ocran 1.3.16 → 1.3.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b492eb2cf2cfd017c042a349bfbed469e3916e9a04d975df067c89f2d51fb76d
-  data.tar.gz: '019bf741312e62175926aa6ac19a7f99fc1d75041a7ec818c777b07cdce0cc37'
+  metadata.gz: 816bbf710efb38734ee1955a19ff5bd418b83ff1a5cf21b7a4d0bfe100b2c439
+  data.tar.gz: 95173c8a2bd36ea959f4dfe5ddafba5a96b891ced56e9026653e4c1b3aba32a3
 SHA512:
-  metadata.gz: c90c2d913370f8023b41683236e4174c9d1e4174ee073f586e602bd11a84f5dea1988e97c5e023ea8d94b02e349b2539d87e4b23c6d590a84c38ad9423b5d589
-  data.tar.gz: 2f03c794cb6bd8c9318d80927bc8c10e8445ab36aa0d344aaff31701779266ec96036f50ef1d02998e3d3487010eefd8213cdd72a169f369d3fdbf177700150b
+  metadata.gz: ae9bd0453f9219098542daa6e1842004cc8efa29422cd80c52a0b936065f790c994139f775a1c2dd42fe9e3ed274e60741ecfc8721692d4293ee1c9fde70a34f
+  data.tar.gz: e422b2ed09f116891ff82cee0d5ec29125b71c6ead67964249cdcc4ad375aacced7802f07b91ef6d9419986af4ec49c7c3c56f0e22fcf85aa6cd55a62fd238e6

