gitlab-cbor 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: ea5eb261daf6b702e032472b8be3b3d3949c5d516f1625b674c193c95bcbd404
+  data.tar.gz: 242826a0aae1fe136ca397ae643104294c5a60e8f95f280ec47cecfa1713e418
+SHA512:
+  metadata.gz: 3ecd0c2c1f49069fde1345ba89c3098464a475e6ff364c7202bf7a30122a2154e711a6f7ff42167aef98066a95b1ec0e56be73b9fc194ed5795bae52bdf30472
+  data.tar.gz: 7ee9b2549b5ff605f27a01778450171529a74f9daa7325d7069a4d4441ed956171a7e2c0ecb25cb817819698a71d50e94eb49f3fa3666c08c3e61fb8189eb282

data/.gitignore

@@ -0,0 +1,25 @@
+*.o
+*.so
+*.gem
+*.class
+.bundle
+Gemfile.lock
+pkg
+test/debug.log
+*~
+/rdoc
+tmp
+.classpath
+.project
+.settings
+/nbproject/private/
+ext/java/build
+ext/java/msgpack.jar
+spec/bench*
+lib/cbor/cbor.bundle
+TAGS
+.yardoc
+doc
+ext/cbor/Makefile
+*.bundle
+mkmf.log

data/.gitlab-ci.yml

@@ -0,0 +1,44 @@
+# CI for gitlab-cbor, GitLab's security fork of the cbor gem.
+#
+# Builds the native extension, installs the gem, and runs a smoke test that
+# verifies the security behavior and a core round-trip. The publish job is
+# intentionally manual and tag-only; the gem is NOT published automatically
+# while the fix is under embargo.
+
+stages:
+  - test
+  - release
+
+.ruby-versions: &ruby-versions
+  parallel:
+    matrix:
+      - RUBY_IMAGE: ["ruby:3.2", "ruby:3.3", "ruby:3.4"]
+
+build-and-test:
+  stage: test
+  image: $RUBY_IMAGE
+  <<: *ruby-versions
+  script:
+    - ruby -v
+    - gem build gitlab-cbor.gemspec
+    - gem install ./gitlab-cbor-*.gem --no-document
+    - ruby ci/test.rb
+
+# Publishing is held until the fix is public. Run manually on a tag once the
+# advisory is out; set GEM_HOST_API_KEY (and GEM_HOST for a private registry)
+# in protected CI/CD variables.
+publish:
+  stage: release
+  image: ruby:3.3
+  rules:
+    - if: '$CI_COMMIT_TAG'
+      when: manual
+      allow_failure: true
+  script:
+    - gem build gitlab-cbor.gemspec
+    - |
+      if [ -z "${GEM_HOST_API_KEY:-}" ]; then
+        echo "GEM_HOST_API_KEY is not set; refusing to publish." >&2
+        exit 1
+      fi
+    - gem push gitlab-cbor-*.gem ${GEM_HOST:+--host "$GEM_HOST"}

data/.travis.yml

@@ -0,0 +1,24 @@
+language: ruby
+rvm:
+  - 2.0.0
+  - 2.1.10
+  - 2.2.10
+  - 2.3.8
+  - 2.4.6
+  - 2.5.5
+  - 2.6.3
+  - ruby-head
+matrix:
+  allow_failures:
+    - rvm: 2.0.0
+    - rvm: 2.1.10
+    - rvm: 2.2.10
+    - rvm: ruby-head
+
+gemfile:
+  - Gemfile
+
+script: "bundle exec rake spec"
+
+notifications:
+  irc: "irc.freenode.org#coap"

data/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog (GitLab fork)
+
+`gitlab-cbor` is GitLab's fork of the [`cbor`](https://rubygems.org/gems/cbor)
+gem. It tracks an upstream release and carries a small number of changes that
+are not yet available upstream. The gem installs the same files and defines the
+same `CBOR` module, so it is a drop-in replacement:
+
+```ruby
+gem "gitlab-cbor", require: "cbor"
+```
+
+## 1.0.0
+
+First release of the fork. Based on upstream cbor 0.6.1.1.
+
+- Do not reconstruct object-constructing CBOR tags by default.
+  Decoding tag 35 (regular expression) and tag 32 (URI) previously built a
+  `Regexp` or `URI` from the decoded value. Because `CBOR.decode` is
+  commonly run on input from untrusted sources, decoding should not build
+  those objects on its own. These tags now decode to a generic
+  `CBOR::Tagged` value. A caller that trusts the source can opt back in per
+  tag:
+
+  ```ruby
+  CBOR.decode(data)                                            # => CBOR::Tagged
+  CBOR.decode(data, reconstruct_from_tags: [CBOR::TAG_REGEXP]) # => Regexp
+  CBOR.decode(data, reconstruct_from_tags: [CBOR::TAG_URI])    # => URI
+  ```
+
+  Tag 0/1 (time) is unchanged; it is a plain value conversion.

