envameleon 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71067c7187ac66066961bb5ae52346bdfa7dd72a11b7506b25f728ac4c81a64d
-  data.tar.gz: d1dc5952b9fb0c501750c0655d905792b9bafe45a31c9a21af7f5ffe0b58cbdf
+  metadata.gz: a494de9062b6ee90d21cb2f3d95560ab4d7816a244e65fb3a7397fc9783583eb
+  data.tar.gz: 763a80b9220b29341d71b42b1df2a36e72e0491e9cea5567a7dc268698a8bcc4
 SHA512:
-  metadata.gz: b6492dd83fabd4f3d3e261bb4fcfa4fc16ee15c9d0c6f688b282b5a089dc4fff3512480904c32800ef6c9c7115e9c4d739f24ac2195587458b1a9d832feab392
-  data.tar.gz: c98a6dd250a633190cd3326a8f425d62902023e8855982db5430c33b7844a22a9e21e29586b221326a3070345910c84f5a8916ca5879f9149aa2cf1f76b62fef
+  metadata.gz: 7e2d6d9d3ffff7090e09b710949827047b2a9e1a404707e2a45f03f498be5c8147a3378b747ee191ed2eccd120d6b14e6f408490f5dbeded6522b5300aa5d0eb
+  data.tar.gz: eb1903816fdeab2c866ef09561adef82676ba89f9d4e6a375420315358fb8483bc385fb1033a483130e2f8166328bf46b09f8fb291e59288aa94dbadb1b77afb

data/README.md

@@ -19,6 +19,7 @@
 
 - [About](#about)
 - [Getting Started](#getting-started)
+- [Native Gems](#native-gems)
 - [Usage](#usage)
 - [How It Works](#how-it-works)
 - [Process Inheritance](#process-inheritance)
@@ -56,7 +57,7 @@ app chooses when to call one of its three methods.
 - Linux for changes to `/proc/self/environ`
 - The Linux `CAP_SYS_RESOURCE` right only for `ENV.drop_proc_data`
 
-On other systems, all three methods are safe no-ops.
+On macOS and Windows, all three methods are safe no-ops.
 
 ### Installation
 
@@ -80,6 +81,35 @@ require "envameleon"
 
 [Back to top](#readme-top).
 
+## Native Gems
+
+ENVameleon publishes precompiled native gems for its supported CRuby minors on:
+
+- GNU/Linux and musl Linux on x86-64 and AArch64
+
+The macOS and Windows gems contain the documented pure-Ruby no-ops. There is no
+native code to compile on those systems. Linux is split into `-linux-gnu` and
+`-linux-musl` gems so a glibc binary is never mistaken for a musl binary. These
+native gems require RubyGems 3.3.22 or newer; musl users should use Bundler
+2.5.6 or newer.
+
+Each precompiled Linux gem contains a separate binary for every supported Ruby
+minor and has no extension build hook. When Linux runs a newer Ruby API,
+RubyGems or Bundler selects the generic source gem instead. That gem runs
+`extconf.rb` and requires a C compiler, Make, and the Ruby headers. macOS and
+Windows continue to select their compiler-free no-op gems. If neither a native
+nor source fallback applies on Linux, `require "envameleon"` fails closed
+instead of silently exposing the process environment.
+
+Every GitHub release includes the gems and `SHA256SUMS`. Release gems also have
+GitHub build-provenance attestations, which can be checked with:
+
+```console
+gh attestation verify envameleon-0.2.0-x86_64-linux-gnu.gem --repo kpumuk/envameleon
+```
+
+[Back to top](#readme-top).
+
 ## Usage
 
 ```ruby
@@ -213,21 +243,34 @@ overwrites the old proc range, but a secret may still exist elsewhere.
 
 ## Development
 
-Build the native extension and run the `test/unit` suite:
+Install the checksum-locked development bundle and run the `test/unit` suite.
+The test task compiles the extension on Linux and exercises the pure-Ruby no-ops
+elsewhere:
 
 ```console
-ruby -Cext/envameleon extconf.rb
-make -C ext/envameleon
-ruby -Ilib -Iext test/test_envameleon.rb
+bundle install
+bundle exec rake test
+bundle exec rake standard
 ```
 
 On Linux, the drop test runs when `CAP_SYS_RESOURCE` is available. Otherwise,
 that one test is omitted.
 
-Build the gem with:
+Build the macOS and Windows no-op gems and the Linux source fallback with:
+
+```console
+bundle exec rake gem
+```
+
+Native builds run inside the versioned image selected by the
+checksum-locked `rake-compiler-dock` gem. The image installs the exact Bundler
+version recorded in `Gemfile.lock`; Bundler then validates its own locked
+checksum and installs every other dependency from the prepared local cache:
 