data/CHANGELOG.txt

@@ -0,0 +1,292 @@
+=== 1.3.18
+- Support shipping IRB as .exe File
+- Fix SxS error 14001 when loading native extensions (e.g. openssl.so, date_core.so) at runtime. Each .so file may have a companion *.so-assembly.manifest in archdir defining its private SxS assembly; these manifests are now included alongside the .so files. All files in ruby_builtin_dlls/ (DLLs and manifest) are now included rather than the manifest alone.
+- Support for Ruby 4.0.
+- Include cacert.pem in the exe file to avoid SSL certificate verification issues.
+- Use wide (UTF-16) Win32 APIs throughout system_utils.c (CreateFileW, CreateDirectoryW, DeleteFileW, FindFirstFileW/FindNextFileW, RemoveDirectoryW, GetFileAttributesW, MoveFileExW, GetTempPathW, CreateProcessW) to correctly handle multibyte (UTF-8) file and directory paths in the stub.
+- Add Windows Authenticode code signing support. The stub now detects and skips PE security directory entries when searching for the OCRAN signature, so signed executables unpack correctly. Build time clears invalid security directory entries from PE headers to allow subsequent signing.
+- Fix incorrect buffer size passed to GetModuleFileNameW in LibraryDetector (passed bytesize instead of character count).
+- Fix pointer subtraction underflow in stub unpacker when a tampered offset places head past tail.
+- Add bounds checking for icon file entries in edicon to prevent out-of-bounds reads from malformed .ico files.
+- Support for Ruby 3.2 and above. Drop ruby 3.0 and 3.1 support.
+- Suppress user notifications during stub cleanup and log errors to DEBUG output
+- Fixes issue where two MessageBox dialogs appeared in GUI mode when a signature was not found.
+- No longer create a marker file when the stub fails to delete the installation directory during cleanup.
+- stub: During cleanup, switch to a safer working directory before removing the extraction directory.
+- stub: Truncate error messages originating from the stub to a fixed maximum length.
+- stub: Changed the name of the extraction directory to follow the mkdtemp style. The name is now generated using secure random numbers.
+- stub: Disabled path expansion of template characters for additional options passed to the script.
+- stub: Changed the script’s working directory switch to use Ruby’s `-C` option.
+
+=== 1.3.17
+- Modified `rake test` to no longer build stubs during test execution. Use `rake build_stub` when stub generation is necessary.
+- New `rake build` task as a unified build entry point, delegating to `build_stub`.
+- Updated GitHub Actions and internal scripts to use `rake build` instead of `rake build_stub`.
+- Add full support for multibyte (UTF-8) names across executables, scripts, and resources. Requires Windows 10 version 1903 or later.
+- Added UTF-8 manifest to stub.exe to enable UTF-8 support in ANSI API calls.
+- Update Bundler from 2.5.10 to 2.5.23. This is the last Bundler version officially supporting Ruby 3.0.
+- Added `bin/setup` and `bin/console` scripts for development (both Bash and Windows .bat versions).
+- `bin/setup` now installs dependencies and builds stub executables automatically.
+- Improved `spec.files` to explicitly include README, LICENSE, and CHANGELOG.
+- Introduced a `Development` section in the README with setup instructions and Windows shell compatibility.
+- Updated copyright year in README and LICENSE.
+
+=== 1.3.16
+- Support for Ruby 3.0 and above. Drop ruby 2.6 and 2.7 support.
+- At startup, OCRAN no longer automatically removes directories that were previously deployed but couldn't be deleted. This change has been made to enhance security by preventing processes other than the startup process from manipulating temporary files created by them.
+- The ability for the stub to launch any script during the unpacking of application files has been removed. This feature was not in use.
+- The exit code from the Ruby application is now returned when the stub is terminated.
+- The packed data no longer contains redundant directory information.
+- Fixed errors in the --debug option.
+- Upgraded LZMA decoder to version 22.01
+- The directory generation for file extraction has been changed to use unique directory names created with high-resolution timestamps. Additionally, a retry limit for directory creation has been introduced, reducing the risk of infinite loops due to name collisions.
+- Implemented variable-length buffer handling for path strings in stub, eliminating the risk of buffer overruns dependent on MAX_PATH.
+- In order to reduce security risks during the cleanup process before application termination, we have implemented a safe current directory change from the system directory and the root of the C drive to the user's temporary directory and the directory of the app executable.
+- The 'stub' executable has been enhanced for security, ensuring it prevents directory traversal attacks by verifying that path elements do not contain relative notations like '.' or '..'.
+- Removed OcranBuilder and split functionality into StubBuilder and InnoSetupBuilder to introduce delayed loading and improve resource efficiency.
+- InnoSetup installer now operates independently of stub, launching through its own batch file.
+- Moved LibraryDetector to a separate file for modularity and implemented delayed loading with standardized Fiddle usage.
+- Update Bundler from 2.4.13 to 2.5.10.
+- Fixed issue where the gem.build_complete file was not included in the package due to an incorrect change.
+- Changed error output from standard output to standard error (stderr).
+- ocransa (Ocran-stand-alone) has been discontinued.
+- The implementation of bin/ocran.rb has been refactored and split into multiple files. These files have been relocated to the lib directory.
+
+=== 1.3.15
+- Support for Ruby 2.6 and above.
+- Properly display errors from InnoSetup.
+- Fixed errors when creating an installer using InnoSetup. Previously, installer creation was not possible due to errors related to file sharing, which occurred only on Windows.
+- Retrieve the path of runtime DLLs even when the path is long. Note that stubs still do not support long paths, so creating executable files with long paths is not yet possible.
+- Fixed bugs in tests. All tests can now be executed.
+- Improved the speed of manifest file discovery. This manifest file is only required in the RubyInstaller environment.
+- Fixed bugs in the regular expressions of GEM_EXTRA_RE. This allows excluding C source files, etc., from the ocran executable package based on command options.
+- Added methods to Ocran::Pathname, making it closer to the implementation of Ruby's Pathname.
+- Reimplemented certain parts to match the implementation of Ruby 2.6 era, for compatibility with older Ruby versions. Therefore, the ocran command cannot be executed on Ruby versions earlier than 2.6.
+
+=== 1.3.14
