[pull] master from ruby:master - #1327
Merged
Merged
Conversation
A cooldown period excludes gem versions published within the last N days from installation and update, as a mitigation against supply chain attacks through freshly published releases. This adds the configuration mechanism: the Gem::Cooldown judgment class, the :cooldown: gemrc setting, and the --cooldown DAYS option mixin. The --cooldown option takes precedence over gemrc, and 0 disables the cooldown. Versions with an unknown publish time are never excluded, so the cooldown fails open. ruby/rubygems@ed07390c7e Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The resolver drops release candidates published within the cooldown period, alongside the platform and required_ruby_version filters, so gem install falls back to the newest version outside the window. Installed and lockfile specifications carry no publish time and are never dropped. When an explicitly requested version is within the window, resolution fails with a hint naming the cooldown period and the --cooldown 0 bypass. Sources that provide no publish times at all warn once and are not filtered. ruby/rubygems@61ef01ef38 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gem update installs the resolved version with an exact pin, so the resolver filter cannot make it fall back. Filter instead when picking the target name tuple, using the new Gem::Source#created_at, which looks up a version's publish time through the compact index info file for the gem. While a cooldown is active the update and outdated lookups search the full index instead of the latest-only index, which carries nothing to fall back to. gem outdated picks the newest version outside the cooldown period as the update candidate and annotates a newer version still within the period with "(cooldown Nd)". ruby/rubygems@c32396ac8a Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The tuple selection and resolver filters already apply to rubygems-update, so gem update --system needs no dedicated code path. Add coverage that the newest release within the cooldown period is passed over in favor of the newest one outside it. ruby/rubygems@e29aac0147 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… and update Without a summary, a version the cooldown kept out is indistinguishable from a version that does not exist, which reads as environments resolving different versions for no visible reason. Match the Bundler summary added in #9762: after a completed install or update, report per gem the newest skipped version, when it will become available, and the version resolved instead. The resolver accumulates skipped candidates and reports only those newer than the resolved version and satisfying the final requirements. gem update also reports skipped name tuples newer than the version the update settled on. gem outdated already annotates versions within the window, so it gets no summary. ruby/rubygems@8f6e62658c Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…does not exist Gem::Uninstaller#initialize called File.realpath on Gem.dir, which raises Errno::ENOENT when only user-installed gems exist. Skip the realpath resolution when the directory is missing, as already done for Gem.user_dir. ruby/rubygems#9149 ruby/rubygems@488da16da5 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rocess EndpointSpecification#load_paths goes through full_require_paths, which reads raw_require_paths, so it reported "<gem>/lib" regardless of what the installed gemspec declares. Also drop source caches after install, since a resolution happening after that point would otherwise materialize against a pre-install snapshot of installed gems. Fixes ruby/rubygems#9781. ruby/rubygems@f247c6429d Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…install message The "1.0.0" assertion was subsumed by the "Installing unusual_paths 1.0.0" line, so it could not detect a load failure on its own. ruby/rubygems@48717bd339 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port #11917 to ZJIT.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )