kettle-dev 3.1.9 → 3.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 452c1019273fac5fa450b42b6bf0d24fee016a6641971eeb3c5bddcf08efaa64
-  data.tar.gz: 4919f5ac1cd4aeb579da6ae378109923cf7fe86c6568b77ab42101e2f8bd4087
+  metadata.gz: 402314d89802c8ea05c0ad109c93b25ee8a703e767a5581855ac80ab1981f139
+  data.tar.gz: 91d16f55dfe212bb82f0506d030734daa151dcbd0cc1cf2cf9f7f4547597e82c
 SHA512:
-  metadata.gz: 58be74c463a06ea48b7571ec6fffa36bcaca0da0eb5e1a7cab2b4d3765f7fe2a4be2932f1cf09bfc496c97a9fa32badcf36182eabcdf58e61f5eb8c7242c9d41
-  data.tar.gz: 6e679af06a75e16ff6321f348cae64f8fa8c6884408f4fca7f20c7d5d8b5498bd4cf6bac270c0dc04a84747f3e67dffe7562c89e15d91afc38d11dd7f59e82f6
+  metadata.gz: 3e4c5dbd0e71242d0b8d7ad112858de871a169f76dfe49d1754525656e31f5d7421c324dcdbddc597a2a38e55228640f57d34a637d7d30f35a0565476a32442f
+  data.tar.gz: c1ceeb7a1c40a1f989ff4ba76fe44bebc988c76d82fb945c6f15ccac66d6e547e6924557bb3cef10f661fd1f91b82407613a014462bbae47fa63b8c70f460a52

data/CHANGELOG.md

@@ -30,6 +30,23 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.10] - 2026-10-11
+
+- TAG: [v3.1.10][3.1.10t]
+- COVERAGE: 91.78% -- 6341/6909 lines in 49 files
+- BRANCH COVERAGE: 75.83% -- 2412/3181 branches in 49 files
+- 52.10% documented
+
+### Fixed
+
+- appraisal:generate now deletes a stale Appraisal.root.gemfile.lock before its bundle install. The root appraisal lockfile is a gitignored local artifact that drifts after dependency bumps; a stale pin made appraisal:generate fail with an opaque "locked to X ... can no longer be found" (observed templating kettle-jem after ast-crispr-ruby-prism's floor moved to an unpublished version). appraisal:generate's contract is to work without resolving appraisal locks, so the stale lock is removed and Bundler resolves fresh.
+
+### Security
+
+- InteractiveReleaseCommand now scrubs every configured secret from child output before printing, capturing, or logging it: a PTY echoes bytes written to its input back onto the output stream while the child's terminal echo is on (e.g. before RubyGems' noecho wraps the password read), so the gem signing passphrase previously appeared in release logs; the scrubber tracks written secrets in memory, removes them from every chunk including secrets split across chunk boundaries, and clears the prompt buffer after answering so a stale prompt cannot trigger a duplicate write
+
+- kettle-release aborts at startup under a prerelease Bundler, and LockfileReset now treats a lockfile BUNDLED WITH a prerelease Bundler as drift: Bundler auto-installs the locked version (including betas) on every bundle install, so one beta-pinned lockfile re-infects every machine that bundles against it; the reset re-locks with the currently running stable Bundler
+
 ## [3.1.9] - 2026-10-09
 
 - TAG: [v3.1.9][3.1.9t]
@@ -4021,7 +4038,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.9...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.10...HEAD
+[3.1.10]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.9...v3.1.10
+[3.1.10t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.10
 [3.1.9]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...v3.1.9
 [3.1.9t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.9
 [3.1.8]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...v3.1.8

data/README.md

@@ -1067,7 +1067,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.848-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.909-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/interactive_release_command.rb