+- Add option to suppress or override RUBYOPT environment variable #3 by ccorn90
+
+=== 1.3.13
+- Fixed the bug why Innosetup did not run because of missing encode method 
+- Fix an issue where rubyinstaller did not find the msys path by putting in an empty msys-2.0.dll into msys64/usr/bin/msys-2.0.dll
+- compatibility with the tiny_tds gem (see above)
+- GitHub builds through github action: making sure you can trust the included binaries.
+- Added some samples including the glimmer-libui GUI example. GUI that starts fast.
+
+=== 1.3.12
+* Forked from Ocra
+* Support Ruby up to 3.2
+* Update lzma.exe to version 22.01
+
+=== 1.3.11
+
+* Support Ruby 2.2-2.7
+* Add ruby2_keywords.rb to ignored modules
+* Update lzma.exe to version 19.00
+* Workaround for warning about deprecated Object#=~
+* Use Fiddle instead of Win32API
+* Fix for invalid argument to relative_path_from
+
+=== 1.3.10
+
+* Reduce memory usage while building & compressing (avoids out of
+  memory issue on really big programs).
+
+* Compile stub.exe with 32-bit compiler again
+
+=== 1.3.9
+
+* Support Ruby 2.4.1p111 (include manifest)
+
+=== 1.3.8
+
+* Use GetModuleFileNameW for DLL detection
+
+=== 1.3.7
+
+* Workaround for handling of file names and directory name with
+  non-ASCII characters (e.g. "invalid byte sequence in UTF-8")
+
+=== 1.3.6
+
+* More robust cleanup of temporary files. Deletes using manual
+  recursive method instead of using the shell. Will mark files for
+  later deletion both using Windows (requires Administrator
+  privileges) and a custom method that will remove old temporary files
+  when the executable is restarted.
+
+=== 1.3.5
+
+* Fixes for Ruby 2.2.2p95
+
+=== 1.3.4
+
+* Workarounds for Ruby 2.1.5
+
+=== 1.3.3
+
+* Rebuild executables with MinGW GCC 4.8.1-4.
+
+=== 1.3.2
+
+* Refactored Gemfile handling for better compatibility with Ruby
+  version.
+
+=== 1.3.1
+
+* Now includes $LOADED_FEATURES even when script is not run to check
+  dependencies. This fixes compatability with Ruby 1.9.3 where
+  rubygems is always loaded.
+
+* Fixed compatability with Ruby 2.0.0: Temp-path alias in binary
+  changed to be valid UTF-8 character.
+
+* README.txt updated related to --no-dep-run (karhatsu).
+
+* Fixes for Bundler handling (DavidMikeSimon).
+
+=== 1.3.0
+
+* Fixed some additional corner cases with absolute and relative
+  require & load paths. Extended test suite to cover a lot more
+  cases.
+
+* Now provides a meaningful exit status code (1 on error, 0 on
+  success). (DavidMikeSimon)
+
+* New option to _not_ run the script to detect dependencies
+  (--no-dep-run). (DavidMikeSimon)
+
+* Bundler support using the --gemfile option. (DavidMikeSimon)
+
+* Debug mode support in the stub (--debug). Also --debug-extract to
+  keep extracted files from executable. (DavidMikeSimon)
+
+* New gem behaviour yet again due to changes in Rubygems. See README
+  file.
+
+=== 1.2.0
+
+* Ignore console events (Ctrl-C, Ctrl-Break). Ruby process handles
+  them anyway and exist, allowing the stub to clean up temporary
+  files.
+
+* Temporary memory used for decompression is now freed before the ruby
+  interpreter is launched by the stub.
+
+* Progress dialog is no longer displayed when removing temporary
+  files.
+
+* Now includes most files from any require'd Rubygem (Now works with
+  mime-types, oledb and other gems that load additional data files
+  from the Gem installation). Some files are still ignored
+  (e.g. Readme's). Use "--no-gem-filter" to make Ocra unconditionally
+  include all files listed in the Gem specification (Thanks to Jorge
+  L. Cangas for patch & ideas).
+
+* NameErrors are now rescued when attempting to load autoloadable
+  constants. Hopefully resolves issues with ActiveRecord [#28488].
+
+* Now works if the script changes environment or working directory
+  while running.
+
+* Fixed a regression in 1.1.4 when resource files are specified;
+  directory layout would not be maintained, e.g. when running "ocra
+  bin/script share/data.dat".
+
+* Added support for passing arguments to script. Specify argument to
+  your script after a "--" marker. Arguments will be passed both at
+  compile time and run time. (#27815)
+
+* Now works if the source files are located beneath Ruby's
+  exec_prefix. (#28505)
+
+=== 1.1.4
+
+* The tempdir marker is now pretty-printed as "<tempdir>" in the
+  output.
+
+* Fixed various issues with path and filenames being handled case
+  sensitive.
+
+* Now uses config settings for Ruby executable names (should now also
+  work with ruby installations built with --program-suffix).
+
+* Supported invoking ocra with an absolute path to the script. Will
+  assume that the script is in the root of the source hierachy.
+
+=== 1.1.3
+
+* Use Win32API (provided with Ruby) instead of win32-api (gem).
+
+* No longer sets GEM_HOME (which would override the default gem
+  path). Instead sets GEM_PATH. Resolves issues with gems not loading
+  on Ruby 1.9.
+
+=== 1.1.2
+
+* Warnings can be disabled using --no-warnings.
+
+* Fixed not .exe being generated when script calls 'exit'.
+
+* Path to the generated executable is now avilable to the running
+  script in the OCRA_EXECUTABLE environment variable.
+
+* Directories on the command line will now be created.
+
+* Supports path globs, fx. "ocra script.rb assets/**/*.png". (See
+  documentation for Ruby's Dir class).
+
+* Fixed issue with spaces in temporary path (TMP environment).
+
+* Improved path comparison to ignore case (this is Windows after all)
+  and be a bit more robust.
+
+* Added support for RubyGems installed in GEM_HOME (or other part
+  handled by RubyGems). If not installed in the Ruby hierarchy, they
+  will now be installed in a directory named 'gemhome' under the
+  temporary directory.
+
+=== 1.1.1
+
+* Fixed duplicate entries in the RUBYLIB environment variable.
+
+* Another slight fix for relative load paths.
+
+* RUBYOPT is now set to the value it had when OCRA was invoked.
+
+=== 1.1.0
+
+* Added an icon to the executable. Can be replaced from a .ico file
+  using the --icon <ico> option.
+
+* Improved handling of load paths added either from the command line
+  (ruby -I), RUBYLIB environment variable or during the script (by
+  modifying $: or $LOAD_PATH).
+
+* Now automatically detects loaded DLLs through Win32::API. Disable
+  with --no-autodll.
+
+=== 1.0.3 / 2009-05-25
+
+* Fixed invokation of executables with spaces in path names (#25966).
+
+* Fixed inverted handling of --windows & --console (#25974)
+
+* Fixed installation issue with RubyGems (missing "lib")
+
+=== 1.0.2 / 2009-05-10
+
+* Added stubw.exe to gem (was missing 1.0.1)
+
+=== 1.0.1 / 2009-05-05
+
+* Added stub with windows runtime for windowed applications
+  (e.g. wxRuby) and fixed issue where OCRA would use ruby.exe instead
+  of rubyw.exe for such programs. [#25774]
+
+=== 1.0.0 / 2009-04-05
+
+* 1 major enhancement
+
+  * Birthday!

