ocran 1.4.5 → 1.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85cce39e5b93c48ccd16ecc3ad73f214a2349c2b203ff242fb1d478a78fbd5b9
-  data.tar.gz: f6ac990c20617164a68d70cd91e38e42afd12889c247f82204684d1843bb26ae
+  metadata.gz: 9898f2fb5230aa7ee4f9bec0b47da2609bed63b37042b7ccb2b0dce9a694f25b
+  data.tar.gz: a3ae88ab734250742900487fa9a4dd3b862da930f11c9f656959b197efc7d24c
 SHA512:
-  metadata.gz: 598cfd6fa803707a732ec8c10687f221b2a0618570377655a7414bcb94d9744d59364ade26ddc5b379fd72daf40adf8d001eccdac3d7af0ab20a69dfbafe1500
-  data.tar.gz: 83311e9e259a7c91f99ab6860529bd3ede2d706b3737451707f7488291679ae0ceb49bddb110128b6413f7d99b38f4b06bdd0a2362acf56a0afb9269bb41ae82
+  metadata.gz: 94b73edf3033cbda84a6d8f5d446b23acdffac467ac06c2881821c3caccb479bf5673e69662c96735d17cc2bfc0db43d0b44a0613e094c1e4251eac3cf915919
+  data.tar.gz: a6fb23433b4fca4ed3379a8486b6202a7c1c0272799034ee28543ab8c137f7d3fd8b04ad23f1a87f2012f98ec65505297e6bc51a90247426676170a1cc909151

data/CHANGELOG.txt

@@ -1,3 +1,9 @@
+=== 1.4.6
+- Applications no longer carry gems that only OCRAN itself activated. The gem scan read Gem.loaded_specs while the build was already running instead of the snapshot taken after the dependency run, so whatever OCRAN had activated by then was packed as if the application had loaded it: OCRAN's own gem and its fiddle dependency, activated by the `ocran` command of an installed OCRAN (since OCRA 1.3.2, which started packing every gem in Gem.loaded_specs; about 390 KB of stubs, lzma.exe and sources per application), and since 1.3.16, whose refactoring moved the build ahead of the gem scan, also tempfile, tmpdir, fileutils, delegate and etc from the stub builder and fiddle from DLL detection. The scan now uses the snapshot and leaves out the running OCRAN's gem and its runtime dependencies. Only activation is discounted: a gem the application does load is still packed. The same snapshot decides which gems' SxS assembly manifests are included on Windows.
+- Gems that Bundler installed into a configured path are found without Bundler (issue #61). ruby/setup-ruby with `bundler-cache: true` - the README's GitHub Actions example - installs the Gemfile's gems into vendor/bundle, a place plain RubyGems never looks, so `ocran app.rb` died with a LoadError on the first gem during the dependency run, `--gemfile` included. Before loading the script OCRAN now asks Bundler, in a child process and without evaluating the Gemfile, where the application's bundle is installed, and adds that directory to the gem path when it is not the system gems. The bundle is not set up, so gems the Gemfile does not list stay loadable as before; a bundle installed into the system gems and `bundle exec` are unaffected.