@@ -14,6 +14,14 @@ module Kettle
         @secret_event_handler = secret_event_handler
         @forward_stdin = forward_stdin
         @gem_signing_passphrase = nil
+        # Secrets are written to the PTY master to answer child prompts. A PTY
+        # slave still echoes what is typed while the child has not yet disabled
+        # terminal echo (RubyGems' ask_for_password only wraps gets in noecho),
+        # so the secret bytes can bounce back into the PTY output stream and —
+        # without filtering — land in release logs. Track every secret written
+        # and scrub it from all child output before it is printed or captured.
+        @written_secrets = []
+        @secret_scrub_carryover = +""
       end
 
       def call(env, cmd)
@@ -44,14 +52,35 @@ module Kettle
                   input.write(@input.readpartial(1024))
                 else
                   chunk = output.readpartial(1024)
+                  # Two views of the same bytes, with independent state.
+                  #
+                  # Emitted view: holds back a trailing window so a secret
+                  # split across chunks can never reach the log; the window
+                  # is released by flush_secret_scrub_carryover at stream end.
+                  #
+                  # Prompt view: scrubbed but never held back. A child that
+                  # prints its prompt and then blocks on stdin (Gem's OTP
+                  # `Code: ` ask) produces no further output; if the prompt
+                  # tail sat in the emitted view's holdback, detection would
+                  # never fire and the child would deadlock. The prompt view
+                  # therefore scrubs the raw chunk directly (plus the emitted
+                  # view's carryover, read-only, so bytes spanning the
+                  # boundary are still masked) instead of consuming it.
+                  chunk = scrub_secrets_from_chunk(chunk)
+                  prompt_text = scrub_secrets_for_prompt_detection(chunk)
                   stdout_str << chunk
                   @output.print(chunk)
-                  prompt_buffer = handle_prompt(input, chunk, prompt_buffer: prompt_buffer)
+                  prompt_buffer = handle_prompt(input, prompt_text, prompt_buffer: prompt_buffer)
                 end
               end
             end
           rescue Errno::EIO, EOFError
             # PTY platforms signal a closed child with EIO or EOFError.
+            chunk = flush_secret_scrub_carryover
+            unless chunk.empty?
+              stdout_str << chunk
+              @output.print(chunk)
+            end
           rescue Kettle::Dev::Error
             Process.kill("TERM", pid)
             raise
@@ -78,6 +107,7 @@ module Kettle
               else
                 begin
                   chunk = reader.readpartial(1024)
+                  chunk = scrub_secrets_from_chunk(chunk)
                   if reader.equal?(output)
                     stdout_str << chunk
                     @output.print(chunk)
@@ -93,6 +123,11 @@ module Kettle
             end
           end
           status = wait_thread.value
+          chunk = flush_secret_scrub_carryover
+          unless chunk.empty?
+            stdout_str << chunk
+            @output.print(chunk)
+          end
         end
         [stdout_str, stderr_str, status]
       end
@@ -110,7 +145,15 @@ module Kettle
           return prompt_buffer
         end
 
-        write_secret(input, label: "gem signing passphrase", source: "gem_signing_passphrase") { gem_signing_passphrase } if signing_password_prompt?(prompt_buffer)
+        if signing_password_prompt?(prompt_buffer)
+          write_secret(input, label: "gem signing passphrase", source: "gem_signing_passphrase") { gem_signing_passphrase }
+          # Clear the buffer after answering: otherwise the stale prompt text
+          # re-matches on every subsequent chunk and writes the secret again.
+          # The duplicate write happens after the child has restored terminal
+          # echo (RubyGems' noecho wraps only the gets call), so its bytes echo
+          # back through the PTY and land in the captured output and logs.
+          return +""
+        end
         prompt_buffer
       end
 
@@ -129,6 +172,11 @@ module Kettle
         @output.puts("#{label} loaded from configured secrets provider.")
         input.write("#{secret}\n")
         input.flush
+        # Register AFTER writing: a chunk currently in flight may contain a
+        # legitimately echoed prompt line, but anything the child echoes from
+        # this point on that contains the secret bytes is PTY echo of the write
+        # and must never reach @output, captured output, or release logs.
+        register_secret!(secret)
         emit_secret_event(source: source, action: "prompt_response", status: "ok", label: label)
       rescue Kettle::Dev::Error => error
         emit_secret_event(source: source, action: "prompt_response", status: "failed", label: label, reason: error.message)
@@ -139,6 +187,57 @@ module Kettle
         secret_event_handler&.call(payload)
       end
 