data/LICENSE.txt

@@ -0,0 +1,23 @@
+(The MIT License)
+
+Copyright (c) 2009-2020 Lars Christensen
+Copyright (c) 2020-2025 The OCRAN Committers Team
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,533 @@
+# ocran
+
+home   :: https://github.com/largo/ocran/
+
+issues :: http://github.com/largo/ocran/issues
+
+## Description
+
+OCRAN (One-Click Ruby Application Next) builds Windows executables from Ruby
+source code. The executable is a self-extracting, self-running
+executable that contains the Ruby interpreter, your source code and
+any additionally needed ruby libraries or DLL.
+
+OCRAN is a fork of Ocra (https://github.com/larsch/ocra) in order to
+maintain compatibility with newer Ruby versions after 3.2
+
+## Recommended usage
+Most commonly you will needs this, when you want to ship your program to windows servers / users that don't have Ruby installed.
+By default each time the .exe is opened it will extract the ruby interpeter along with the code to the temp directory.
+Since this process takes time, we recommend using the innosetup edition which will install your program together with the ruby intepreter into
+a directory.
+
+## Features
+
+* LZMA Compression (optional, default on)
+* Both windowed/console mode supported
+* Includes gems based on usage, or from a Bundler Gemfile
+
+## Problems & Bug Reporting
+
+* Windows support only
+
+If you experience problems with OCRAN or have found a bug, please use
+the issue tracker on GitHub (http://github.com/largo/ocran/issues).
+
+## Safety
+
+As this gem comes with binary blobs, we have taken actions to insure your safety.
+The gem releases are securely built on Github Actions. Feel free verify that it matches the version on rubygems.
+This repository ships with LZMA.exe from [The official release of ip7z/7zip](https://github.com/ip7z/7zip/releases): Version 22.01 from lzma2201.7z
+The LZMA.exe is used to compress the executable.
+Other files such as stub.exe, stubw.exe and edicon.exe are built from source code in the repository.
+
+## Installation
+
+Gem:
+
+    gem install ocran
+
+Alternatively you can download the gem at either
+http://rubygems.org/gems/ocran or
+https://github.com/largo/ocran/releases/.
+
+## Synopsis
+
+### Building an executable:
+
+    ocran script.rb
+
+Will package `script.rb`, the Ruby interpreter and all
+dependencies (gems and DLLs) into an executable named
+`script.exe`.
+
+### Command line:
+  
+    ocran [options] script.rb [<other files> ...] [-- <script arguments> ...]
+
+### Options:
+
+    ocran --help
+
+Ocran options:
+
+    --help             Display this information.
+    --quiet            Suppress output while building executable.
+    --verbose          Show extra output while building executable.
+    --version          Display version number and exit.
+
+Packaging options:
+
+    --dll dllname      Include additional DLLs from the Ruby bindir.
+    --add-all-core     Add all core ruby libraries to the executable.
+    --gemfile <file>   Add all gems and dependencies listed in a Bundler Gemfile.
+    --no-enc           Exclude encoding support files
+
+Gem content detection modes:
+
+    --gem-minimal[=gem1,..]  Include only loaded scripts
+    --gem-guess=[gem1,...]   Include loaded scripts & best guess (DEFAULT)
+    --gem-all[=gem1,..]      Include all scripts & files
+    --gem-full[=gem1,..]     Include EVERYTHING
+    --gem-spec[=gem1,..]     Include files in gemspec (Does not work with Rubygems 1.7+)
+
+    --[no-]gem-scripts[=..]  Other script files than those loaded
+    --[no-]gem-files[=..]    Other files (e.g. data files)
+    --[no-]gem-extras[=..]   Extra files (README, etc.)
+
+Gem modes:
+
+* *minimal*: loaded scripts
+* *guess*: loaded scripts and other files
+* *all*: loaded scripts, other scripts, other files (except extras)
+* *full*: Everything found in the gem directory
+
+File groups:
+
+* *scripts*: .rb/.rbw files  
+* *extras*: C/C++ sources, object files, test, spec, README  
+* *files*: all other files  
+
+Auto-detection options:
+
+    --no-dep-run       Don't run script.rb to check for dependencies.
+    --no-autoload      Don't load/include script.rb's autoloads.
+    --no-autodll       Disable detection of runtime DLL dependencies.
+
+Output options:
+
+    --output <file>    Name the exe to generate. Defaults to ./<scriptname>.exe.
+    --no-lzma          Disable LZMA compression of the executable.
+    --innosetup <file> Use given Inno Setup script (.iss) to create an installer.
+
+Executable options:
+
+    --windows          Force Windows application (rubyw.exe)  
+    --console          Force console application (ruby.exe)  
+    --chdir-first      When exe starts, change working directory to app dir.  
+    --icon <ico>       Replace icon with a custom one.  
+    --rubyopt <str>    Set the RUBYOPT environment variable when running the executable
+    --debug            Executable will be verbose.  
+    --debug-extract    Executable will unpack to local dir and not delete after.  
+
+  
+### Compilation:
+
+* OCRAN will load your script (using `Kernel#load`) and build
+  the executable when it exits.
+
+* Your program should 'require' all necessary files when invoked without
+  arguments, so OCRAN can detect all dependencies.
+
+* DLLs are detected automatically but only those located in your Ruby
+  installation are included.
+
+* .rb files will become console applications. .rbw files will become
+  windowed application (without a console window popping
+  up). Alternatively, use the `--console` or
+  `--windows` options.
+
+### Running your application:
+
+* The 'current working directory' is not changed by OCRAN when running
+  your application. You must change to the installation or temporary
+  directory yourself. See also below.
+* When the application is running, the OCRAN_EXECUTABLE environment
+  variable points to the .exe (with full path).
+* The temporary location of the script can be obtained by inspected
+  the $0 variable.
+* OCRAN does not set up the include path. Use `$:.unshift
+  File.dirname($0)` at the start of your script if you need to
+  'require' additional source files from the same directory as your
+  main script.
+
+### Pitfalls:
+
+* Avoid modifying load paths at run time. Specify load paths using -I
+  or RUBYLIB if you must, but don't expect OCRAN to preserve them for
+  runtime. OCRAN may pack sources into other directories than you
+  expect.
+* If you use .rbw files or the `--windows` option, then check
+  that your application works with rubyw.exe before trying with OCRAN.
+* Avoid absolute paths in your code and when invoking OCRAN.
+
+### Multibyte path and filename support:
+
+* OCRAN-built executables can correctly handle multibyte paths and filenames
+  (e.g., Japanese or emoji) on Windows. To use this feature, the executable
+  must be run on Windows 10 version 1903 or later.
+* When using OCRAN-built executables from the console, we recommend running
