rubygems-update 2.6.1 → 3.5.0

data/.autotest

@@ -1,71 +0,0 @@
-# -*- ruby -*-
-
-Gem.refresh
-
-require 'autotest/restart'
-require 'autotest/isolate'
-
-Autotest.add_hook :run_command do |_, cmd|
-  cmd.sub! ' -e ', ' -we '
-end
-
-Autotest.add_hook :initialize do |at|
-  at.testlib = ''
-
-  at.failed_results_re = /^\s+\d+\) (?:Failure|Error):\n(.*?):/
-  at.completed_re = /\d+ tests, \d+ assertions, \d+ failures, \d+ errors/
-
-  at.add_exception %r%/\.git/%
-  at.add_exception %r%\.rbc$%
-  at.add_exception %r%test/rubygems/rubygems%
-
-  at.find_directories.clear
-  at.find_directories.push 'lib', 'test'
-
-  at.add_mapping %r%^lib/rubygems.rb$% do |_, m|
-    "test/rubygems/test_gem.rb"
-  end
-
-  at.add_mapping %r%^lib/rubygems/(.*).rb$% do |_, m|
-    "test/rubygems/test_gem_#{m[1].gsub '/', '_'}.rb"
-  end
-
-  args = ARGV.reject { |a| a =~ /^-/ }
-  at.find_directories = args unless args.empty?
-
-  def at.handle_results results
-    results = results.gsub(/\e\[\d+m/, '') # strip ascii color
-    failed = results.scan(self.failed_results_re).map { |m, k|
-      /(?<k>\w+)#(?<m>\w+)/ =~ m
-      [m, k]
-    }
-
-    completed = results[self.completed_re]
-
-    if completed then
-      completed = completed.scan(/(\d+) (\w+)/).map { |v, k| [k, v.to_i] }
-
-      self.latest_results = Hash[*completed.flatten]
-      self.files_to_test  = consolidate_failures failed
-
-      color = failed.empty? ? :green : :red
-      hook color unless $TESTING
-    else
-      self.latest_results = nil
-    end
-
-    self.tainted = true unless self.files_to_test.empty?
-  end
-
-  def at.path_to_classname s
-    sep = File::SEPARATOR
-
-    f = s.sub(/^test#{sep}rubygems#{sep}/, '').sub(/\.rb$/, '').split sep
-
-    f = f.map { |path| path.split(/_|(\d+)/).map { |seg| seg.capitalize }.join }
-
-    f.join('::').
-      gsub('Rdoc', 'RDoc').
-      gsub('GemDependencyApi', 'GemDependencyAPI')
-  end
-end

data/.document

@@ -1,5 +0,0 @@
-README
-LICENSE.txt
-GPL.txt
-lib
-release_notes

data/.travis.yml

@@ -1,46 +0,0 @@
----
-after_script:
-- rake travis:after -t
-before_script:
-- gem uninstall executable-hooks gem-wrappers -x --force -i `gem env home`@global
-- gem install rake --no-document
-- gem install hoe-travis --no-document
-- gem install minitest -v '~> 4.7' --no-document
-- rake travis:before -t
-- gem list --details
-- gem env
-language: ruby
-notifications:
-  email:
-  - drbrain@segment7.net
-  - evan+notify@phx.io
-rvm:
-- 1.8.7
-- 1.9.2
-- 1.9.3
-- 2.0.0
-- 2.1.7
-- 2.2.3
-- 2.3.0
-- ruby-head
-env:
-  - "YAML=syck"
-  - "YAML=psych"
-script: rake travis
-matrix:
-  exclude:
-    - rvm: 1.8.7
-      env: "YAML=psych"
-    - rvm: 2.0.0
-      env: "YAML=syck"
-    - rvm: 2.1.7
-      env: "YAML=syck"
-    - rvm: 2.2.3
-      env: "YAML=syck"
-    - rvm: 2.3.0
-      env: "YAML=syck"
-    - rvm: ruby-head
-      env: "YAML=syck"
-  allow_failures:
-    - rvm: ruby-head
-sudo: false