+      # Never persist secret values. Register the exact byte string so the
+      # scrubber can recognize it in child output without logging it.
+      def register_secret!(secret)
+        secret = secret.to_s
+        return if secret.empty?
+
+        @written_secrets << secret unless @written_secrets.include?(secret)
+        @written_secrets.shift if @written_secrets.length > 8
+      end
+
+      # Secrets typed into a PTY can be echoed back when the child's terminal
+      # echo is momentarily on (e.g. before Gem's noecho gets runs). Remove
+      # registered secret byte sequences from every chunk before printing or
+      # capturing. A chunk boundary can split a secret, so carry a trailing
+      # window of the longest secret forward to the next chunk.
+      def scrub_secrets_from_chunk(chunk)
+        return chunk if @written_secrets.empty? || chunk.empty?
+
+        window = @written_secrets.map(&:bytesize).max || 0
+        buffer = @secret_scrub_carryover + chunk
+        buffer = buffer.gsub(Regexp.union(@written_secrets), "[SECRET REMOVED]")
+        if buffer.bytesize >= window && window > 0
+          @secret_scrub_carryover = buffer.byteslice(-window, window).to_s
+          buffer.byteslice(0, buffer.bytesize - window).to_s
+        else
+          @secret_scrub_carryover = buffer
+          +""
+        end
+      end
+
+      # At stream end nothing else can reveal a secret split across chunks, so
+      # release the held trailing window (already scrubbed once).
+      def flush_secret_scrub_carryover
+        chunk = @secret_scrub_carryover
+        @secret_scrub_carryover = +""
+        chunk
+      end
+
+      # Prompt-detection view: scrubbed, but never holds back a trailing
+      # window. Reads (never consumes) the emitted view's carryover so bytes
+      # spanning a chunk boundary are still masked here. Without this view, a
+      # prompt whose tail falls inside the holdback — a child that blocks on
+      # stdin and produces no further output — would never be answered, and
+      # the release would deadlock.
+      def scrub_secrets_for_prompt_detection(chunk)
+        return chunk if @written_secrets.empty?
+
+        buffer = @secret_scrub_carryover + chunk
+        buffer.gsub(Regexp.union(@written_secrets), "[SECRET REMOVED]")
+      end
+
       def otp_prompt?(chunk)
         chunk.match?(/(?:multi-factor authentication|OTP code|one-time password|\bCode:\s*)/i)
       end

data/lib/kettle/dev/lockfile_reset.rb

@@ -311,6 +311,7 @@ module Kettle
         has_local_path_remote?(path, strict: strict) ||
           !empty_registry_checksums(path).empty? ||
           !unreleased_workspace_registry_specs(path).empty? ||
+          bundled_with_prerelease?(path) ||
           bundled_with_checksum_mismatch?(path)
       end
 
@@ -325,6 +326,9 @@ module Kettle
         unreleased_workspace_registry_specs(path).each do |name, version, line_number|
           diagnostics << "#{display_path(path)} locks local workspace gem #{name} #{version} as a registry gem, but that version is not resolvable from the configured gem source at line #{line_number}"
         end
+        if bundled_with_prerelease?(path)
+          diagnostics.push("#{display_path(path)} BUNDLED WITH #{bundled_with_version(path)} is a prerelease Bundler; re-lock with a stable Bundler")
+        end
         if bundled_with_checksum_mismatch?(path)
           diagnostics.push("#{display_path(path)} BUNDLED WITH #{bundled_with_version(path)} has no matching Bundler checksum")
         end
@@ -542,6 +546,19 @@ module Kettle
         ""
       end
 