+  `chcp 65001` to switch the code page to UTF-8. This ensures proper
+  input/output of multibyte characters in Command Prompt (CMD) and
+  PowerShell.
+
+## REQUIREMENTS:
+
+* Windows
+* Working Ruby installation.
+* Ruby Installation with devkit from rubyinstaller (when working with the source code only)
+
+## Development
+
+### Quick start
+
+Quickly set up the development environment and run the full test suite:
+
+    git clone https://github.com/largo/ocran.git
+    cd ocran
+    bin/setup          # install Bundler & all dev gems, generate stub for tests
+    bundle exec rake   # run the entire Minitest suite
+
+### Developer Utilities (bin/ scripts)
+
+All scripts in the `bin/` directory are designed for developers and can be executed in any standard Windows shell, including Command Prompt (CMD), PowerShell, and Git Bash.
+
+| Script        | Purpose                                                                  |
+|---------------|--------------------------------------------------------------------------|
+| `bin/setup`   | Installs Bundler and all required development gems, then builds stub.exe |
+| `bin/console` | Launches an IRB console with OCRAN preloaded                             |
+
+
+### Rake tasks (Windows compatible)
+
+| Task         | Purpose                                                                |
+|--------------|------------------------------------------------------------------------|
+| `rake build` | Compile stub.exe (requires MSVC or mingw‑w64 + DevKit)                 |
+| `rake clean` | Remove generated binaries (e.g., stub.exe); temp files are not deleted |
+| `rake test`  | Execute all unit & integration tests                                   |
+
+## Technical details
+
+OCRAN first runs the target script in order to detect any files that
+are loaded and used at runtime (Using `Kernel#require` and
+`Kernel#load`).
+
+OCRAN embeds everything needed to run a Ruby script into a single
+executable file. The file contains the .exe stub which is compiled
+from C-code, and a custom opcode format containing instructions to
+create directories, save files, set environment variables and run
+programs. The OCRAN script generates this executable and the
+instructions to be run when it is launched.
+
+When executed, the OCRAN stub extracts the Ruby interpreter and your
+scripts into a temporary directory. The directory will contains the
+same directory layout as your Ruby installlation. The source files for
+your application will be put in the 'src' subdirectory.
+
+### Libraries
+
+Any code that is loaded through `Kernel#require` when your
+script is executed will be included in the OCRAN
+executable. Conditionally loaded code will not be loaded and included
+in the executable unless the code is actually run when OCRAN invokes
+your script. Otherwise, OCRAN won't know about it and will not include
+the source files.
+
+RubyGems are handled specially. Whenever a file from a Gem is
+detected, OCRAN will attempt to include all the required files from
+that specific Gem, expect some unlikely needed files such as readme's
+and other documentation. This behaviour can be controlled by using the
+--gem-* options. Behaviour can be changed for all gems or specific
+gems using --gem-*=gemname.
+
+Libraries found in non-standard path (for example, if you invoke OCRAN
+with "ruby -I some/path") will be placed into the site dir
+(lib/ruby/site_ruby). Avoid changing `$LOAD_PATH` or
+`$:` from your script to include paths outside your source
+tree, since OCRAN may place the files elsewhere when extracted into the
+temporary directory.
+
+In case your script (or any of its dependencies) sets up autoloaded
+module using `Kernel#autoload`, OCRAN will automatically try to
+load them to ensure that they are all included in the
+executable. Modules that doesn't exist will be ignored (a warning will
+be logged).
+
+Dynamic link libraries (.dll files, for example WxWidgets, or other
+source files) will be detected and included by OCRAN.
+
+### Including libraries non-automatically
+
+If an application or framework is complicated enough that it tends
+to confuse Ocran's automatic dependency resolution, then you can
+use other means to specify what needs to be packaged with your app.
+
+To disable automatic dependency resolution, use the `--no-dep-run`
+option; with it, Ocran will skip executing your program during the
+build process. This on the other hand requires using `--gem-full` option
+(see more below); otherwise Ocran will not include all the necessary
+files for the gems.
+
+You will also probably need to use the `--add-all-core` option to
+include the Ruby core libraries.
+
+If your app uses gems, then you can specify them in a
+Bundler (http://gembundler.com) Gemfile, then use the --gemfile
+option to supply it to Ocran. Ocran will automatically include all
+gems specified, and all their dependencies.
+
+(Note: This assumes that the gems are installed in your system,
+*not* locally packaged inside the app directory by "bundle package")
+
+These options are particularly useful for packaging Rails
+applications.  For example, to package a Rails 3 app in the
+directory "someapp" and create an exe named "someapp.exe", without
+actually running the app during the build, you could use the
+following command:
+
+    ocran someapp/script/rails someapp --output someapp.exe --add-all-core \
+    --gemfile someapp/Gemfile --no-dep-run --gem-full --chdir-first -- server
+
+Note the space between `--` and `server`! It's important; `server` is
+an argument to be passed to rails when the script is ran.
+
+Rails 2 apps can be packaged similarly, though you will have to
+integrate them with Bundler (http://gembundler.com/rails23.html)
+first.
+
+### Gem handling
+
+By default, Ocran includes all scripts that are loaded by your script
+when it is run before packaging. Ocran detects which gems are using and
+includes any additional non-script files from those gems, except
+trivial files such as C/C++ source code, object files, READMEs, unit
+tests, specs, etc.
+
+This behaviour can be changed by using the --gem-* options. There are
+four possible modes:
+
+* *minimal*: Include only loaded scripts
+* *guess*: Include loaded scripts and important files (DEFAULT)
+* *all*: Include all scripts and important files
+* *full*: Include all files
+
+If you find that files are missing from the resulting executable, try
+first with --gem-all=gemname for the gem that is missing, and if that
+does not work, try --gem-full=gemname. The paranoid can use --gem-full
+to include all files for all required gems.
+
+### Creating an installer for your application
+
+To make your application start up quicker, or to allow it to
+keep files in its application directory between runs, or if
+you just want to make your program seem more like a "regular"
+Windows application, you can have Ocran generate an installer
