rubygems-update 1.8.30 → 2.0.0.preview2

metadata.gz.sig

@@ -0,0 +1 @@
+�Me2�,�:���46�)���n?�s$�e����ȍ������M�oX~����Ǿ�.Jf�O�
���1�yu?�"�^���|���kP�j�

data/CVE-2013-4287.txt

@@ -1,36 +0,0 @@
-= Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
-
-RubyGems validates versions with a regular expression that is vulnerable to
-denial of service due to a backtracking regular expression.  For specially
-crafted RubyGems versions attackers can cause denial of service through CPU
-consumption.
-
-RubyGems versions 2.0.7 and older, 2.1.0.rc.1 and 2.1.0.rc.2 are vulnerable.
-
-Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded
-versions of RubyGems.
-
-It does not appear to be possible to exploit this vulnerability by installing a
-gem for RubyGems 1.8.x or 2.0.x.  Vulnerable uses of RubyGems API include
-packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask),
-sending user input to Gem::Version.new, Gem::Version.correct? or use of the
-Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
-constants.
-
-Notably, users of bundler that install gems from git are vulnerable if a
-malicious author changes the gemspec to an invalid version.
-
-The vulnerability can be fixed by changing the first grouping to an atomic
-grouping in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb.  For
-RubyGems 2.0.x:
-
-  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
-  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
-
-For RubyGems 1.8.x:
-
-  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*' # :nodoc:
-  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc:
-
-This vulnerability was discovered by Damir Sharipov <dammer2k@gmail.com>
-

data/CVE-2013-4363.txt

@@ -1,45 +0,0 @@
-= Algorithmic complexity vulnerability in RubyGems 2.1.4 and older
-
-The patch for CVE-2013-4287 was insufficiently verified so the combined
-regular expression for verifying gem version remains vulnerable following
-CVE-2013-4287.
-
-RubyGems validates versions with a regular expression that is vulnerable to
-denial of service due to backtracking.  For specially crafted RubyGems
-versions attackers can cause denial of service through CPU consumption.
-
-RubyGems versions 2.1.4 and older are vulnerable.
-
-Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded
-versions of RubyGems.
-
-It does not appear to be possible to exploit this vulnerability by installing a
-gem for RubyGems 1.8.x or newer.  Vulnerable uses of RubyGems API include
-packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask),
-sending user input to Gem::Version.new, Gem::Version.correct? or use of the
-Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
-constants.
-
-Notably, users of bundler that install gems from git are vulnerable if a
-malicious author changes the gemspec to an invalid version.
-
-The vulnerability can be fixed by changing the "*" repetition to a "?"
-repetition in Gem::Version::ANCHORED_VERSION_PATTERN in
-lib/rubygems/version.rb.  For RubyGems 2.1.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-For RubyGems 2.0.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-For RubyGems 1.8.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-
-This vulnerability was discovered by Alexander Cherepanov <cherepan@mccme.ru>
-

data/ci_build.sh

@@ -1,27 +0,0 @@
-# You must ensure that rake, hoe, and minitest are already installed in specified RVM interpreter
-export rvm_install_on_use_flag=1
-export rvm_gemset_create_on_use_flag=1
-rvm use $1
-. "$HOME/.rvm/environments/ruby-$1" # There seems to be a bug where 'rvm use' from within a script doesn't override default interpreter, so we have to manually source the rvm environment file for the proper interpreter
-
-# TODO: How can you make Hoe's check_extra_deps not use sudo?
-#rake check_extra_deps default
-# install gems manually for now
-gem install 'rake' --no-ri --no-rdoc
-gem install 'hoe' --no-ri --no-rdoc
-gem install 'builder' -v '~> 2.1' --no-ri --no-rdoc
-gem install 'hoe-seattlerb' -v '~> 1.2' --no-ri --no-rdoc
-gem install 'minitest' -v '~> 1.4' --no-ri --no-rdoc
-gem install 'session' -v '~> 2.4' --no-ri --no-rdoc
-gem install 'rubyforge' --no-ri --no-rdoc
-
-echo "----------------------------"
-echo "Build environment:"
-cat /etc/issue
-uname -a
-ruby -v
-gem env
-gem list
-echo "----------------------------"
-
-rake default

