz, not in the gem file itself, which was decoded successfully.
2024-03-22[rubygems/rubygems] Respect global umask when writing regular filesDavid Rodriguez
https://github.com/rubygems/rubygems/commit/fd5cb7396f
2024-01-24Revert "Ensure File.open applies default umask on gem extract"Hiroshi SHIBATA
This reverts commit 01f9766aa05182a7bbdc914a5dcd8a36ebade861.
2024-01-24Ensure File.open applies default umask on gem extractMartin Emde
2023-12-22Merge RubyGems-3.5.2 and Bundler-2.5.2Hiroshi SHIBATA
2023-12-11[rubygems/rubygems] Fewer allocations in gem installationSamuel Giddins
For now, on a small rails app I have hanging around: ``` ==> memprof.after.txt <== Total allocated: 872.51 MB (465330 objects) Total retained: 40.48 kB (326 objects) ==> memprof.before.txt <== Total allocated: 890.79 MB (1494026 objects) Total retained: 40.40 kB (328 objects) ``` Not a huge difference in memory usage, but it's a drastic improvement in total number of allocations. Additionally, this will pay huge dividends once https://github.com/ruby/zlib/pull/61 is merged, as it will allow us to completely avoid allocations in the repeated calls to readpartial, which currently accounts for most of the memory usage shown above. https://github.com/rubygems/rubygems/commit/f78d45d927
2023-12-07[rubygems/rubygems] Use modern hashes consistentlyDavid Rodríguez
https://github.com/rubygems/rubygems/commit/bb66253f2c
2023-11-13[rubygems/rubygems] Drop support for Ruby 2.6 and Ruby 2.7 in RubyGemsDavid Rodríguez
https://github.com/rubygems/rubygems/commit/10c26a483d
2023-09-11[rubygems/rubygems] Fixed include realpath in error statementnegi0109
https://github.com/rubygems/rubygems/commit/ac3b85bd5e
2023-09-11[rubygems/rubygems] Fixed false positive SymlinkError in symbolic link directorynegi0109
https://github.com/rubygems/rubygems/commit/58173ff2ea
2023-08-17[rubygems/rubygems] Raise Gem::Package::FormatError on EOF, indicating ↵Martin Emde
corrupt gem Gem::Package::TarReader::Entry now raises EOFError or returns nil appropriately based on Ruby core IO.read and IO.readpartial behavior. Zlib will respond accordingly by raising Zlib::GzipFile::Error on EOF. When verifying a gem or extracting contents, raise FormatError similar to other cases of corrupt gems. Addresses a bug where Gem::Package would attempt to call size on nil instead of raising a more descriptive and useful error, leading users to assume the problem is internal to rubygems. Remove unused error class TarReader::UnexpectedEOF that was never raised since the NoMethodError on nil would happen first. Use EOFError instead. https://github.com/rubygems/rubygems/commit/dc6129644b
2023-06-15[rubygems/rubygems] auto-correct Style/YodaConditionHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/6d9e8025dc
2023-04-11util/rubocop -A --only Style/NumericLiteralPrefixHiroshi SHIBATA
2023-04-07[rubygems/rubygems] util/rubocop -A --only Style/FormatStringHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/132a56569d
2023-03-23util/rubocop -A --only Style/AsciiCommentsHiroshi SHIBATA
Notes: Merged: https://github.com/ruby/ruby/pull/7582
2023-03-23util/rubocop -A --only Layout/EmptyLineAfterMagicCommentHiroshi SHIBATA
Notes: Merged: https://github.com/ruby/ruby/pull/7582
2023-03-23util/rubocop -A --only Lint/NonLocalExitFromIteratorHiroshi SHIBATA
Notes: Merged: https://github.com/ruby/ruby/pull/7582
2023-03-23[rubygems/rubygems] Enabled Style/RedundantReturn copHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/05cc97bdf8 Notes: Merged: https://github.com/ruby/ruby/pull/7582
2023-03-17util/rubocop -A --only Style/SymbolProcHiroshi SHIBATA
2023-03-17[rubygems/rubygems] util/rubocop -A --only Style/RescueStandardErrorHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/80b57da926
2023-03-17[rubygems/rubygems] util/rubocop -A --only Style/SelfAssignmentHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/7c1168c623
2023-03-17[rubygems/rubygems] util/rubocop -A --only Style/NumericLiteralsHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/860669b08a
2023-03-17[rubygems/rubygems] util/rubocop -A --only Style/StringLiteralsInInterpolationHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/cb554f6eb7
2023-03-17[rubygems/rubygems] util/rubocop -A --only Layout/FirstArgumentIndentationHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/0542726fd3
2023-03-17[rubygems/rubygems] util/rubocop -A --only Lint/UnusedBlockArgumentHiroshi SHIBATA
https://github.com/rubygems/rubygems/commit/d8efd919db
2022-12-26Merge RubyGems/Bundler masterHiroshi SHIBATA
from https://github.com/rubygems/rubygems/commit/72fd3dd2096af16d797ad0cd8e0d2a8869e240b3 Notes: Merged: https://github.com/ruby/ruby/pull/7025
2022-09-15[rubygems/rubygems] Mask the file mode when extracting filesKevin Newton