data/CONTRIBUTING.rdoc

@@ -1,129 +0,0 @@
-= How to contribute
-
-Community involvement is essential to RubyGems. We want to keep it easy as
-possible to contribute changes. There are a few guidelines that we need
-contributors to follow to reduce the time it takes to get changes merged in.
-
-== Guidelines
-
-1. New features should be coupled with tests.
-
-2. Ensure that your code blends well with ours:
-   * No trailing whitespace
-   * Match indentation (two spaces)
-   * Match coding style (`if`, `elsif`, `when` need trailing `then`)
-
-3. Don't modify the history file or version number.
-
-4. If you have any questions, just ask on IRC in #rubygems on Freenode or file
-   an issue here: http://github.com/rubygems/rubygems/issues
-
-For more information and ideas on how to contribute to RubyGems ecosystem, see
-here: http://guides.rubygems.org/contributing/
-
-== Getting Started
-
-    $ gem install hoe
-    $ rake newb
-
-To run commands like `gem install` from the repo:
-
-    $ ruby -Ilib bin/gem install
-
-== Issues
-
-RubyGems uses labels to track all issues and pull requests. In order to provide
-guidance to the community this is documentation of how labels are used in the
-rubygems repository.
-
-=== Type
-
-Most Issues or pull requests will have one of these labels, which describes the
-type of the issue or pull request.
-
-* <b>bug report</b> - An issue describing a bug in rubygems. This would be something
-  that is broken, confusing, unexpected behavior etc.
-* <b>bugfix</b> - A pull request that fixes a bug report.
-* <b>feature request</b> - An issue describing a request for a new feature or
-  enhancement.
-* <b>feature implementation</b> - A pull request implementing a feature request.
-* <b>question</b> - An issue that is a more of a question than a call for specific
-  changes in the codebase.
-* <b>cleanup</b> - Generally for a pull request that improves the code base without
-  fixing a bug or implementing a feature.
-* <b>major bump</b> - This issue or pull request requires a major version bump
-* <b>administrative</b> - This issue relates to adminstrative tasks that need to
-  take place as it relates to rubygems
-
-Bug report and Bugfix have the same color. And feature implementation and
-feature request have the same color since they are related labels.
-
-=== Workflow
-
-These are labels that indicate the state of an issue, where it is in the process
-from being submitted to being closed. These are listed in rough progression
-order from submitted to closed.
-
-* <b>triage</b> - This is an issue or pull request that needs to be properly
-  labeled by by a maintainer.
-* <b>accepted</b> - This issue / pull request has been accepted as valid and
-  will be worked on by someone.
-* <b>ready for work</b> - An issue that is available for collaboration. This issue
-  should have existing discussion on the problem, and a description of how to go
-  about solving it. This label should be removed once someone has said they are
-  going to work on it.
-* <b>claimed</b> - An issue that is claimed by a member of the community and is
-  working on it. If the member can be assigned to the issue, they should be.
-* <b>feedback</b>- This issue/pull request is waiting on feedback from
-  one ore more of the folks involved in the issue. Generally their should be an
-  <tt>@username/team</tt> in the issue indicating who should respond.
-* <b>blocked</b> - the issue/pull request is currently unable to move forward because
-  of some specific reason, generally this will be a reason that is outside
-  RubyGems or needs feedback from some specific individual or group, and it may
-  be a while before something it is resolved.
-
-Feedback and blocked all have the same color since they are all waiting on
-someone in particular to do something.
-
-=== Inactive Reason
-
-Reasons are why an issue / pull request was closed without being worked on or
-accepted. There should also be more detailed information in the comments.
-
-* *duplicate* - This is a duplicate of an existing bug. The comments must
-  reference the existing issue.
-* *abandonded* - This is an issue/pull request that has aged off, is no longer
-  applicable or similar.
-* *declined* - An issue that won't be fixed/implemented or a pull request that
-  is not accepted.
-* *deprecated* - An issue/pull request that no longer applies to the actively
-  maintained codebase.
-
-All the reason labels are the same maroon color.
-
-=== Categories
-
-These are aspects of the codebase, or what general area the issue or pull
-request pertains too. Not all issues will have a category.
-
-* <b>gemspec</b> - related to the gem specification itself
-* <b>API</b> - related to the public supported rubygems API. This is the code api,
-  not a network related API.
-* <b>command</b> - related to something in <tt>Gem::Commands</tt>
-* <b>install</b> - related to gem installations
-* <b>documentation</b> - related to updating / fixing / clarifiying documentation or
-  guides
-
-All category labels are the same blue color.
-
-=== Platforms
-
-If an issue or pull request pertains to only one platform, then it should have
-an appropriate platform tag.
-
-* *windows*
-* *java*
-* *osx*
-* *linux*
-
-All platform tags are the same purple color.