+for your app with the free Inno Setup software.
+
+You will first have to download and install Inno Setup 5 or
+later, and also add its directory to your PATH (so that Ocran
+can find the ISCC compiler program). Once you've done that,
+you can use the `--innosetup` option to Ocran to supply an
+Inno Setup script. Do not add any [Files] or [Dirs] sections
+to the script; Ocran will figure those out itself.
+
+To continue the Rails example above, let's package the Rails 3
+app into an installer. Save the following as `someapp.iss`:
+
+  [Setup]
+  AppName=SomeApp
+  AppVersion=0.1
+  DefaultDirName={pf}\SomeApp
+  DefaultGroupName=SomeApp
+  OutputBaseFilename=SomeAppInstaller
+
+  [Icons]
+  Name: "{group}\SomeApp"; Filename: "{app}\someapp.bat"; IconFilename: "{app}\someapp.ico"; Flags: runminimized;
+  Name: "{group}\Uninstall SomeApp"; Filename: "{uninstallexe}"
+
+Then, run Ocran with this command:
+
+    ocran someapp/script/rails someapp --output someapp.exe --add-all-core \
+    --gemfile someapp/Gemfile --no-dep-run --gem-full --chdir-first --no-lzma \
+    --icon someapp.ico --innosetup someapp.iss -- server
+
+If all goes well, a file named "SomeAppInstaller.exe" will be placed
+into the Output directory.
+
+### Environment variables
+
+OCRAN executables clear the RUBYLIB environment variable before your
+script is launched. This is done to ensure that your script does not
+use load paths from the end user's Ruby installation.
+
+OCRAN executables set the RUBYOPT environment variable to the value it
+had when you invoked OCRAN. For example, if you had "RUBYOPT=rubygems"
+on your build PC, OCRAN ensures that it is also set on PC's running the
+executables.
+
+OCRAN executables set OCRAN_EXECUTABLE to the full path of the
+executable, for example
+
+    ENV["OCRAN_EXECUTABLE"] # => C:\Program Files\MyApp\MyApp.exe
+
+### Working directory
+
+The OCRAN executable does not change the working directory when it is
+launched, unless you use the `--chdir-first` option.
+
+You should not assume that the current working directory when invoking
+an executable built with .exe is the location of the source script. It
+can be the directory where the executable is placed (when invoked
+through the Windows Explorer), the users' current working directory
+(when invoking from the Command Prompt), or even
+`C:\\WINDOWS\\SYSTEM32` when the executable is invoked through
+a file association.
+
+With the `--chdir-first` option, the working directory will
+always be the common parent directory of your source files. This
+should be fine for most applications. However, if your application
+is designed to run from the command line and take filenames as
+arguments, then you cannot use this option.
+
+If you wish to maintain the user's working directory, but need to
+`require` additional Ruby scripts from the source directory, you can
+add the following line to your script:
+
+    $LOAD_PATH.unshift File.dirname($0)
+
+### Load path mangling
+
+Adding paths to `$LOAD_PATH` or `$:` at runtime is not
+recommended. Adding relative load paths depends on the working
+directory being the same as where the script is located (See
+above). If you have additional library files in directories below the
+directory containing your source script you can use this idiom:
+
+    $LOAD_PATH.unshift File.join(File.dirname($0), 'path/to/script')
+
+### Detecting
+
+You can detect whether OCRAN is currently building your script by
+looking for the 'Ocran' constant. If it is defined, OCRAN is currenly
+building the executable from your script. For example, you can use
+this to avoid opening a GUI window when compiling executables:
+
+    app = MyApp.new
+    app.main_loop unless defined?(Ocran)
+
+### Additional files and resources
+
+You can add additional files to the OCRAN executable (for example
+images) by appending them to the command line. They should be placed
+in the source directory with your main script (or a subdirectory).
+
+    ocran mainscript.rb someimage.jpeg docs/document.txt
+
+This will create the following layout in the temporary directory when
+your program is executed:
+
+    src/mainscript.rb
+    src/someimage.jpeg
+    src/docs/document.txt
+
+Both files, directoriess and glob patterns can be specified on the
+command line. Files will be added as-is. If a directory is specified,
+OCRAN will include all files found below that directory. Glob patterns
+(See Dir.glob) can be used to specify a specific set of files, for
+example:
+
+    ocran script.rb assets/**/*.png
+
+### Command Line Arguments
+
+To pass command line argument to your script (both while building and
+when run from the resulting executable), specify them after a
+`--` marker. For example:
+
+    ocran script.rb -- --some-options=value
+
+This will pass `--some-options=value` to the script when
+build and when running the executable. Any extra argument specified by
+the user when invoking the executable will be appended after the
+compile-time arguments.
+
+### Window/Console
+
+By default, OCRAN builds console application from .rb-files and
+windowed applications (without console window) from .rbw-files.
+
+Ruby on Windows provides two executables: ruby.exe is a console mode
+application and rubyw.exe is a windowed application which does not
+bring up a console window when launched using the Windows Explorer.
+By default, or if the `--console` option is used, OCRAN will
+use the console runtime (ruby.exe). OCRAN will automatically select the
+windowed runtime when your script has the ".rbw" extension, or if you
+specify the `--windows` command line option.
+
+If your application works in console mode but not in windowed mode,
+first check if your script works without OCRAN using rubyw.exe. A
+script that prints to standard output (using puts, print etc.) will
+eventually cause an exception when run with rubyw.exe (when the IO
+buffers run full).
+
+You can also try wrapping your script in an exception handler that
+logs any errors to a file:
+
+    begin
+      # your script here
+    rescue Exception => e
+      File.open("except.log") do |f|
+        f.puts e.inspect
+        f.puts e.backtrace
+      end
+    end
+
+## CREDITS:
+
+Lars Christensen and contributors for the OCRA project which this is forked from.
+
+Kevin Walzer of codebykevin, Maxim Samsonov for ocra2, John Mair for codesigining support (to be merged) 
+
+Thanks for Igor Pavlov for the LZMA compressor and decompressor. The
+source code used was place into Public Domain by Igor Pavlov.
+
+Erik Veenstra for rubyscript2exe which provided inspiration.
+
+Dice for the default .exe icon (vit-ruby.ico,
+http://ruby.morphball.net/vit-ruby-ico_en.html)
+
+## LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2009-2020 Lars Christensen
+Copyright (c) 2020-2025 The OCRAN Committers Team
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/lib/ocran/direction.rb