 ```console
-gem build envameleon.gemspec
+bundle cache --all-platforms
+bundle exec rake gem:x86_64-linux-gnu
+ruby .github/scripts/verify_native_gem.rb pkg/envameleon-0.2.0-x86_64-linux-gnu.gem x86_64-linux-gnu
 ```
 
 ## License

data/ext/envameleon/envameleon.c

@@ -7,7 +7,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
-#include <linux/prctl.h>
 
 static void
 read_env_range(unsigned long *env_start, unsigned long *env_end)
@@ -16,22 +15,26 @@ read_env_range(unsigned long *env_start, unsigned long *env_end)
     char *field;
     char *end;
     FILE *file = fopen("/proc/self/stat", "r");
+    int error = 0;
     int number;
+    size_t length;
 
     if (file == NULL)
         rb_sys_fail("fopen(/proc/self/stat)");
 
-    if (fgets(stat, sizeof(stat), file) == NULL) {
-        int error = errno;
-        fclose(file);
-        if (error != 0) {
-            errno = error;
-            rb_sys_fail("fgets(/proc/self/stat)");
-        }
-        rb_raise(rb_eRuntimeError, "empty /proc/self/stat");
-    }
+    length = fread(stat, 1, sizeof(stat), file);
+    if (ferror(file))
+        error = errno == 0 ? EIO : errno;
     fclose(file);
 
+    if (error != 0)
+        rb_syserr_fail(error, "fread(/proc/self/stat)");
+    if (length == sizeof(stat))
+        rb_raise(rb_eRuntimeError, "/proc/self/stat is too large");
+    if (length == 0)
+        rb_raise(rb_eRuntimeError, "empty /proc/self/stat");
+    stat[length] = '\0';
+
     field = strrchr(stat, ')');
     if (field == NULL || field[1] != ' ')
         rb_raise(rb_eRuntimeError, "invalid /proc/self/stat");
@@ -98,16 +101,15 @@ mask_proc_data(VALUE environment)
         size_t remaining = (char *)env_end - entry;
         char *terminator = memchr(entry, '\0', remaining);
         char *equals;
-        char *value;
-        size_t value_length;
 
         if (terminator == NULL)
             rb_raise(rb_eRuntimeError, "invalid environment data");
 
         equals = memchr(entry, '=', terminator - entry);
         if (equals != NULL) {
-            value = equals + 1;
-            value_length = terminator - value;
+            char *value = equals + 1;
+            size_t value_length = terminator - value;
+
             if (value_length > 2)
                 memset(value + 1, '*', value_length - 2);
         }
@@ -154,7 +156,7 @@ drop_proc_data(VALUE environment)
 }
 #endif
 
-void
+RUBY_FUNC_EXPORTED void
 Init_envameleon(void)
 {
     ID environment_id = rb_intern2("ENV", 3);

data/ext/envameleon/extconf.rb

@@ -2,4 +2,24 @@
 
 require "mkmf"
 
+append_cflags %w[
+  -Wall
+  -Wextra
+  -Wformat=2
+  -Werror=format-security
+  -Werror=implicit-function-declaration
+  -fstack-protector-strong
+  -fvisibility=hidden
+]
+
+if RUBY_PLATFORM.include?("linux")
+  append_cflags "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
+
+  append_ldflags %w[
+    -Wl,-z,noexecstack
+    -Wl,-z,now
+    -Wl,-z,relro
+  ]
+end
+
 create_makefile("envameleon/envameleon")

data/lib/envameleon/noop.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+ENV.define_singleton_method(:scrub_proc_data) { nil }
+ENV.define_singleton_method(:mask_proc_data) { nil }
+ENV.define_singleton_method(:drop_proc_data) { nil }

data/lib/envameleon.rb

@@ -1,7 +1,30 @@
 # frozen_string_literal: true
 
-module ENVameleon
-  VERSION = "0.1.0"
-end
+require "rbconfig"
+
+ruby_api_version = RUBY_VERSION[/\A\d+\.\d+/]
+native_extension = File.expand_path(
+  "envameleon/#{ruby_api_version}/envameleon.#{RbConfig::CONFIG.fetch("DLEXT")}",
+  __dir__
+)
+development_extension = File.expand_path(
+  "envameleon/envameleon.#{RbConfig::CONFIG.fetch("DLEXT")}",
+  __dir__
+)
 
-require "envameleon/envameleon"
+if RbConfig::CONFIG.fetch("host_os").include?("linux")
+  extension = [native_extension, development_extension].find { |path| File.file?(path) }
+  if extension
+    require extension
+  else
+    begin
+      require "envameleon/envameleon"
+    rescue LoadError => error
+      raise unless error.path == "envameleon/envameleon"
+
+      raise LoadError, "ENVameleon has no native extension for Ruby #{ruby_api_version} on #{RUBY_PLATFORM}"
+    end
+  end
+else
+  require_relative "envameleon/noop"
+end

metadata

@@ -1,14 +1,84 @@
 --- !ruby/object:Gem::Specification
 name: envameleon
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Dmytro Shteflyuk
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies: []
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.2'
+- !ruby/object:Gem::Dependency
+  name: rake-compiler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.3.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.3.1
+- !ruby/object:Gem::Dependency
+  name: rake-compiler-dock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.12'
+- !ruby/object:Gem::Dependency
+  name: standard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.56'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.56'
+- !ruby/object:Gem::Dependency
+  name: test-unit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.7'
 description: Scrub, mask, or drop Linux's /proc/self/environ view without changing
   Ruby's ENV.
 executables: []
@@ -18,13 +88,17 @@ extra_rdoc_files: []
 files:
 - LICENSE.txt
 - README.md
-- assets/envameleon.png
 - ext/envameleon/envameleon.c
 - ext/envameleon/extconf.rb
 - lib/envameleon.rb
+- lib/envameleon/noop.rb
+homepage: https://github.com/kpumuk/envameleon
 licenses:
 - MIT
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/kpumuk/envameleon/issues
+  rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/kpumuk/envameleon
 rdoc_options: []
 require_paths:
 - lib
@@ -32,14 +106,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Leave no ENVidence.
 test_files: []