rubygems-update 2.4.4 → 2.7.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: d45335473804839a55a75fa236d648bcd9f33b17
-  data.tar.gz: ace593b2f7f8b001fe67f038b0f6f9a3a837411a
+SHA256:
+  metadata.gz: 2fd65b08de35370803c876822126dbfa9022a6702679170bb7b0438d2fa2e6c9
+  data.tar.gz: f3a0661f0e4df43931639f54ed9b27fe1c25d358f1fe336dfec1f836188a4887
 SHA512:
-  metadata.gz: d255ea71d77bd18fa781c6076dec28c3383818575e53876d912ff07b4ce504cfbf0d56c3cfe529d8bd09cadc7e46309bafd146fdaf9c20b8164a2f8d57a38848
-  data.tar.gz: e625369d791159e76f18eaab91d52d3cdb8f4519e1cabeb27903e38ad25db9ff0614ca3796d33dd3e1ecae297e8a2afca7d741f5187f041a8ce91aa09acdc71b
+  metadata.gz: 65f66d7f93527f0bc04a19d788a7aeb43488348951b6d507f31dfbb97d80bba52a0c9dfc6eda7e8d4a1906ce2b39ed1d1182bc9e16031cf40d89e3ae2591dc14
+  data.tar.gz: 8d069f6b20f3210fe3332343077b5cba38df8c601599479ad82f79075f6d132ce040163286a5588222b6b6b8c37a234d9eac9411e3734a6166033954f8b4b957

data/.travis.yml

@@ -0,0 +1,58 @@
+---
+after_script:
+- util/ci after_script
+before_script:
+- util/ci before_script
+language: ruby
+dist: trusty
+sudo: required
+branches:
+  only:
+    - master
+    - auto
+    - /^[\d.]+$/
+    - /.+-stable$/
+rvm:
+- 1.8.7
+- 1.9.2
+- 1.9.3
+- 2.0.0
+- 2.1.10
+- 2.2.9
+- 2.3.6
+- 2.4.3
+- ruby-head
+env:
+  - "TEST_TOOL=rubygems YAML=syck"
+  - "TEST_TOOL=rubygems YAML=psych"
+  - "TEST_TOOL=bundler RGV=master"
+script:
+- util/ci script
+matrix:
+  exclude:
+    - rvm: 1.8.7
+      env: "TEST_TOOL=rubygems YAML=psych"
+    - rvm: 1.9.2
+      env: "TEST_TOOL=bundler RGV=master"
+    - rvm: 2.0.0
+      env: "TEST_TOOL=rubygems YAML=syck"
+    - rvm: 2.1.10
+      env: "TEST_TOOL=rubygems YAML=syck"
+    - rvm: 2.2.9
+      env: "TEST_TOOL=rubygems YAML=syck"
+    - rvm: 2.3.6
+      env: "TEST_TOOL=rubygems YAML=syck"
+    - rvm: 2.4.3
+      env: "TEST_TOOL=rubygems YAML=syck"
+    - rvm: ruby-head
+      env: "TEST_TOOL=rubygems YAML=syck"
+  allow_failures:
+    - rvm: 1.8.7
+      env: "TEST_TOOL=bundler RGV=master"
+    - rvm: 1.9.3
+      env: "TEST_TOOL=bundler RGV=master"
+    - rvm: 2.0.0
+      env: "TEST_TOOL=bundler RGV=master"
+    - rvm: 2.1.10
+      env: "TEST_TOOL=bundler RGV=master"
+    - rvm: ruby-head

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,43 @@
+# Contributor Code of Conduct
+
+### Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+### Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+### Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+### Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+### Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the [project team](MAINTAINERS.txt). All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+### Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 1.4, available at http://contributor-covenant.org/version/1/4.