data/ChangeLog

@@ -0,0 +1,106 @@
+2016-04-11  Carsten Bormann  <cabo@tzi.org>
+
+	* 0.5.9.1: Fix WIN32 problem inherited from upstream
+
+2014-12-13  Carsten Bormann  <cabo@tzi.org>
+
+	* 0.5.9.0: Upstream fixes; prepare for Ruby 2.2 (use GC-able
+	symbols for :keys_as_symbols, use rb_integer_pack if available)
+
+2014-12-12  Carsten Bormann  <cabo@tzi.org>
+
+	* 0.5.8.0: Upstream fixes (including {symbolize_keys: true} as an
+	alternative for :keys_as_symbols); README updates.
+
+2014-02-09  Carsten Bormann  <cabo@tzi.org>
+
+	* 0.5.6.4: Add more checking for bare indefinite breaks and
+	non-strings inside indefinite strings.
+
+2013-08-17  Carsten Bormann  <cabo@tzi.org>
+
+	* First version of CBOR variant of this code.
+
+2013-09-23 version 0.5.6:
+
+* Fixed "can't modify frozen String" exception in Unpacker with ruby 2.1.0-dev
+* Getting work with Ruby v2.0 on Windows (Thank you @thegreendroid)
+* Fixed EOFError handling in Unpacker
+
+
+2013-05-12 version 0.5.5:
+
+* Fixed SEGV problem in to_msgpack
+* Fixed a possible race condition in MessagePack.load when it loads data from IO
+* mingw32 package includes binary for ruby-2.0.0
+
+
+2013-03-15 version 0.5.4:
+
+* Added missing MessagePack::Unpacker#reset method
+
+
+2013-02-14 version 0.5.3:
+
+* Fixed segfault problem on Buffer#clear (reuse rmem internal fragment optimization)
+* Fixed segfault problem on Buffer (rmem free code)
+
+
+2013-02-07 version 0.5.2:
+
+* Fixed invalid pack/unpack on 32bit architecture such as Win32
+* Disable rmem on Rubinius because rmem is not thread safe
+
+
+2012-12-23 version 0.5.1:
+
+* Fixed compile error with Rubinius 2.0.0-dev
+* Optimized msgpack_packer_write_hash for Rubinius
+
+
+2012-12-20 version 0.5.0:
+
+* Rewrote all code and improved performance significantly
+* Added MessagePack::Buffer class
+* Added MessagePack::Packer class
+* Added Packer#buffer and Unpacker#buffer accessors which return MessagePack::Buffer
+* Added Packer#write_{array,map}_header and Unpacker#read_{array,map}_header methods
+* Added Packer#write_nil and Unpacker#skip_nil methods
+* Added Packer#write -> #pack alias and Unpacker#read method
+* Added exception classes - UnpackError, MalformedFormatError, StackError and TypeError
+* Added MessagePack.dup -> .pack and MessagePack.load -> .unpack aliases
+* Added Packer#empty?, #size and #clear methods
+* Added Packer#write_to(io) method to flush serialized data to IO efficiently
+* Added Unpacker#skip method to skip an object efficiently
+* Removed obsoleted Unpacker#fill, #execute, #execute_limit, #finished? and #data methods
+* Removed obsoleted Unapcker#stream and #stream= methods. Use unpacker.buffer.io instead
+
+
+2012-05-05 version 0.4.7:
+
+* Fixed serialization of double values on ARM OABI architectures
+* Fixed byteorder problem on big-endian platforms
+* Don't use MRI internals in the Ruby extension for Rubinius
+* Detect whether st.h is present and don't use RUBY_VM as the condition for
+  Rubinius
+
+2011-08-08 version 0.4.6:
+
+* Fixed compile error problem on Mac OS X Lion
+
+2011-05-09 version 0.4.5:
+
+* Improves compatibility with JRuby
+
+2010-11-28 version 0.4.4:
+
+* Adds Unpacker#feed_each method
+* Improves compatibility with Rubinius
+* Improves compatibility with ruby-1.8.5
+* Encodings of String instances to UTF-8 on Ruby 1.9
+
+2010-06-29 version 0.4.3:
+
+* Adds MessagePack::VERSION constant
+* Fixes SEGV problem caused by GC bug at MessagePack_Unpacker_mark
+