data/cruise_config.rb

@@ -1,32 +0,0 @@
-# Project-specific configuration for CruiseControl.rb
-require 'socket'
-
-Project.configure do |project|
-  # To add a build for a new interpreter (from ccrb root):
-  # ./cruise add RubyGems-x_y_z-pxxx -s git -r git://github.com/rubygems/rubygems.git
-  interpreter = Regexp.new(/RubyGems-(.*)$/i).match(project.name)[1]
-  interpreter.gsub!('_','.')
-
-  # only send notifications from the official ci box
-  if Socket.gethostname =~ /cibuilder.pivotallabs.com/
-    # explicitly enable dev list notification only for interpreters which should be green
-    interpreters_with_enabled_notification = [
-      '1.8.7-p330',
-      '1.9.1-p378',
-      '1.9.2-p136'
-    ]
-    if interpreters_with_enabled_notification.include?(interpreter)
-      project.email_notifier.emails = ['rubygems-developers@rubyforge.org']
-    end
-
-    # Always notify the following for all interpreters:
-    project.email_notifier.emails.concat([
-      'thewoolleyman+rubygems-ci@gmail.com'
-    ])
-  end
-
-  project.build_command = "./ci_build.sh '#{interpreter}@rubygems'"
-
-  project.email_notifier.from = 'thewoolleyman+rubygems-ci@gmail.com'
-  project.scheduler.polling_interval = 5.minutes
-end

data/lib/rbconfig/datadir.rb

@@ -1,13 +0,0 @@
-#--
-# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
-# All rights reserved.
-# See LICENSE.txt for permissions.
-#++
-
-# N.B. This file is used by Config.datadir in rubygems.rb, and must not be
-# removed before that require is removed. I require to avoid warning more than
-# once.
-
-warn 'rbconfig/datadir.rb and {Rb}Config.datadir is being deprecated from '\
- 'RubyGems. It will be removed completely on or after June 2011. If you '\
- 'wish to rely on a datadir, please use Gem.datadir.'

data/lib/rubygems/builder.rb

@@ -1,99 +0,0 @@
-#--
-# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
-# All rights reserved.
-# See LICENSE.txt for permissions.
-#++
-
-require 'rubygems'
-require 'rubygems/user_interaction'
-
-Gem.load_yaml
-
-require 'rubygems/package'
-
-##
-# The Builder class processes RubyGem specification files
-# to produce a .gem file.
-
-class Gem::Builder
-
-  include Gem::UserInteraction
-
-  ##
-  # Constructs a builder instance for the provided specification
-  #
-  # spec:: [Gem::Specification] The specification instance
-
-  def initialize(spec)
-    @spec = spec
-  end
-
-  ##
-  # Builds the gem from the specification.  Returns the name of the file
-  # written.
-
-  def build(skip_validation=false)
-    @spec.mark_version
-    @spec.validate unless skip_validation
-    @signer = sign
-    write_package
-    say success if Gem.configuration.verbose
-    File.basename @spec.cache_file
-  end
-
-  def success
-    <<-EOM
-  Successfully built RubyGem
-  Name: #{@spec.name}
-  Version: #{@spec.version}
-  File: #{File.basename @spec.cache_file}
-EOM
-  end
-
-  private
-
-  ##
-  # If the signing key was specified, then load the file, and swap to the
-  # public key (TODO: we should probably just omit the signing key in favor of
-  # the signing certificate, but that's for the future, also the signature
-  # algorithm should be configurable)
-
-  def sign
-    signer = nil
-
-    if @spec.respond_to?(:signing_key) and @spec.signing_key then
-      require 'rubygems/security'
-
-      signer = Gem::Security::Signer.new @spec.signing_key, @spec.cert_chain
-      @spec.signing_key = nil
-      @spec.cert_chain = signer.cert_chain.map { |cert| cert.to_s }
-    end
-
-    signer
-  end
-
-  def write_package
-    file_name = File.basename @spec.cache_file
-    open file_name, 'wb' do |gem_io|
-      Gem::Package.open gem_io, 'w', @signer do |pkg|
-        yaml = @spec.to_yaml
-        pkg.metadata = yaml
-
-        @spec.files.each do |file|
-          next if File.directory?(file)
-          next if file == file_name # Don't add gem onto itself
-
-          stat = File.stat(file)
-          mode = stat.mode & 0777
-          size = stat.size
-
-          pkg.add_file_simple file, mode, size do |tar_io|
-            tar_io.write open(file, "rb") { |f| f.read }
-          end
-        end
-      end
-    end
-  end
-
-end
-

