ace-lab 0.14.0 → 0.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c2b81c8fa6e9c3e9838a696ccb0813d28e2a18f7cd46f49e724cc3122cb7ed5
-  data.tar.gz: 1b5338586438ce21609dad591ddd740d1fe4277f7d997f4c84eb7a0a097c8f6a
+  metadata.gz: a3291bf80fb998a68f1e58c0427dfcaa77e8392761b329db1a637700037f3dfb
+  data.tar.gz: 657770601dfa66713d0f0b0de8fb6b9434348a236c486a111f46b8e8df75784c
 SHA512:
-  metadata.gz: 803eb4a258b8776e6dc07e98ce77fe58f903236e68bfb486d1bb785b7d888128649a151d637b1b6e5f710a8574c5f1b13238148ae43c9cae83d9501543dbdb19
-  data.tar.gz: 327c1a76590d7b5695545c1003c4ad97d6638b73287524f0fc51464837f5e4524f915e1e3828f23b89e4d4fdac776d64531f5270ec375444dca5b8aa7d651a5f
+  metadata.gz: 3e3cb3595c7042859c5bd9b7dbe721657a614fffbeeac2a6c422d7607ca0ad0510460f68085a802eaacb71a60c723ba98301d3e44a13e7090f36d4e88c766069
+  data.tar.gz: e6dd9400e2424f955b178c394c042ce9b1a4aa42f7a854c6bdbd6965d9d43038fccc6d2a732a2e92896d5ec4f3737672578dc478e9996ea503e5606290bfcc92

data/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.14.1] - 2026-10-31
+
+### Fixed
+
+- Converge public installed gem payload permissions for shared operational
+  runtimes, including resolved dependencies and native extension outputs.
+  Validate cached archive identity and archive-owned payload paths before changes; preserve unknown files
+  and reject symlink escapes, with identical dry-run inventory validation.
+
 ## [0.14.0] - 2026-10-30
 