+      # A lockfile pinned to a prerelease Bundler re-infects every machine that
+      # runs bundle install against it: Bundler auto-installs the locked version
+      # (including betas) before doing anything else. Treat it as drift and let
+      # the reset re-lock with the currently running stable Bundler.
+      def bundled_with_prerelease?(path)
+        version = bundled_with_version(path)
+        return false if version.empty?
+
+        Gem::Version.new(version).prerelease?
+      rescue ArgumentError
+        false
+      end
+
       def path_source_gems(path)
         lockfile_parser(path).specs.each_with_object(Set.new) do |spec, gems|
           source = spec.source

data/lib/kettle/dev/rakelib/appraisal.rake

@@ -54,6 +54,19 @@ begin
   end
 
   run_generate_steps = lambda do
+    # The root appraisal lockfile is a local artifact (gitignored) that drifts
+    # after dependency bumps. A stale pin makes `bundle install` fail with an
+    # opaque "locked to X ... can no longer be found" — observed when a family
+    # member's gemspec floor was raised to an unpublished sibling version.
+    # appraisal:generate's contract is to work without resolving appraisal
+    # locks, so delete the stale root lock and let Bundler resolve fresh from
+    # Appraisal.root.gemfile.
+    root_appraisal_lock = File.join("Appraisal.root.gemfile.lock")
+    if File.file?(root_appraisal_lock)
+      File.delete(root_appraisal_lock)
+      puts("[kettle-dev][appraisal:generate] deleted stale #{root_appraisal_lock}")
+    end
+
     # 1) BUNDLE_GEMFILE=Appraisal.root.gemfile bundle install
     run_command.call(
       "appraisal:generate failed: BUNDLE_GEMFILE=Appraisal.root.gemfile bundle install",

data/lib/kettle/dev/release_cli.rb

@@ -1859,6 +1859,13 @@ module Kettle
         if ver < min
           abort("kettle-release requires Bundler >= 2.7.0 for reproducible builds by default. Current: #{Bundler::VERSION}. Please upgrade bundler.")
         end
+        if ver.prerelease?
+          abort(
+            "kettle-release refuses to run under a prerelease Bundler (#{Bundler::VERSION}). " \
+              "Prerelease Bundler has repeatedly introduced release-breaking behavior changes. " \
+              "Run `gem uninstall bundler -v #{Bundler::VERSION}` and install the latest stable Bundler."
+          )
+        end
       end
 
       # Keep Bundler maintenance separate from the release metadata commit.
@@ -1882,8 +1889,18 @@ module Kettle
         appraisal_gemfile = File.join(@root, "Appraisal.root.gemfile")
         if File.file?(appraisal_gemfile)
           appraisal_lockfile = File.join(@root, "Appraisal.root.gemfile.lock")
-          appraisal_command = "BUNDLE_GEMFILE=#{Shellwords.escape(appraisal_gemfile)} " \
-            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)} bundle update --bundler=#{bundler_version}"
+          appraisal_env = "BUNDLE_GEMFILE=#{Shellwords.escape(appraisal_gemfile)} " \
+            "BUNDLE_LOCKFILE=#{Shellwords.escape(appraisal_lockfile)}"
+          # The appraisal root lockfile is a gitignored local artifact; the
+          # release lockfile reset restores repo state by removing untracked
+          # files, so it is frequently absent here. `bundle update` refuses to
+          # run against a missing lockfile ("This Bundle hasn't been installed
+          # yet"), so materialize the bundle first — bundle install writes the
+          # lockfile and is a no-op when everything is already installed.
+          unless File.file?(appraisal_lockfile)
+            run_cmd!(release_project_command("#{appraisal_env} bundle install"))
+          end
+          appraisal_command = "#{appraisal_env} bundle update --bundler=#{bundler_version}"
           run_cmd!(release_project_command(appraisal_command))
           run_cmd!(release_project_command("bundle exec rake appraisal:reset"))
         end