+- On Windows, an `--output` name without an extension now gets .exe (names ending in .exe or .com are used as given). The name used to be taken verbatim, so `ocran myapp.rb --output myapp` - the README's GitHub Actions example, whose comment promised myapp.exe - produced an extensionless `myapp` that Windows does not run. Other platforms keep the name as given. New CI workflow test-readme-actions.yml runs that example step for step on Windows, Linux and both macOS architectures against OCRAN from the commit under test.
+- Repository: removed a Ruby 3.3 bundle (vendor/bundle, 4,586 files), .bundle/config and a stray .ape-1.10 binary that a merge commit had checked in on 2026-08-09, and ignore them from now on. The bundle's binstubs call `ruby3.3`, which CI runners do not have, so every Ruby 3.3 test job failed before running a test once the bundler cache no longer replaced them; the jobs' cache-version is bumped to drop the caches that restored them. None of it was ever part of a published gem.
+
 === 1.4.5
 - Windows: detected DLLs are now also bundled into bin, next to ruby.exe, whenever they are not already resolvable from where they get packed. The Windows loader resolves a native extension's imports from the extension's own directory, ruby.exe's application directory (bin) plus its ruby_builtin_dlls SxS assembly, and the system directories - PATH is not consulted on hardened systems, and the AddDllDirectory route gems take through ruby_installer/runtime does not exist in a packed app. A DLL loaded from a gem's own tree (e.g. FreeTDS, which tiny_tds ships under ports/), from a devkit's msys64 tree inside the Ruby prefix, or from outside the prefix entirely was packed only at that original location, which the loader never searches, so the packaged application died at require time with a misleading LoadError on machines where a rich PATH did not mask the gap - the out-of-prefix case was skipped entirely by a guard that made its copy_to_bin branch unreachable. DLLs from the Windows directory keep coming from the target system and are never bundled. Companion DLLs found next to native extensions (e.g. libssl-3-x64.dll beside openssl.so in archdir) go into bin as well: a copy in archdir only helps extensions in archdir itself, while the same extension packed at a gem path (openssl and psych are gems since Ruby 3.x) resolves its imports from bin.
 - `--cosmo-ruby`: a native gem now also counts as provided by the payload when the payload can resolve the gem's primary feature, not only when the payload has a gemspec of that name. A gemspec is not what makes a library requirable - an extension linked into the APE, or a library in the interpreter's embedded stdlib, answers `require` with nothing under /zip/lib/ruby/gems/*/specifications - so gems such as cgi and pathname (both compiled into CosmoRuby, and both ordinary native gems on Ruby 3.4+) were reported incompatible and refused builds that work. The probe runs the payload once using $LOAD_PATH.resolve_feature_path, which searches exactly as require does, built-in extensions included, but executes none of the code it finds.