 ### Fixed

data/lib/ace/lab/molecules/gem_payload_permissions.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "rbconfig"
+require "find"
+
+module Ace
+  module Lab
+    module Molecules
+      # Installed specifications select identity; cached gem archives own payload
+      # membership (installed gemspecs omit files). No recursive runtime sweep.
+      class GemPayloadPermissions
+        class Error < StandardError; end
+        INVENTORY = <<~'CODE'
+          require 'json'
+          require 'rubygems'
+          require 'rubygems/package'
+          home = ARGV.shift
+          Gem.use_paths(home)
+          queue = [Gem::Specification.find_by_name(ARGV.shift, ARGV.shift)]
+          dry_run = ARGV.shift == "dry-run"
+          seen = {}; rows = []
+          until queue.empty?
+            spec = queue.shift
+            next if seen[spec.full_name]
+            seen[spec.full_name] = true
+            unless spec.default_gem?
+              cache = File.join(home, "cache", "#{spec.full_name}.gem")
+              unless File.file?(cache) && !File.symlink?(cache) && !File.symlink?(File.dirname(cache))
+                puts JSON.generate(error: "installed gem payload cache missing or symlinked: #{cache}")
+                exit 1
+              end
+              package = Gem::Package.new(cache)
+              package.verify
+              unless package.spec.full_name == spec.full_name
+                puts JSON.generate(error: "installed gem payload cache identity mismatch: #{cache}")
+                exit 1
+              end
+              rows << {root: spec.full_gem_path, spec: spec.loaded_from,
+                files: package.contents, executables: spec.executables,
+                bindir: spec.bindir, extension: spec.extensions.empty? ? nil : spec.extension_dir}
+            end
+            spec.runtime_dependencies.each do |dep|
+              begin
+                queue << dep.to_spec
+              rescue Gem::MissingSpecError
+                # Convergence already predicts installing absent dependencies.
+                # Validate the existing payload; do not invent future files.
+                raise unless dry_run
+              end
+            end
+          end
+          puts JSON.generate(rows)
+        CODE
+
+        def initialize(gem_home:, dry_run:, privileged:)
+          @declared_home = File.expand_path(gem_home)
+          raise Error, "gem runtime is a symlink" if File.symlink?(@declared_home)
+          @home = File.realpath(@declared_home)
+          @dry_run, @privileged = dry_run, privileged
+        end
+
+        def call(name:, version:)
+          # Default Ruby gems need no mutation in this runtime. With no local
+          # specifications there cannot be any owned installed payload here.
+          return [] unless File.directory?(File.join(@home, "specifications"))
+
+          env = ENV.keys.grep(/\ABUNDLE/).to_h { |key| [key, nil] }
+          env.merge!("RUBYOPT" => nil, "RUBYLIB" => nil, "GEM_HOME" => @home, "GEM_PATH" => @home)
+          out, _err, status = Open3.capture3(env, RbConfig.ruby, "-e", INVENTORY, @home, name, version, @dry_run ? "dry-run" : "apply")
+          unless status.success?
+            detail = begin
+              JSON.parse(out)["error"]
+            rescue JSON::ParserError
+              nil
+            end
+            raise Error, detail || "could not inventory installed gem payload #{name} #{version}"
+          end
+
+          converge(JSON.parse(out))
+        rescue SystemCallError, JSON::ParserError => e
+          raise Error, "gem payload permission convergence failed (#{e.class})"
+        end
+
+        def converge(rows)
+          paths = {}
+          executables = []
+          rows.each do |row|
+            root = validate(row.fetch("root"))
+            raise Error, "invalid installed gem root" unless File.dirname(root) == File.join(@home, "gems")
+            spec = validate(row.fetch("spec"))
+            raise Error, "invalid installed gem specification" unless File.dirname(spec) == File.join(@home, "specifications")
+            add(paths, spec)
+            row.fetch("files").each { |file| add(paths, payload_path(root, file)) }
+            row.fetch("executables").each do |exe|
+              raise Error, "invalid gem executable" unless File.basename(exe) == exe && !%w[. ..].include?(exe)
+              [payload_path(root, File.join(row.fetch("bindir"), exe)), File.join(@home, "bin", exe)].each do |path|
+                add(paths, path)
+                executables << validate(path)
+              end
+            end
+            if (extension = row["extension"])
+              extension = validate(extension)
+              raise Error, "invalid gem extension directory" unless
+                extension.start_with?(File.join(@home, "extensions") + "/") &&
+                File.basename(extension) == File.basename(root)
+              Find.find(extension) do |path|
+                validate(path)
+                add(paths, path)
+              end
+            end
+          end
+          changes = paths.filter_map do |path, stat|
+            desired = stat.directory? || executables.include?(path) || (stat.mode & 0o111).positive? ? 0o755 : 0o644
+            owner_change = @privileged && (stat.uid != 0 || stat.gid != 0)
+            next if (stat.mode & 0o7777) == desired && !owner_change
+            {"path" => path, "mode" => desired, "owner_change" => owner_change,
+             "status" => @dry_run ? "would_normalize" : "normalized"}
+          end
+          # Inventory validation is complete before the first mutation.
+          unless @dry_run
+            changes.each do |change|
+              path = validate(change.fetch("path"))
+              current = File.lstat(path)
+              original = paths.fetch(path)
+              raise Error, "gem payload changed during permission convergence: #{path}" unless
+                current.ino == original.ino && current.dev == original.dev && !current.symlink?
+              File.chown(0, 0, path) if change["owner_change"]
+              File.chmod(change.fetch("mode"), path)
+            end
+          end
+          changes
+        end
+
+        private
+
+        def payload_path(root, relative)
+          path = File.expand_path(relative, root)
+          raise Error, "gem payload escapes specification root" unless path.start_with?(root + "/")
+          path
+        end
+
+        def validate(path)
+          path = File.expand_path(path)
+          if path == @declared_home || path.start_with?(@declared_home + "/")
+            path = @home + path.delete_prefix(@declared_home)
+          end
+          raise Error, "gem payload escapes declared runtime: #{path}" unless path == @home || path.start_with?(@home + "/")
+          cursor = path
+          loop do
+            stat = File.lstat(cursor)
+            raise Error, "gem payload symlink refused: #{cursor}" if stat.symlink?
+            raise Error, "unsupported gem payload: #{cursor}" unless stat.file? || stat.directory?
+            break if cursor == @home
+            cursor = File.dirname(cursor)
+          end
+          path
+        end
+
+        def add(paths, path)
+          path = validate(path)
+          loop do
+            stat = File.lstat(path)
+            raise Error, "hardlinked gem payload refused: #{path}" if stat.file? && stat.nlink > 1
+            paths[path] = stat
+            break if path == @home
+            path = File.dirname(path)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/gemset_provisioner.rb

@@ -3,6 +3,7 @@
 require_relative "../errors"
 require "open3"
 require "fileutils"
+require_relative "gem_payload_permissions"
 
 module Ace
   module Lab
@@ -210,7 +211,12 @@ module Ace
           closure = converge_closure(gem, gem_home)
           return report.merge("status" => "failed", "message" => closure) if closure.is_a?(String)
           report["closure"] = closure
+          permissions = GemPayloadPermissions.new(gem_home: gem_home, dry_run: @dry_run,
+            privileged: @privileged.call).call(name: gem["name"], version: gem["version"])
+          report["permissions"] = permissions
           report
+        rescue GemPayloadPermissions::Error => e
+          report.merge("status" => "failed", "message" => e.message)
         end
 
         # @return [Array<Hash>, String] per-version removal reports or a

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.14.0"
+    VERSION = "0.14.1"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.14.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-30 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -212,6 +212,7 @@ files:
 - lib/ace/lab/molecules/extension_provisioner.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
+- lib/ace/lab/molecules/gem_payload_permissions.rb
 - lib/ace/lab/molecules/gemset_provisioner.rb
 - lib/ace/lab/molecules/grant_provisioner.rb
 - lib/ace/lab/molecules/grant_resolver.rb