data/Gemfile

@@ -0,0 +1,11 @@
+source 'https://rubygems.org/'
+
+gemspec
+
+group :test do
+  gem "rake"
+  gem 'rake-compiler'
+  gem 'rspec'
+  gem 'json'
+  gem 'yard'
+end

data/README.rdoc

@@ -0,0 +1,191 @@
+= CBOR for Ruby
+
+This is a Ruby implementation of the CBOR[http://cbor.io] encoding, based on
+the (polished) high-performance msgpack-ruby code.
+
+Documentation will follow, but generally, if you replace MessagePack
+and msgpack with CBOR and cbor in the text cited from MessagePack
+below, you will be on the right track.  For a starter:
+
+    require 'cbor'
+    s = [1, 2, 33.5, 4].to_cbor  #=> "\x84\x01\x02\xF9P0\x04"
+    CBOR.decode(s)  #=> [1, 2, 33.5, 4]
+
+Use RubyGems to install:
+
+    gem install cbor
+
+CBOR is an object representation format defined by the IETF[http://ietf.org].
+The specification[http://tools.ietf.org/html/rfc8949]
+is an IETF Standards-Track specification
+and has been published as RFC 8949 (superseding the older RFC 7049).
+
+This is all based on wonderful work by frsyuki, and I have no idea how
+to acknowledge him appropriately.  This gem is not intended to fork or
+supersede MessagePack[http://msgpack.org], which has a vibrant
+ecosystem.  It is just making use of the high-quality code that is
+available in this community.  If MessagePack works for you, go for it.
+If you need CBOR, you need this.
+
+Todos:
+
+* This code has not yet been fully optimized, so it is still a few
+  percent slower than msgpack-ruby.
+
+* Properly document things, in particular the classes CBOR::Simple and
+  CBOR::Tagged.  If you check out the source, you can +rake+ +doc+ to
+  get some documentation in the directory +doc+ (see +index.html+ there).
+
+* Cover more rubies.
+  * \[✔✔✔✔] tested on MRI (1.9.3, 2.0.0, 2.1.10, 2.2.10, 2.3.7, 2.4.4 and 2.5.1).
+  * (\[✔] There now also is some basic MRI 1.8.7 compatibility, however 1.8.7 does not support differentiation between byte and text strings.)
+  * \[✔] tested on Rubinius 2.4.1.
+  * \[_] Publish the pure-ruby version and make it work the same way on JRuby.
+
+* Find and implement good ways to offer CBOR's indefinite length
+  ("streaming") capability at the Ruby API level.  (Decoding is fully
+  supported, just no streaming or indefinite length encoding.)
+
+* Rename some of the internals from msgpack to cbor.  Right now, much
+  of the code still uses the name msgpack in its identifiers, to
+  facilitate merging upstream fixes.  (The msgpack and cbor gems
+  coexist nicely in one MRI instance due to the magic in +renamer.h+.)
+
+Same Apache 2.0 License applies to the changes as to the original.
+For the changes:
+
+Author::    Carsten Bormann <cabo@tzi.org>
+Copyright:: Copyright (c) 2013, 2014 Carsten Bormann
+License::   Apache License, Version 2.0
+
+{<img src="https://travis-ci.org/cabo/cbor-ruby.svg?branch=master" />}[https://travis-ci.org/cabo/cbor-ruby] {<img src="https://badge.fury.io/rb/cbor.svg" alt="Gem Version" />}[http://badge.fury.io/rb/cbor]
+
+For the original, see below.
+
+= MessagePack
+
+MessagePack[http://msgpack.org] is an efficient binary serialization format.
+It lets you exchange data among multiple languages like JSON but it's faster and smaller.
+For example, small integers (like flags or error code) are encoded into a single byte,
+and typical short strings only require an extra byte in addition to the strings themselves.
+
+If you ever wished to use JSON for convenience (storing an image with metadata) but could