@@ -144,10 +144,36 @@ module Ocran
         end
       end
 
-      # Add external manifest files
+      # Add external manifest and builtin DLLs
       if (manifest = ruby_builtin_manifest)
-        say "Adding external manifest #{manifest}"
-        builder.duplicate_to_exec_prefix(manifest)
+        manifest.dirname.each_child do |path|
+          next if path.directory?
+          say "Adding builtin DLL/manifest #{path}"
+          builder.duplicate_to_exec_prefix(path)
+        end
+      end
+
+      # Include SxS assembly manifests for native extensions.
+      # Each .so file may have an embedded manifest referencing a companion
+      # *.so-assembly.manifest file in the same directory. Without these
+      # manifests the SxS activation context fails (error 14001) at runtime.
+      # Scan archdir and the extension dirs of all loaded gems.
+      sxs_manifest_dirs = []
+      archdir = Pathname(RbConfig::CONFIG["archdir"])
+      sxs_manifest_dirs << archdir if archdir.exist? && archdir.subpath?(exec_prefix)
+      if defined?(Gem)
+        Gem.loaded_specs.each_value do |spec|
+          next if spec.extensions.empty?
+          ext_dir = Pathname(spec.extension_dir)
+          sxs_manifest_dirs << ext_dir if ext_dir.exist? && ext_dir.subpath?(exec_prefix)
+        end
+      end
+      sxs_manifest_dirs.each do |dir|
+        dir.each_child do |path|
+          next unless path.extname == ".manifest"
+          say "Adding native extension assembly manifest #{path}"
+          builder.duplicate_to_exec_prefix(path)
+        end
       end
 
       # Add extra DLLs specified on the command line
@@ -209,15 +235,15 @@ module Ocran
       # If requested, add all ruby standard libraries
       if @option.add_all_core?
         say "Will include all ruby core libraries"
-        @pre_env.load_path.each do |load_path|
-          path = Pathname.new(load_path)
+        all_core_dir.each do |path|
           # Match the load path against standard library, site_ruby, and vendor_ruby paths
-          path.to_posix.match(RUBY_LIBRARY_PATH_REGEX) do |m|
-            subdir = m[1]
-            path.find.each do |src|
-              next if src.directory?
-              builder.copy_to_lib(src, Pathname(subdir) / src.relative_path_from(path))
-            end
+          unless (subdir = path.to_posix.match(RUBY_LIBRARY_PATH_REGEX)&.[](1))
+            raise "Unexpected library path format (does not match core dirs): #{path}"
+          end
+          path.find.each do |src|
+            next if src.directory?
+            a = Pathname(subdir) / src.relative_path_from(path)
+            builder.copy_to_lib(src, Pathname(subdir) / src.relative_path_from(path))
           end
         end
       end
@@ -312,6 +338,52 @@ module Ocran
         end
       end
 
+      # Bundle SSL certificates if OpenSSL was loaded (e.g. via net/http HTTPS)
+      if defined?(OpenSSL)
+        cert_file = Pathname(OpenSSL::X509::DEFAULT_CERT_FILE)
+        if cert_file.file? && cert_file.subpath?(exec_prefix)
+          say "Adding SSL certificate file #{cert_file}"
+          builder.duplicate_to_exec_prefix(cert_file)
+          builder.export("SSL_CERT_FILE", File.join(EXTRACT_ROOT, cert_file.relative_path_from(exec_prefix).to_posix))
+        end
+
+        cert_dir = Pathname(OpenSSL::X509::DEFAULT_CERT_DIR)
+        if cert_dir.directory? && cert_dir.subpath?(exec_prefix)
+          say "Adding SSL certificate directory #{cert_dir}"
+          cert_dir.find.each do |path|
+            next if path.directory?
+            builder.duplicate_to_exec_prefix(path)
+          end
+          builder.export("SSL_CERT_DIR", File.join(EXTRACT_ROOT, cert_dir.relative_path_from(exec_prefix).to_posix))
+        end
+      end
+
+      # Bundle Tcl/Tk library scripts if the Tk extension is loaded.
+      # tcl86.dll and tk86.dll are auto-detected by DLL scanning, but the
+      # Tcl/Tk script libraries (init.tcl etc.) must also be bundled so
+      # that Tcl can find them relative to the DLL at runtime.
+      if defined?(TclTkLib)
+        exec_prefix.glob("**/lib/tcl[0-9]*/init.tcl").each do |init_tcl|
+          tcl_lib_dir = init_tcl.dirname
+          next unless tcl_lib_dir.subpath?(exec_prefix)
+          say "Adding Tcl library files #{tcl_lib_dir}"
+          tcl_lib_dir.find.each do |path|
+            next if path.directory?
+            builder.duplicate_to_exec_prefix(path)
+          end
+        end
+
+        exec_prefix.glob("**/lib/tk[0-9]*/pkgIndex.tcl").each do |pkg_index|
+          tk_lib_dir = pkg_index.dirname
+          next unless tk_lib_dir.subpath?(exec_prefix)
+          say "Adding Tk library files #{tk_lib_dir}"
+          tk_lib_dir.find.each do |path|
+            next if path.directory?
+            builder.duplicate_to_exec_prefix(path)
+          end
+        end
+      end
+
       # Set environment variable
       builder.export("RUBYOPT", rubyopt)
       # Add the load path that are required with the correct path after

data/lib/ocran/host_config_helper.rb

@@ -33,5 +33,12 @@ module Ocran
     def ruby_exe
       @ruby_exe ||= (RbConfig::CONFIG["ruby_install_name"] || "ruby") + exe_extname
     end
+
+    def all_core_dir
+      RbConfig::CONFIG
+          .slice("rubylibdir", "sitelibdir", "vendorlibdir")
+          .values
+          .map { |path| Pathname.new(path) }
+    end
   end
 end