data/lib/rubygems/custom_require.rb

@@ -1,69 +0,0 @@
-#--
-# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
-# All rights reserved.
-# See LICENSE.txt for permissions.
-#++
-
-module Kernel
-
-  if defined?(gem_original_require) then
-    # Ruby ships with a custom_require, override its require
-    remove_method :require
-  else
-    ##
-    # The Kernel#require from before RubyGems was loaded.
-
-    alias gem_original_require require
-    private :gem_original_require
-  end
-
-  ##
-  # When RubyGems is required, Kernel#require is replaced with our own which
-  # is capable of loading gems on demand.
-  #
-  # When you call <tt>require 'x'</tt>, this is what happens:
-  # * If the file can be loaded from the existing Ruby loadpath, it
-  #   is.
-  # * Otherwise, installed gems are searched for a file that matches.
-  #   If it's found in gem 'y', that gem is activated (added to the
-  #   loadpath).
-  #
-  # The normal <tt>require</tt> functionality of returning false if
-  # that file has already been loaded is preserved.
-
-  def require path
-    if Gem.unresolved_deps.empty? then
-      gem_original_require path
-    else
-      spec = Gem::Specification.find { |s|
-        s.activated? and s.contains_requirable_file? path
-      }
-
-      unless spec then
-        found_specs = Gem::Specification.find_in_unresolved path
-        unless found_specs.empty? then
-          found_specs = [found_specs.last]
-        else
-          found_specs = Gem::Specification.find_in_unresolved_tree path
-        end
-
-        found_specs.each do |found_spec|
-          found_spec.activate
-        end
-      end
-
-      return gem_original_require path
-    end
-  rescue LoadError => load_error
-    if load_error.message.start_with?("Could not find") or
-        (load_error.message.end_with?(path) and Gem.try_activate(path)) then
-      return gem_original_require(path)
-    end
-
-    raise load_error
-  end
-
-  private :require
-
-end
-

