ruby-sig August 2024

ruby-sig@lists.fedoraproject.org

3 participants
4 discussions

SPDX Status for Rubygems in Fedora as of 2024-08-29
by Jarek Prokop 30 Aug '24

30 Aug '24

Hi all, end of August is here, and with it a new report for the SPDX rubygems status. Regards, Jarek * Total rubygems in Fedora: 446 * Excluded gems: rubygem-krb5-auth rubygem-rgen rubygem-net-irc * Total rubygems checked: 440 * Fedora License field and gem2rpm license match and license-validate succeeds: 298/440 * license-validate says they are OK SPDX, but licenses may or may not match between Fedora and upstream: 414/440 * license-validate with converted conjunctions: 414/440 * Action required: 25/440 Packages that need to convert to valid SPDX: rubygem-, fedora_license rubygem-ansi, BSD rubygem-bcrypt, MIT and Public Domain and ISC rubygem-bcrypt_pbkdf,MIT and BSD and ISC rubygem-cookiejar, BSD rubygem-ffi, BSD rubygem-hashery, BSD rubygem-hiredis, BSD rubygem-httpclient, (Ruby or BSD) and Public Domain rubygem-idn, ASL 2.0 and LGPLv2+ rubygem-macaddr, Ruby or BSD rubygem-marcel, MIT and ASL 2.0 rubygem-narray, BSD and Ruby rubygem-ncursesw, LGPLv2+ rubygem-open4, BSD or Ruby rubygem-rack, MIT and BSD rubygem-rchardet, LGPLv2 rubygem-rdoc, GPL-2.0 AND Ruby AND BSD-3-Clause AND CC-BY-2.5 AND OFL-1.1-RFN rubygem-rmail, BSD rubygem-ruby-libvirt,LGPLv2+ rubygem-ruby-shadow, Public Domain rubygem-sassc-rails, MIT and OFL rubygem-scanf, BSD rubygem-uuid, MIT or CC-BY-SA rubygem-xmlparser, GPLv2+ and ( Ruby or GPLv2+ or MIT ) and ( GPLv2+ or Artistic ) rubygem-xmlrpc, Ruby or BSD Package author list: package, owner(, other contributors) rubygem-ansi: stevetraylen rubygem-bcrypt: vondruch, ruby-packagers-sig rubygem-bcrypt_pbkdf: pvalena rubygem-cookiejar: pvalena, ruby-packagers-sig rubygem-ffi: vondruch, ruby-packagers-sig, tdawson rubygem-hashery: pvalena, ruby-packagers-sig rubygem-hiredis: pvalena, tdawson rubygem-httpclient: tdawson, brandfbb, maxamillion, rcallicotte rubygem-idn: spstarr, tdawson rubygem-macaddr: valtri rubygem-marcel: pvalena, ruby-packagers-sig rubygem-narray: besser82 rubygem-ncursesw: dcallagh rubygem-open4: vondruch, tdawson rubygem-rack: pvalena, ruby-packagers-sig, vondruch, tdawson rubygem-rchardet: stevetraylen rubygem-rdoc: vondruch, ruby-packagers-sig rubygem-rmail: dcallagh rubygem-ruby-libvirt: vondruch, ruby-packagers-sig, clalance, tdawson rubygem-ruby-shadow: terjeros, ignatenkobrain rubygem-sassc-rails: pvalena rubygem-scanf: ekohl, brandfbb rubygem-uuid: valtri rubygem-xmlparser: schwicke rubygem-xmlrpc: pvalena

2 1

minitest 5.25.0 update pending
by Mamoru TASAKA 19 Aug '24

19 Aug '24

Hello, ruby-sig folks: Today minitest 5.25.0 is released. I tried rebuilding all rubygem-foo packages, and it seems this breaks: * rubygem-puma * rubygem-actionpack * rubygem-actionview * rubygem-activesupport * rubygem-railties All these seems due to: https://github.com/minitest/minitest/commit/8cd3b1c749c778038ead3ddf7894dc1… and this issue is reported below at the moment: https://github.com/minitest/minitest/issues/1007 For now I am going to stay this new minitest unpushed to rawhide/F41. Regards, Mamoru