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -12,6 +12,47 @@ module Kettle
     ENV_TRUE_RE = /\A(1|true|y|yes)\z/i unless const_defined?(:ENV_TRUE_RE, false)
 
     module RubyGemsVersions
+      # ---------------------------------------------------------------------------
+      # Registry answer caches: which one to build on
+      # ---------------------------------------------------------------------------
+      #
+      # Registry answers are cached at three layers. Each has a distinct scope
+      # and purpose; pick by the question your tool asks, not by proximity.
+      #
+      # 1. THE PERSISTENT CACHE — this module (disk, ~30-day TTL, keyed
+      #    [name, source]). The only cross-process layer. Use it, via
+      #    #published_version_numbers / #fetch, whenever your tool needs
+      #    "what versions exist on this registry" and can tolerate the TTL
+      #    window. Source-keyed because gem.coop can lag rubygems.org — a
+      #    version present on one can be absent from the other, so the two
+      #    registries must never share entries.
+      #    Built on by: kettle-jem deps-floor, kettle-family bup pre-clean.
+      #
+      # 2. THE SNAPSHOT MEMO — kettle-family PublishedVersionCheck::REGISTRY_MEMO
+      #    (process-local, keyed [name, remote, version]). NOT a performance
+      #    layer. Exists for snapshot consistency: one command run must see one
+      #    registry snapshot, so a gem landing mid-run cannot be reported
+      #    unpublished for early members and published for later ones. It also
+      #    owns the just-released bypass: the disk cache can hold a pre-publish
+      #    answer, and only this layer knows which exact pinned version the
+      #    caller cares about, so only here can kettle-release's on-disk
+      #    release marker override the disk cache for that gem+version.
+      #    Built on by: kettle-family bup/release lockfile validation.
+      #
+      # 3. THE RUN-LEVEL MEMO — kettle-family ReleasePreClean@published
+      #    (per-command-instance, keyed name). Fail-open sentinel: registry
+      #    answers memoized as nil mean "unreachable — remove nothing", which
+      #    is this command's safety rule. Also collapses repeated per-member
+      #    lookups of the same name into one answer within the run.
+      #    Built on by: kettle-family release-mode bup pre-clean.
+      #
+      # Rule of thumb: persistence goes at layer 1, correctness-scoping
+      # (snapshot/bypass) at layer 2, command-local safety policy at layer 3.
+      # A future tool that needs "is this version published" should call
+      # layer 1, and add a higher layer ONLY if it needs snapshot
+      # consistency or its own failure policy.
+      #
+      # -------------------------------------------------------------------------
       CACHE_BUST_TTL_SECONDS = 30 * 24 * 60 * 60
       VERSION_CACHE_TTL_SECONDS = 30 * 24 * 60 * 60
       HTTP_OPEN_TIMEOUT_SECONDS = 5

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.9"
+      VERSION = "3.1.10"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.9
+  version: 3.1.10
 platform: ruby
 authors:
 - Peter H. Boling
@@ -60,7 +60,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.16
+        version: 0.3.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -70,7 +70,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.16
+        version: 0.3.17
 - !ruby/object:Gem::Dependency
   name: kettle-ndjson
   requirement: !ruby/object:Gem::Requirement
@@ -80,7 +80,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.18
+        version: 0.1.19
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -90,7 +90,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.18
+        version: 0.1.19
 - !ruby/object:Gem::Dependency
   name: kettle-rb
   requirement: !ruby/object:Gem::Requirement
@@ -100,7 +100,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.15
+        version: 0.1.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -110,7 +110,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.15
+        version: 0.1.17
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -120,7 +120,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.23
+        version: 2.0.24
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -130,7 +130,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.23
+        version: 2.0.24
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.9
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.9/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.10
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.10/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.9
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.10
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev

metadata.gz.sig

@@ -1 +1,5 @@
-"�
��5s_�
4+���ٻ\�ڋlb=��*��%�.$/��>���Z���=Q�R%���J�+Z���2����3��YX
+��yo}��+'�c��Q��UK�N��*v;�\/�P���Z-Y�^���.�%��EV5
+za*/�◅*q��r���.]��/���j �y�?��v�¾���4\����%��$"�wD<�%�V�w���49�G[��~���9\�!0ʄ�gYe�R���;99��"K�:}KCr
+e+�
+������_Žg��,�C������3$G+�T�]jJ!�I�{���{�pAD�7'B�<4��U�(“�^�A�nK����r0x�-�Rc>ެ?%���Q%u�2������w��$>��L�w؝��n��J}C
+
�8����Ē�b�l�-r��CdYU*���Ku�$�����G�p;�7vO>