data/lib/ocran/library_detector.rb

@@ -49,7 +49,7 @@ module Ocran
                   end
         str = "\x00".encode("UTF-16LE") * MAX_PATH
         handles.map do |handle|
-          length = GetModuleFileNameW(handle, str, str.bytesize)
+          length = GetModuleFileNameW(handle, str, str.bytesize / 2)
           if length == 0
             raise "GetModuleFileNameW failed with error code #{GetLastError()}"
           end

data/lib/ocran/stub_builder.rb

@@ -8,7 +8,7 @@ module Ocran
   # instance of OcranBuilder.
   class StubBuilder
     Signature = [0x41, 0xb6, 0xba, 0x4e].freeze
-    OP_END = 0
+
     OP_CREATE_DIRECTORY = 1
     OP_CREATE_FILE = 2
     OP_SETENV = 3
@@ -28,6 +28,34 @@ module Ocran
 
     attr_reader :data_size
 
+    # Clear invalid security directory entries from PE executables
+    # This is necessary because some linkers may set non-zero values in the
+    # security directory even when there is no actual digital signature
+    def self.clear_invalid_security_entry(file_path)
+      data = File.binread(file_path)
+      return unless data.size > 64 # Minimum PE header size
+
+      # Read DOS header to find PE header offset
+      e_lfanew_offset = 60
+      pe_offset = data[e_lfanew_offset, 4].unpack1("L")
+      return if pe_offset + 160 > data.size # Not enough room for headers
+
+      # Calculate security directory offset
+      # PE signature (4) + FILE_HEADER (20) + partial OPTIONAL_HEADER to DataDirectory
+      security_entry_offset = pe_offset + 4 + 20 + 128
+
+      # Read security directory entry (VirtualAddress and Size)
+      sec_addr = data[security_entry_offset, 4].unpack1("L")
+      sec_size = data[security_entry_offset + 4, 4].unpack1("L")
+
+      # Check if security entry is invalid (points beyond file or size is 0)
+      if sec_size != 0 && (sec_addr == 0 || sec_addr >= data.size || sec_addr + sec_size > data.size)
+        # Clear the invalid security entry
+        data[security_entry_offset, 8] = "\x00" * 8
+        File.binwrite(file_path, data)
+      end
+    end
+
     # chdir_before:
     # When set to true, the working directory is changed to the application's
     # deployment location at runtime.
@@ -65,6 +93,9 @@ module Ocran
       IO.copy_stream(gui_mode ? STUBW_PATH : STUB_PATH, stub)
       stub.close
 
+      # Clear any invalid security directory entries from the stub
+      self.class.clear_invalid_security_entry(stub.path)
+
       if icon_path
         system(EDICON_PATH, stub.path, icon_path.to_s, exception: true)
       end
@@ -77,7 +108,6 @@ module Ocran
 
         b = proc {
           yield(self)
-          write_opcode(OP_END)
         }
 
         if enable_compression
@@ -184,13 +214,23 @@ module Ocran
         raise ArgumentError, "String length #{len} is too large: must be less than or equal to 65535 bytes including null terminator"
       end
 
-      @of << [len, str].pack("vZ*")
-      @data_size += 2 + len
+      write_size(len)
+      @of << [str].pack("Z*")
+      @data_size += len
     end
     private :write_string
 
     def write_string_array(*str_array)
       ary = str_array.map(&:to_s)
+
+      if ary.any?(&:empty?)
+         raise ArgumentError, "Argument list must not contain empty strings"
+      end
+
+      # Append an empty string so that when joined with "\0", the final buffer
+      # ends in two consecutive NUL bytes (double–NUL terminator) to mark end-of-list.
+      ary << ""
+
       size = ary.sum(0) { |s| s.bytesize + 1 }
       write_size(size)
       ary.each_slice(1) { |a| @of << a.pack("Z*") }

data/lib/ocran/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ocran
-  VERSION = "1.3.16"
+  VERSION = "1.3.18"
 end

metadata

@@ -1,21 +1,34 @@
 --- !ruby/object:Gem::Specification
 name: ocran
 version: !ruby/object:Gem::Version
-  version: 1.3.16
+  version: 1.3.18
 platform: ruby
 authors:
 - Andi Idogawa
 - Lars Christensen
-autorequire:
-bindir: bin
+bindir: exe
 cert_chain: []
-date: 2024-08-05 00:00:00.000000000 Z
-dependencies: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fiddle
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 description: "OCRAN (One-Click Ruby Application Next) builds Windows executables from
   Ruby source code. \n  The executable is a self-extracting, self-running executable
   that contains the Ruby interpreter, your source code and any additionally needed
   ruby libraries or DLL.\n  \n  This is a fork of OCRA that is compatible with ruby
-  version after 3.0.\n  Migration guide: make sure to write ocran instead of ocra
+  version after 3.2.\n  Migration guide: make sure to write ocran instead of ocra
   in your code. For instance: OCRAN_EXECUTABLE\n\n  usage: \n    ocra helloworld.rb\n
   \   helloworld.exe\n\n  See readme at https://github.com/largo/ocran\n  Report problems
   in the github issues. Contributions welcome.\n  This gem contains executables. We
@@ -27,7 +40,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- bin/ocran
+- CHANGELOG.txt
+- LICENSE.txt
+- README.md
+- exe/ocran
 - lib/ocran.rb
 - lib/ocran/build_constants.rb
 - lib/ocran/build_facade.rb
@@ -59,7 +75,6 @@ metadata:
   homepage_uri: https://github.com/largo/ocran
   source_code_uri: https://github.com/largo/ocran
   changelog_uri: https://github.com/largo/ocran/CHANGELOG.txt
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -67,15 +82,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key:
+rubygems_version: 4.0.3
 specification_version: 4
 summary: OCRAN (One-Click Ruby Application Next) builds Windows executables from Ruby
   source code.