+not for technical reasons (binary data, size, speed...), MessagePack is a perfect replacement.
+
+    require 'msgpack'
+    msg = [1,2,3].to_msgpack  #=> "\x93\x01\x02\x03"
+    MessagePack.unpack(msg)   #=> [1,2,3]
+
+Use RubyGems to install:
+
+    gem install msgpack
+
+or build msgpack-ruby and install:
+
+    bundle
+    rake
+    gem install --local pkg/msgpack
+
+
+= Use cases
+
+* Store objects efficiently serialized by msgpack on memcached or Redis
+  * In fact Redis supports msgpack in EVAL-scripts[http://redis.io/commands/eval]
+* Upload data in efficient format from mobile devices such as smartphones
+  * MessagePack works on iPhone/iPad and Android. See also Objective-C[https://github.com/msgpack/msgpack-objectivec] and Java[https://github.com/msgpack/msgpack-java] implementations
+* Design a portable protocol to communicate with embedded devices
+  * Check also Fluentd[http://fluentd.org/] which is a log collector which uses msgpack for the log format (they say it uses JSON but actually it's msgpack, which is compatible with JSON)
+* Exchange objects between software components written in different languages
+  * You'll need a flexible but efficient format so that components exchange objects while keeping compatibility
+
+
+= Portability
+
+MessagePack for Ruby should run on x86, ARM, PowerPC, SPARC and other CPU architectures.
+
+And it works with MRI (CRuby) and Rubinius.
+Patches to improve portability is highly welcomed.
+
+
+= Serializing objects
+
+Use *MessagePack.pack* or *to_msgpack*:
+
+    require 'msgpack'
+    msg = MessagePack.pack(obj)  # or
+    msg = obj.to_msgpack
+
+== Streaming serialization
+
+Packer provides advanced API to serialize objects in streaming style:
+
+    # serialize a 2-element array [e1, e2]
+    pk = MessagePack::Packer.new(io)
+    pk.write_array_header(2).write(e1).write(e2).flush
+
+See {API reference}[http://ruby.msgpack.org/MessagePack/Packer.html] for details.
+
+= Deserializing objects
+
+Use *MessagePack.unpack*:
+
+    require 'msgpack'
+    obj = MessagePack.unpack(msg)
+
+== Streaming deserialization
+
+Unpacker provides advanced API to deserialize objects in streaming style:
+
+    # deserialize objects from an IO
+    u = MessagePack::Unpacker.new(io)
+    u.each do |obj|
+      # ...
+    end
+
+or event-driven style which works well with EventMachine:
+
+    # event-driven deserialization
+    def on_read(data)
+      @u ||= MessagePack::Unpacker.new
+      @u.feed_each(data) {|obj|
+         # ...
+      }
+    end
+
+See {API reference}[http://ruby.msgpack.org/MessagePack/Unpacker.html] for details.
+
+
+= Buffer API
+
+MessagePack for Ruby provides a buffer API so that you can read or write data by hand, not via Packer or Unpacker API.
+
+This {MessagePack::Buffer}[http://ruby.msgpack.org/MessagePack/Buffer.html] is backed with a fixed-length shared memory pool which is very fast for small data (<= 4KB),
+and has zero-copy capability which significantly affects performance to handle large binary data.
+
+= How to build and run tests
+
+Before building msgpack, you need to install bundler and dependencies.
+
+    gem install bundler
+    bundle install
+
+Then, you can run the tasks as follows:
+
+* Build
+
+    bundle exec rake build
+
+* Run tests
+
+    bundle exec rake spec
+
+* Generating docs
+
+    bundle exec rake doc
+
+= Copyright
+
+Author::    Sadayuki Furuhashi <frsyuki@gmail.com>
+Copyright:: Copyright (c) 2008-2013 Sadayuki Furuhashi
+License::   Apache License, Version 2.0
+