data/lib/rubygems/doc_manager.rb

@@ -1,243 +0,0 @@
-#--
-# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
-# All rights reserved.
-# See LICENSE.txt for permissions.
-#++
-
-require 'rubygems'
-
-##
-# The documentation manager generates RDoc and RI for RubyGems.
-
-class Gem::DocManager
-
-  include Gem::UserInteraction
-
-  @configured_args = []
-
-  def self.configured_args
-    @configured_args ||= []
-  end
-
-  def self.configured_args=(args)
-    case args
-    when Array
-      @configured_args = args
-    when String
-      @configured_args = args.split
-    end
-  end
-
-  ##
-  # Load RDoc from a gem if it is available, otherwise from Ruby's stdlib
-
-  def self.load_rdoc
-    begin
-      gem 'rdoc'
-    rescue Gem::LoadError
-      # use built-in RDoc
-    end
-
-    begin
-      require 'rdoc/rdoc'
-
-      @rdoc_version = if defined? RDoc::VERSION then
-                        Gem::Version.new RDoc::VERSION
-                      else
-                        Gem::Version.new '1.0.1' # HACK parsing is hard
-                      end
-
-    rescue LoadError => e
-      raise Gem::DocumentError,
-          "ERROR: RDoc documentation generator not installed: #{e}"
-    end
-  end
-
-  def self.rdoc_version
-    @rdoc_version
-  end
-
-  ##
-  # Updates the RI cache for RDoc 2 if it is installed
-
-  def self.update_ri_cache
-    load_rdoc rescue return
-
-    return unless defined? RDoc::VERSION # RDoc 1 does not have VERSION
-
-    require 'rdoc/ri/driver'
-
-    options = {
-      :use_cache => true,
-      :use_system => true,
-      :use_site => true,
-      :use_home => true,
-      :use_gems => true,
-      :formatter => RDoc::RI::Formatter,
-    }
-
-    RDoc::RI::Driver.new(options).class_cache
-  end
-
-  ##
-  # Create a document manager for +spec+. +rdoc_args+ contains arguments for
-  # RDoc (template etc.) as a String.
-
-  def initialize(spec, rdoc_args="")
-    require 'fileutils'
-    @spec = spec
-    @doc_dir = spec.doc_dir
-    @rdoc_args = rdoc_args.nil? ? [] : rdoc_args.split
-  end
-
-  ##
-  # Is the RDoc documentation installed?
-
-  def rdoc_installed?
-    File.exist?(File.join(@doc_dir, "rdoc"))
-  end
-
-  ##
-  # Is the RI documentation installed?
-
-  def ri_installed?
-    File.exist?(File.join(@doc_dir, "ri"))
-  end
-
-  ##
-  # Generate the RI documents for this gem spec.
-  #
-  # Note that if both RI and RDoc documents are generated from the same
-  # process, the RI docs should be done first (a likely bug in RDoc will cause
-  # RI docs generation to fail if run after RDoc).
-
-  def generate_ri
-    setup_rdoc
-    install_ri # RDoc bug, ri goes first
-
-    FileUtils.mkdir_p @doc_dir unless File.exist?(@doc_dir)
-  end
-
-  ##
-  # Generate the RDoc documents for this gem spec.
-  #
-  # Note that if both RI and RDoc documents are generated from the same
-  # process, the RI docs should be done first (a likely bug in RDoc will cause
-  # RI docs generation to fail if run after RDoc).
-
-  def generate_rdoc
-    setup_rdoc
-    install_rdoc
-
-    FileUtils.mkdir_p @doc_dir unless File.exist?(@doc_dir)
-  end
-
-  ##
-  # Generate and install RDoc into the documentation directory
-
-  def install_rdoc
-    rdoc_dir = File.join @doc_dir, 'rdoc'
-
-    FileUtils.rm_rf rdoc_dir
-
-    say "Installing RDoc documentation for #{@spec.full_name}..."
-    run_rdoc '--op', rdoc_dir
-  end
-
-  ##
-  # Generate and install RI into the documentation directory
-
-  def install_ri
-    ri_dir = File.join @doc_dir, 'ri'
-
-    FileUtils.rm_rf ri_dir
-
-    say "Installing ri documentation for #{@spec.full_name}..."
-    run_rdoc '--ri', '--op', ri_dir
-  end
-
-  ##
-  # Run RDoc with +args+, which is an ARGV style argument list
-
-  def run_rdoc(*args)
-    args << @spec.rdoc_options
-    args << self.class.configured_args
-    args << @spec.require_paths.clone
-    args << @spec.extra_rdoc_files
-    args << '--title' << "#{@spec.full_name} Documentation"
-    args << '--quiet'
-    args = args.flatten.map do |arg| arg.to_s end
-
-    if self.class.rdoc_version >= Gem::Version.new('2.4.0') then
-      args.delete '--inline-source'
-      args.delete '--promiscuous'
-      args.delete '-p'
-      args.delete '--one-file'
-      # HACK more
-    end
-
-    debug_args = args.dup
-
-    r = RDoc::RDoc.new
-
-    old_pwd = Dir.pwd
-    Dir.chdir @spec.full_gem_path
-
-    say "rdoc #{args.join ' '}" if Gem.configuration.really_verbose
-
-    begin
-      r.document args
-    rescue Errno::EACCES => e
-      dirname = File.dirname e.message.split("-")[1].strip
-      raise Gem::FilePermissionError.new(dirname)
-    rescue Interrupt => e
-      raise e
-    rescue Exception => ex
-      alert_error "While generating documentation for #{@spec.full_name}"
-      ui.errs.puts "... MESSAGE:   #{ex}"
-      ui.errs.puts "... RDOC args: #{debug_args.join(' ')}"
-      ui.errs.puts "\t#{ex.backtrace.join "\n\t"}" if
-        Gem.configuration.backtrace
-      terminate_interaction 1
-    ensure
-      Dir.chdir old_pwd
-    end
-  end
-
-  def setup_rdoc
-    if File.exist?(@doc_dir) && !File.writable?(@doc_dir) then
-      raise Gem::FilePermissionError.new(@doc_dir)
-    end
-
-    FileUtils.mkdir_p @doc_dir unless File.exist?(@doc_dir)
-
-    self.class.load_rdoc
-  end
-
-  ##
-  # Remove RDoc and RI documentation
-
-  def uninstall_doc
-    base_dir = @spec.base_dir
-    raise Gem::FilePermissionError.new base_dir unless File.writable? base_dir
-
-    # TODO: ok... that's twice... ugh
-    old_name = [
-      @spec.name, @spec.version, @spec.original_platform].join '-'
-
-    doc_dir = @spec.doc_dir
-    unless File.directory? doc_dir then
-      doc_dir = File.join File.dirname(doc_dir), old_name
-    end
-
-    ri_dir = @spec.ri_dir
-    unless File.directory? ri_dir then
-      ri_dir = File.join File.dirname(ri_dir), old_name
-    end
-
-    FileUtils.rm_rf doc_dir
-    FileUtils.rm_rf ri_dir
-  end
-
-end
-