2 2

Re: Is CVE-2024-27281 affecting also 2.x?
by Vít Ondruch 19 Aug '24

19 Aug '24

(Adding ruby-maint ML into CC) Folks, could somebody help Borja find the answers sooner then me? I have to go through my backlog after a few days of PTO. Thx Vít Dne 19. 08. 24 v 7:21 Borja Tarraso Hueso napsal(a): > Hi Vit, > > This is Borja Tarraso from Red Hat Product SecurityI am looking to > determine if ruby 2.x is vulnerable for CVE-2024-27281? > > In the ruby page, it states the affected versions are 3.0.6 or lower: > https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/ > <https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/>The > version that puppet is using (ruby 2.7.8p225), it states that 2.7.8 is > the last version and vulnerabilities will not be addressed anymore: > https://ruby-lang.org/en/news/2023/03/30/ruby-2-7-8-released/ > <https://ruby-lang.org/en/news/2023/03/30/ruby-2-7-8-released/> : > "After this release, Ruby 2.7 reaches EOL. In other words, this is > expected to be the last release of Ruby 2.7 series. We will not > release Ruby 2.7.9 even if a security vulnerability is found (but > could release if a severe regression is found). We recommend all Ruby > 2.7 users to start migration to Ruby 3.2, 3.1, or 3.0 immediately." > Though this is not RH, Ubuntu has found that 2.x is also affected: > https://ubuntu.com/security/CVE-2024-27281 > <https://ubuntu.com/security/CVE-2024-27281>. So I am unsure if > CVE-2024-27281 only affects ruby package 3.x only and not 2.x. > > But after looking at it a bit more, I think the issue is just > impacting ruby 3.0.x as here is the fix: > https://github.com/ruby/ruby/commit/ffdf0232efd4955a234955c8372885b850fcfe33 > <https://github.com/ruby/ruby/commit/ffdf0232efd4955a234955c8372885b850fcfe33>In > ruby 2.7 we do not do *load_file_unsafe* but just *load_file*: > https://github.com/ruby/ruby/blob/1f4d4558484b370999954f3ede7e3aa3a3a01ef3/… > <https://github.com/ruby/ruby/blob/1f4d4558484b370999954f3ede7e3aa3a3a01ef3/…> > > Then by running git-blame I noticed this was introduced via this > commit and this person 3 years ago: > https://github.com/ruby/ruby/blame/70613595645fc3ae2bdde8f023728e3f10122ffb… > <https://github.com/ruby/ruby/blame/70613595645fc3ae2bdde8f023728e3f10122ffb…> > > So I think it was never implemented, back-ported, or existed in 2.x > and ruby 3.0 was already released on 2020-12-25. If you could confirm > for the matter of a sanity check? > > Regards, > -- > - Borja Tarraso > Principal Product Security Engineer > > Red Hat Nordics >

1 0

SPDX Status for Rubygems in Fedora as of 2024-08-08
by Jarek Prokop 08 Aug '24

08 Aug '24

Hi all, since the last report, a few license mass "auto translations" from callaway -> SPDX identifier happened, so we are seeing around 40 rubygems less compared to last report. Please review your packages if you haven't done so yet and ideally review whether the license is correct. Remainders are usually related to BSD license or similar "unclear" licenses that while have a single identifier under the old format, SPDX has multiple version for them that could be valid and must be manually converted. Regards, Jarek * Total rubygems in Fedora: 447 * Excluded gems: rubygem-krb5-auth rubygem-rgen rubygem-net-irc * Total rubygems checked: 441 * Fedora License field and gem2rpm license match and license-validate succeeds: 298/441 * license-validate says they are OK SPDX, but licenses may or may not match between Fedora and upstream: 415/441 * license-validate with converted conjunctions: 415/441 * Action required: 25/441 Packages that need to convert to valid SPDX: rubygem-, fedora_license rubygem-ansi, BSD rubygem-bcrypt, MIT and Public Domain and ISC rubygem-bcrypt_pbkdf,MIT and BSD and ISC rubygem-cookiejar, BSD rubygem-ffi, BSD rubygem-hashery, BSD rubygem-hiredis, BSD rubygem-httpclient, (Ruby or BSD) and Public Domain rubygem-idn, ASL 2.0 and LGPLv2+ rubygem-macaddr, Ruby or BSD rubygem-marcel, MIT and ASL 2.0 rubygem-narray, BSD and Ruby rubygem-ncursesw, LGPLv2+ rubygem-open4, BSD or Ruby rubygem-rack, MIT and BSD rubygem-rchardet, LGPLv2 rubygem-rdoc, GPL-2.0 AND Ruby AND BSD-3-Clause AND CC-BY-2.5 AND OFL-1.1-RFN rubygem-rmail, BSD rubygem-ruby-libvirt,LGPLv2+ rubygem-ruby-shadow, Public Domain rubygem-sassc-rails, MIT and OFL rubygem-scanf, BSD rubygem-uuid, MIT or CC-BY-SA rubygem-xmlparser, GPLv2+ and ( Ruby or GPLv2+ or MIT ) and ( GPLv2+ or Artistic ) rubygem-xmlrpc, Ruby or BSD Package author list: package, owner(, other contributors) rubygem-ansi: stevetraylen rubygem-bcrypt: vondruch, ruby-packagers-sig rubygem-bcrypt_pbkdf: pvalena rubygem-cookiejar: pvalena, ruby-packagers-sig rubygem-ffi: vondruch, ruby-packagers-sig, tdawson rubygem-hashery: pvalena, ruby-packagers-sig rubygem-hiredis: pvalena, tdawson rubygem-httpclient: tdawson, brandfbb, maxamillion, rcallicotte rubygem-idn: spstarr, tdawson rubygem-macaddr: valtri rubygem-marcel: pvalena, ruby-packagers-sig rubygem-narray: besser82 rubygem-ncursesw: dcallagh rubygem-open4: vondruch, tdawson rubygem-rack: pvalena, ruby-packagers-sig, vondruch, tdawson rubygem-rchardet: stevetraylen rubygem-rdoc: vondruch, ruby-packagers-sig rubygem-rmail: dcallagh rubygem-ruby-libvirt: vondruch, ruby-packagers-sig, clalance, tdawson rubygem-ruby-shadow: terjeros, ignatenkobrain rubygem-sassc-rails: pvalena rubygem-scanf: ekohl, brandfbb rubygem-uuid: valtri rubygem-xmlparser: schwicke rubygem-xmlrpc: pvalena

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

ruby-sig August 2024