data/Rakefile

@@ -0,0 +1,97 @@
+
+require 'bundler'
+Bundler::GemHelper.install_tasks
+
+require 'fileutils'
+
+require 'rspec/core'
+require 'rspec/core/rake_task'
+require 'yard'
+
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.rspec_opts = ["-c", "-f documentation"]
+  t.rspec_opts << "-Ilib"
+  t.pattern = 'spec/**/*_spec.rb'
+  t.verbose = true
+end
+
+task :spec => :compile
+
+desc 'Run RSpec code examples and measure coverage'
+task :coverage do |t|
+  ENV['SIMPLE_COV'] = '1'
+  Rake::Task["spec"].invoke
+end
+
+desc 'Generate YARD document'
+YARD::Rake::YardocTask.new(:doc) do |t|
+  t.files   = ['lib/cbor/version.rb','doclib/**/*.rb']
+  t.options = []
+  t.options << '--debug' << '--verbose' if $trace
+end
+
+spec = eval File.read("cbor.gemspec")
+
+if RUBY_PLATFORM =~ /java/
+  require 'rake/javaextensiontask'
+
+  Rake::JavaExtensionTask.new('cbor', spec) do |ext|
+    ext.ext_dir = 'ext/java'
+    #jruby_home = RbConfig::CONFIG['prefix']
+    #jars = ["#{jruby_home}/lib/jruby.jar"] + FileList['lib/*.jar']
+    #ext.classpath = jars.map { |x| File.expand_path x }.join ':'
+  end
+
+else
+  require 'rake/extensiontask'
+
+  Rake::ExtensionTask.new('cbor', spec) do |ext|
+    ext.cross_compile = true
+    ext.lib_dir = File.join(*['lib', 'cbor', ENV['FAT_DIR']].compact)
+    #ext.cross_platform = 'i386-mswin32'
+  end
+end
+
+CLEAN.include('lib/cbor/*.jar')
+CLEAN.include('lib/cbor/cbor.*')
+
+task :default => :build
+
+
+###
+## Cross compile memo
+##
+## Ubuntu Ubuntu 10.04.1 LTS
+##
+#
+### install mingw32 cross compiler with w64 support
+# sudo apt-get install gcc-mingw32
+# sudo apt-get install mingw-w64
+#
+### install rbenv
+# git clone git://github.com/sstephenson/rbenv.git ~/.rbenv
+# echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bash_profile
+# echo 'eval "$(rbenv init -)"' >> ~/.bash_profile
+# exec $SHELL -l
+#
+### install cross-compiled ruby 2.0.0
+# rbenv install 2.0.0-p0
+# gem install rake-compiler
+# rake-compiler cross-ruby VERSION=2.0.0-p0
+#
+### install cross-compiled ruby 1.9.3
+# rbenv install 1.9.3-p327
+# gem install rake-compiler
+# rake-compiler cross-ruby VERSION=1.9.3-p327
+#
+### install cross-compiled ruby 1.8.7
+# rbenv install 1.8.7-p371
+# gem install rake-compiler
+# rake-compiler cross-ruby VERSION=1.8.7-p371
+#
+### build gem
+# rbenv shell 1.8.7-p371
+# gem install bundler && bundle
+# rake cross native gem RUBY_CC_VERSION=1.8.7:1.9.3:2.0.0
+#
+

data/ci/test.rb

@@ -0,0 +1,31 @@
+# Smoke test run in CI against the installed gitlab-cbor gem. Exercises the
+# security behavior (object-constructing tags are opt-in) plus a core
+# round-trip, the same way a consumer loads it: require "cbor".
+require "cbor"
+require "time"
+require "uri"
+
+failures = []
+check = lambda do |name, got, want|
+  failures << "#{name}: got #{got.inspect}, want #{want.inspect}" unless got == want
+end
+
+re  = "\xd8\x23\x63foo".b           # tag 35, "foo"
+uri = "\xd8\x20\x6bhttp://a.ex".b   # tag 32, "http://a.ex"
+tm  = "\xc1\x1a\x51\x4b\x67\xb0".b  # tag 1, epoch
+
+check.call("constants", [CBOR::TAG_REGEXP, CBOR::TAG_URI], [35, 32])
+check.call("default regexp -> Tagged", CBOR.decode(re), CBOR::Tagged.new(35, "foo"))
+check.call("default uri -> Tagged",    CBOR.decode(uri), CBOR::Tagged.new(32, "http://a.ex"))
+check.call("opt-in regexp", CBOR.decode(re, reconstruct_from_tags: [CBOR::TAG_REGEXP]), /foo/)
+check.call("opt-in uri",    CBOR.decode(uri, reconstruct_from_tags: [CBOR::TAG_URI]), URI.parse("http://a.ex"))
+check.call("uri stays Tagged without opt-in", CBOR.decode(uri, reconstruct_from_tags: [CBOR::TAG_REGEXP]), CBOR::Tagged.new(32, "http://a.ex"))
+check.call("time always reconstructed", CBOR.decode(tm), Time.at(1363896240))
+check.call("core round-trip", CBOR.decode({ "a" => [1, 2, "x"] }.to_cbor), { "a" => [1, 2, "x"] })
+
+if failures.empty?
+  puts "OK: all #{8} checks passed (gitlab-cbor #{Gem.loaded_specs['gitlab-cbor']&.version})"
+else
+  warn "FAILED:\n  " + failures.join("\n  ")
+  exit 1
+end