data/CONTRIBUTING.rdoc

@@ -0,0 +1,130 @@
+= How to contribute
+
+Community involvement is essential to RubyGems. We want to keep it as easy
+as possible to contribute changes. There are a few guidelines that we need
+contributors to follow to reduce the time it takes to get changes merged in.
+
+== Guidelines
+
+1. New features should be coupled with tests.
+
+2. Ensure that your code blends well with ours:
+   * No trailing whitespace
+   * Match indentation (two spaces)
+   * Match coding style (+if+, +elsif+, +when+ need trailing +then+)
+
+3. If any new files are added or existing files removed in a commit or PR, please update the +Manifest.txt+ accordingly.
+
+4. Don't modify the history file or version number.
+
+5. If you have any questions, just ask on IRC in #rubygems on Freenode or file
+   an issue here: http://github.com/rubygems/rubygems/issues
+
+For more information and ideas on how to contribute to RubyGems ecosystem, see
+here: http://guides.rubygems.org/contributing/
+
+== Getting Started
+
+    $ gem install hoe
+    $ rake newb
+
+To run commands like <tt>gem install</tt> from the repo:
+
+    $ ruby -Ilib bin/gem install
+
+== Issues
+
+RubyGems uses labels to track all issues and pull requests. In order to provide
+guidance to the community this is documentation of how labels are used in the
+rubygems repository.
+
+=== Contribution
+
+These labels are made to guide contributors to issue/pull requests that they
+can help with. That are marked with a light gray <tt>contribution: *</tt>
+
+* *small* - The issue described here will take a small amount of work to resolve,
+  and is a good option for a new contributor
+* *unclaimed* - The issue has not been claimed for work, and is awaiting willing
+  volunteers!
+
+=== Type
+
+Most Issues or pull requests will have a light green <tt>type: *</tt> label, 
+which describes the type of the issue or pull request.
+
+* <b>bug report</b> - An issue describing a bug in rubygems. This would be something
+  that is broken, confusing, unexpected behavior etc.
+* <b>bug fix</b> - A pull request that fixes a bug report.
+* <b>feature request</b> - An issue describing a request for a new feature or
+  enhancement.
+* <b>feature implementation</b> - A pull request implementing a feature request.
+* *question* - An issue that is a more of a question than a call for specific
+  changes in the codebase.
+* *cleanup* - Generally for a pull request that improves the code base without
+  fixing a bug or implementing a feature.
+* <b>major bump</b> - This issue or pull request requires a major version bump
+* *administrative* - This issue relates to administrative tasks that need to
+  take place as it relates to rubygems
+* *documentation* - This issue relates to improving the documentation for
+  in this repo. Note that much of the rubygems documentation is here:
+  https://github.com/rubygems/guides
+
+=== Workflow / Status
+
+The light yellow <tt>status: *</tt> labels that indicate the state of an 
+issue, where it is in the process from being submitted to being closed. 
+These are listed in rough  progression order from submitted to closed.
+
+* *triage* - This is an issue or pull request that needs to be properly
+  labeled by by a maintainer.
+* *confirmed* - This issue/pull request has been accepted as valid, but
+  is not yet immediately ready for work.
+* <b>ready</b> - An issue that is available for collaboration. This issue
+  should have existing discussion on the problem, and a description of how to go
+  about solving it.
+* <b>working</b> - An issue that has a specific invidual assigned to and planning
+  to do work on it.
+* <b>user feedback required</b> - The issue/pull request is blocked pending more
+  feedback from an end user
+* <b>blocked / backlog</b> - the issue/pull request is currently unable to move forward
+  because of some specific reason, generally this will be a reason that is outside
+  RubyGems or needs feedback from some specific individual or group, and it may
+  be a while before something it is resolved.
+
+=== Closed Reason
+
+Reasons are why an issue / pull request was closed without being worked on or
+accepted. There should also be more detailed information in the comments. The
+closed reason labels are maroon <tt>closed: *</tt>.
+
+* *duplicate* - This is a duplicate of an existing bug. The comments must
+  reference the existing issue.
+* *abandonded* - This is an issue/pull request that has aged off, is no longer
+  applicable or similar.
+* *declined* - An issue that won't be fixed/implemented or a pull request that
+  is not accepted.
+* *deprecated* - An issue/pull request that no longer applies to the actively
+  maintained codebase.
+* *discussion* - An issue/pull that is no longer about a concrete change, and
+  is instead being used for discussion.
+
+=== Categories
+
+These are aspects of the codebase, or what general area the issue or pull
+request pertains too. Not all issues will have a category. All categorized
+issues have a blue <tt>category: *</tt> label.
+
+* *gemspec* - related to the gem specification itself
+* *API* - related to the public supported rubygems API. This is the code API,
+  not a network related API.
+* *command* - related to something in <tt>Gem::Commands</tt>
+* *install* - related to gem installations
+* *documentation* - related to updating / fixing / clarifying documentation or
+  guides
+
+=== Platforms
+
+If an issue or pull request pertains to only one platform, then it should have
+an appropriate purple <tt>platform: *</tt> label. Current platform labels:
+*windows*, *java*, *osx*, *linux*

data/CVE-2015-3900.txt

@@ -0,0 +1,40 @@
+= Request hijacking vulnerability in RubyGems 2.4.6 and earlier
+
+RubyGems provides the ability of a domain to direct clients to a separate
+host that is used to fetch gems and make API calls against. This mechanism
+is implemented via DNS, specificly a SRV record _rubygems._tcp under the
+original requested domain.
+
+For example, this is the one that users who use rubygems.org see:
+
+  > dig _rubygems._tcp.rubygems.org SRV
+
+  ;; ANSWER SECTION:
+  _rubygems._tcp.rubygems.org. 600 IN	SRV	0 1 80 api.rubygems.org.
+
+RubyGems did not validate the hostname returned in the SRV record before
+sending requests to it.
+
+This left clients open to a DNS hijack attack, whereby an attacker could
+return a SRV of their choosing and get the client to use it. For example:
+
+  > dig _rubygems._tcp.rubygems.org SRV
+
+  ;; ANSWER SECTION:
+  _rubygems._tcp.rubygems.org. 600 IN	SRV	0 1 80 gems.nottobetrusted.wtf
+
+The fix, detailed at https://github.com/rubygems/rubygems/commit/6bbee35,
+shows that we validate the record now to be under the original domain. This
+restricts the client to be using the original trust/security domain as they
+would have otherwise.
+
+RubyGems versions between 2.0 and 2.4.6 are vulnerable.
+
+RubyGems version 2.0.16, 2.2.4, and 2.4.7 have been released that fix this
+issue.
+
+Ruby versions 1.9.0 through 2.2.0 are vulnerable as they contain embedded
+versions of RubyGems.
+
+This vulnerability was reported by Jonathan Claudius <JClaudius@trustwave.com>.
+