data/README.md

@@ -1,5 +1,7 @@
 # OCRAN
 
+![OCRAN: ship your Ruby app as one file, no Ruby needed to run it](docs/social/twitter-card.png)
+
 [OCRAN (One-Click Ruby Application Next)](https://github.com/largo/ocran) packages Ruby applications for
 distribution. It bundles your script, the Ruby interpreter, gems, and native
 libraries into a single self-contained artifact that runs without requiring

data/lib/ocran/direction.rb

@@ -191,8 +191,7 @@ module Ocran
         end
       end
       if defined?(Gem)
-        foreign = foreign_bundle_gem_names
-        specs += Gem.loaded_specs.each_value.reject { |spec| foreign.include?(spec.name) }
+        specs += application_loaded_specs
         # Now, we also detect gems that are not included in Gem.loaded_specs.
         # Therefore, we look for any loaded file from a gem path.
         specs += GemSpecQueryable.detect_gems_from(features, verbose: @option.verbose?)
@@ -202,6 +201,46 @@ module Ocran
       specs
     end
 
+    # The gems RubyGems had activated when the dependency run ended, less
+    # those that are not the application's.
+    #
+    # Read from the snapshot taken with the loaded features, not from
+    # Gem.loaded_specs, which by now also holds what OCRAN activated for the
+    # build itself - fiddle for DLL detection, tempfile with tmpdir,
+    # fileutils, delegate and etc for the builder - and which every
+    # application used to get packed since 1.3.16 moved the build ahead of
+    # the gem scan. OCRAN's own gem and its runtime dependencies (fiddle) are
+    # dropped as well: the `ocran` command activates them before the
+    # dependency run starts, and since OCRA 1.3.2 they were packed into
+    # every application built from an installed OCRAN, although nothing in a
+    # packaged application loads OCRAN. Only activation is discounted: an
+    # application that does load one of them still gets it packed through
+    # detect_gems_from.
+    def application_loaded_specs
+      @application_loaded_specs ||= begin
+        excluded = foreign_bundle_gem_names | ocran_gem_names
+        @post_env.loaded_specs.reject { |spec| excluded.include?(spec.name) }
+      end
+    end
+
+    # The names of the gem this OCRAN runs from and of the gems it activated
+    # as its runtime dependencies. Empty when OCRAN does not run from an
+    # installed gem, as from a source checkout.
+    def ocran_gem_names
+      specs = @post_env.loaded_specs.to_h { |spec| [spec.name, spec] }
+      own = specs.each_value.find { |spec| Pathname(__dir__).subpath?(spec.gem_dir) }
+      names = Set.new
+      queue = own ? [own] : []
+      while (spec = queue.shift)
+        next unless names.add?(spec.name)
+
+        spec.runtime_dependencies.each do |dep|
+          queue << specs[dep.name] if specs.key?(dep.name)
+        end
+      end
+      names
+    end
+
     # The gems RubyGems had already activated for a bundle that is not the
     # application's, by the time OCRAN started.
     #
@@ -560,7 +599,7 @@ module Ocran
         archdir = Pathname(RbConfig::CONFIG["archdir"])
         sxs_manifest_dirs << archdir if archdir.exist? && archdir.subpath?(exec_prefix)
         if defined?(Gem)
-          Gem.loaded_specs.each_value do |spec|
+          application_loaded_specs.each do |spec|
             next if spec.extensions.empty?
             ext_dir = Pathname(spec.extension_dir)
             sxs_manifest_dirs << ext_dir if ext_dir.exist? && ext_dir.subpath?(exec_prefix)

data/lib/ocran/option.rb

@@ -277,7 +277,15 @@ EOF
 
       @options[:output_executable] =
         if output_override
-          output_override
+          # Windows runs a program only by its extension, so a name given
+          # without .exe - `--output myapp`, as a build script shared with
+          # Linux and macOS writes it - gets one there. .exe and .com names
+          # are used as given.
+          if Gem.win_platform? && !output_override.extname?(".exe") && !output_override.extname?(".com")
+            Pathname("#{output_override}.exe")
+          else
+            output_override
+          end
         else
           executable = script
           # If debug mode is enabled, append "-debug" to the filename

data/lib/ocran/runner.rb

@@ -49,6 +49,7 @@ module Ocran
       else
         warn_about_foreign_bundle
       end
+      expose_bundle_install_path
       say "Loading script to check dependencies"
       $PROGRAM_NAME = @option.script.to_s
     end
@@ -110,6 +111,58 @@ module Ocran
               (app_gemfile ? "; pass --gemfile #{app_gemfile} to package against that bundle" : "")
     end
 