When extracting files from the tarball, a mode is retrieved from the header. Occasionally you'll encounter a gem that was packaged on a system whose permission bits result in a value that is larger than the value that File.chmod will allow (anything >= 2^16). In that case the extraction fails with a RangeError, which is pretty esoteric. If you extract the tarball with the tar and gunzip utilities, the file permissions end up being just the bottom 16 bits masked off from the original value. I've mirrored that behavior here. Per the tar spec: > Modes which are not supported by the operating system restoring > files from the archive will be ignored. I think that basically means what I've done here. --- This commit also changes the behavior very slightly with regard to when the chmod is called. Previously it was called while the file descriptor was still open, but after the write call. When write flushes, the file permissions are changed to the mode value from the File.open call, undoing the changes made by FileUtils.chmod. CRuby appears to flush the buffer after the chmod call, whereas TruffleRuby flushes before the chmod call. So the file permissions can change depending on implementation. Both implementations end up getting the correct file permissions for the bottom 9 bits (user, group, world), but differ with regard to the sticky bit in the next 3. To get consistent behavior, this commit changes it to close the file descriptor before attempting to chmod anything, which makes it consistent because the write flushes in both cases. https://github.com/rubygems/rubygems/commit/22ce076e99
2022-08-09Merge rubygems/bundler HEAD.Hiroshi SHIBATA
Pick from https://github.com/rubygems/rubygems/commit/dfbb5a38114640e0d8d616861607f3de73ee0199 Notes: Merged: https://github.com/ruby/ruby/pull/6224
2022-08-04[rubygems/rubygems] Warn dangling symlinksDavid Rodríguez
https://github.com/rubygems/rubygems/commit/425b78637f
2022-08-04[rubygems/rubygems] Extract entry.full_name to a variableDavid Rodríguez
https://github.com/rubygems/rubygems/commit/3973773005
2022-07-22RubyGems: Enable Style/StringLiterals copTakuya Noguchi
Signed-off-by: Takuya Noguchi <takninnovationresearch@gmail.com>
2022-03-15[rubygems/rubygems] [DOC] Enable Gem::Package exampleNobuyoshi Nakada
Other code must not be between the doc and class definition. https://github.com/rubygems/rubygems/commit/366784aae5
2022-01-19Merge rubygems/rubygems HEAD.Hiroshi SHIBATA
Picked at 12aeef6ba9a3be0022be9934c1a3e4c46a03ed3a Notes: Merged: https://github.com/ruby/ruby/pull/5462
2022-01-19[rubygems/rubygems] Normalize end alignment style with BundlerDavid Rodríguez
https://github.com/rubygems/rubygems/commit/f7f504b24c
2021-10-10[ruby/rubygems] We no longer need to check realpathsDavid Rodríguez
Since symlinks and absolute paths are already checked. https://github.com/rubygems/rubygems/commit/de19bc4c7e
2021-10-10[ruby/rubygems] Check safety of packaged symlinksDavid Rodríguez
If we explicitly disallow the creation of symlinks that point to files outside of the destination directory, we can avoid any other safety checks while creating directories, because we can be sure they will always fall under the destination directory as well. https://github.com/rubygems/rubygems/commit/555692b8de
2021-10-10[ruby/rubygems] Install location safety should consider casingDavid Rodríguez
https://github.com/rubygems/rubygems/commit/0a0ad34af3
2021-10-10[ruby/rubygems] Remove redundant `File.expand_path`David Rodríguez
`File.realpath` already expands paths. https://github.com/rubygems/rubygems/commit/25524ebbeb
2021-10-10[ruby/rubygems] Simplify `File.expand_path` usageDavid Rodríguez
https://github.com/rubygems/rubygems/commit/02e3cf44bf
2021-10-10[ruby/rubygems] Don't make duplicated checks on directory safetyDavid Rodríguez
This seems to speed up `gem install` on Windows by more than 50%. https://github.com/rubygems/rubygems/commit/1970b1296d
2021-08-31[rubygems/rubygems] Prefer `require_relative` to `require` for internal requiresDavid Rodríguez
https://github.com/rubygems/rubygems/commit/c74fc58695 Notes: Merged: https://github.com/ruby/ruby/pull/4789
2021-04-15Merge the master branch of RubyGemsHiroshi SHIBATA
Notes: Merged: https://github.com/ruby/ruby/pull/4383
2020-12-08Merge prepare version of RubyGems 3.2.0Hiroshi SHIBATA
Notes: Merged: https://github.com/ruby/ruby/pull/3864
2020-09-23Revert "Manually merged from https://github.com/rubygems/rubygems/pull/2636"Hiroshi SHIBATA
31a6eaabc165d8a222e176f2c809d90622d88ec2 is obsoleted with https://github.com/rubygems/rubygems/pull/3820
2020-09-23Manually merged from https://github.com/rubygems/rubygems/pull/2636Hiroshi SHIBATA
Enable Style/EmptyLinesAroundClassBody rubocop cop.
2020-07-31[rubygems/rubygems] Let more exceptions flowDavid Rodríguez
If any error happens while verifying a package entry, it doesn't mean that the package is corrupt. It could be a bug in rubygems, for example. This in fact happened in CI and the current error doesn't make it easy to troubleshoot the root cause, since it doesn't provide a backtrace. See https://github.com/rubygems/rubygems/pull/3807/checks?check_run_id=862526615. So I propose to let the exception happens. There was something useful about the previous message, which is the file entry where the error happened, so I'm keeping that information in a warning message. https://github.com/rubygems/rubygems/commit/ece87d858f Notes: Merged: https://github.com/ruby/ruby/pull/3379
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-14 21:40:43 +0000