+    # `bundle install` puts the gems where Bundler is configured to put them,
+    # and a configured path - `bundle config set path vendor/bundle`, which is
+    # what ruby/setup-ruby's `bundler-cache: true` does - is a place only
+    # Bundler looks. The dependency run loads the script as plain Ruby, so
+    # its first `require` of a gem from such a bundle raised LoadError
+    # although the bundle was installed (github issue #61).
+    #
+    # Add the bundle's install directory to the gem path. Its gems become
+    # visible exactly as if they had been installed into Ruby's own gem
+    # directory, and nothing more: setting the bundle up would also hide
+    # every gem the Gemfile does not list, breaking scripts that work today.
+    # A bundle installed into the system gems, the ordinary case outside CI,
+    # changes nothing, and under `bundle exec` Bundler has already put its
+    # gems on the gem path.
+    def expose_bundle_install_path
+      return if @pre_env.bundler_setup_loaded?
+
+      gemfile = @option.application_gemfile or return
+      path = bundle_install_path(gemfile) or return
+      return if Gem.path.any? { |gem_path| same_file?(gem_path, path) }
+
+      verbose "Adding #{path}, where the bundle of #{gemfile} is installed, to the gem path"
+      Gem.paths = { "GEM_HOME" => Gem.dir, "GEM_PATH" => (Gem.path + [path]).join(File::PATH_SEPARATOR) }
+    end
+
+    # Ruby run in a child process to print where Bundler installs the bundle
+    # of BUNDLE_GEMFILE, or nothing when that is the system gems.
+    BUNDLE_PATH_QUERY = <<~RUBY
+      require "bundler"
+      print Bundler.bundle_path unless Bundler.configured_bundle_path.use_system_gems?
+    RUBY
+    private_constant :BUNDLE_PATH_QUERY
+
+    # The directory the bundle of the given Gemfile is installed into when
+    # that is not the system gems, or nil. Bundler decides it from its
+    # settings - .bundle/config beside the Gemfile, the user's configuration
+    # and BUNDLE_* variables - without evaluating the Gemfile.
+    #
+    # Asked in a child process: loading Bundler here, before the dependency
+    # run, would put Bundler's files among the script's loaded features and
+    # pack them into every application with a Gemfile.
+    def bundle_install_path(gemfile)
+      env = { "BUNDLE_GEMFILE" => gemfile.to_s, "RUBYOPT" => nil, "BUNDLER_SETUP" => nil }
+      path = IO.popen(env, [RbConfig.ruby, "-e", BUNDLE_PATH_QUERY], err: File::NULL, &:read)
+      return nil unless $?.success? && !path.empty? && File.directory?(path)
+
+      path
+    rescue SystemCallError => e
+      verbose "Could not ask Bundler where the bundle of #{gemfile} is installed: #{e.message}"
+      nil
+    end
+
     # The Gemfile this process was started against, if any.
     def active_bundler_gemfile
       return ENV["BUNDLE_GEMFILE"] unless ENV["BUNDLE_GEMFILE"].to_s.empty?

data/lib/ocran/runtime_environment.rb

@@ -15,18 +15,26 @@ module Ocran
     # under.
     BUNDLER_SETUP_FEATURE = %r{[\\/]bundler[\\/]setup\.rb\z}
 
-    attr_reader :env, :load_path, :loaded_features, :pwd, :activated_gems
+    attr_reader :env, :load_path, :loaded_features, :pwd, :loaded_specs
 
     def initialize
       @env = ENV.to_hash.freeze
       @load_path = $LOAD_PATH.dup.freeze
       @loaded_features = $LOADED_FEATURES.dup.freeze
       @pwd = Dir.pwd.freeze
-      # The gems RubyGems had activated at this point. Under `bundle exec`
-      # that is the entire bundle, activated before OCRAN's first line runs,
-      # so a snapshot taken before the dependency run is what tells the build
-      # environment's gems apart from the application's.
-      @activated_gems = (defined?(Gem) ? Gem.loaded_specs.keys : []).freeze
+      # The specs of the gems RubyGems had activated at this point. Taken
+      # with the loaded features for the same reason: OCRAN goes on to
+      # activate gems of its own while it builds (fiddle for DLL detection,
+      # tempfile for the builder, ...), and those are not the application's.
+      # Under `bundle exec` the snapshot taken before the dependency run is
+      # the entire bundle, activated before OCRAN's first line runs, which is
+      # what tells the build environment's gems apart from the application's.
+      @loaded_specs = (defined?(Gem) ? Gem.loaded_specs.values : []).freeze
+    end
+
+    # The names of the gems in #loaded_specs.
+    def activated_gems
+      @loaded_specs.map(&:name)
     end
 
     # Whether Bundler had already set this process up when the snapshot was

data/lib/ocran/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ocran
-  VERSION = "1.4.5"
+  VERSION = "1.4.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ocran
 version: !ruby/object:Gem::Version
-  version: 1.4.5
+  version: 1.4.6
 platform: ruby
 authors:
 - Andi Idogawa
@@ -116,7 +116,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: OCRAN (One-Click Ruby Application Next) packages Ruby applications for distribution
   on Windows, Linux, and macOS.