data/CVE-2013-4287.txt

@@ -1,35 +0,0 @@
-= Algorithmic complexity vulnerability in RubyGems 2.0.7 and older
-
-RubyGems validates versions with a regular expression that is vulnerable to
-denial of service due to backtracking.  For specially crafted RubyGems
-versions attackers can cause denial of service through CPU consumption.
-
-RubyGems versions 2.0.7 and older, 2.1.0.rc.1 and 2.1.0.rc.2 are vulnerable.
-
-Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded
-versions of RubyGems.
-
-It does not appear to be possible to exploit this vulnerability by installing a
-gem for RubyGems 1.8.x or 2.0.x.  Vulnerable uses of RubyGems API include
-packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask),
-sending user input to Gem::Version.new, Gem::Version.correct? or use of the
-Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
-constants.
-
-Notably, users of bundler that install gems from git are vulnerable if a
-malicious author changes the gemspec to an invalid version.
-
-The vulnerability can be fixed by changing the first grouping to an atomic
-grouping in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb.  For
-RubyGems 2.0.x:
-
-  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
-  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
-
-For RubyGems 1.8.x:
-
-  -  VERSION_PATTERN = '[0-9]+(\.[0-9a-zA-Z]+)*' # :nodoc:
-  +  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc:
-
-This vulnerability was discovered by Damir Sharipov <dammer2k@gmail.com>
-

data/CVE-2013-4363.txt

@@ -1,45 +0,0 @@
-= Algorithmic complexity vulnerability in RubyGems 2.1.4 and older
-
-The patch for CVE-2013-4287 was insufficiently verified so the combined
-regular expression for verifying gem version remains vulnerable following
-CVE-2013-4287.
-
-RubyGems validates versions with a regular expression that is vulnerable to
-denial of service due to backtracking.  For specially crafted RubyGems
-versions attackers can cause denial of service through CPU consumption.
-
-RubyGems versions 2.1.4 and older are vulnerable.
-
-Ruby versions 1.9.0 through 2.0.0p247 are vulnerable as they contain embedded
-versions of RubyGems.
-
-It does not appear to be possible to exploit this vulnerability by installing a
-gem for RubyGems 1.8.x or newer.  Vulnerable uses of RubyGems API include
-packaging a gem (through `gem build`, Gem::Package or Gem::PackageTask),
-sending user input to Gem::Version.new, Gem::Version.correct? or use of the
-Gem::Version::VERSION_PATTERN or Gem::Version::ANCHORED_VERSION_PATTERN
-constants.
-
-Notably, users of bundler that install gems from git are vulnerable if a
-malicious author changes the gemspec to an invalid version.
-
-The vulnerability can be fixed by changing the "*" repetition to a "?"
-repetition in Gem::Version::ANCHORED_VERSION_PATTERN in
-lib/rubygems/version.rb.  For RubyGems 2.1.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-For RubyGems 2.0.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-For RubyGems 1.8.x:
-
-  -  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc:
-  +  ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc:
-
-
-This vulnerability was discovered by Alexander Cherepanov <cherepan@mccme.ru>
-

data/CVE-2015-3900.txt

@@ -1,40 +0,0 @@
-= Request hijacking vulnerability in RubyGems 2.4.6 and earlier
-
-RubyGems provides the ability of a domain to direct clients to a separate
-host that is used to fetch gems and make API calls against. This mechanism
-is implemented via DNS, specificly a SRV record _rubygems._tcp under the
-original requested domain.
-
-For example, this is the one that users who use rubygems.org see:
-
-  > dig _rubygems._tcp.rubygems.org SRV
-
-  ;; ANSWER SECTION:
-  _rubygems._tcp.rubygems.org. 600 IN	SRV	0 1 80 api.rubygems.org.
-
-RubyGems did not validate the hostname returned in the SRV record before
-sending requests to it.
-
-This left clients open to a DNS hijack attack, whereby an attacker could
-return a SRV of their choosing and get the client to use it. For example:
-
-  > dig _rubygems._tcp.rubygems.org SRV
-
-  ;; ANSWER SECTION:
-  _rubygems._tcp.rubygems.org. 600 IN	SRV	0 1 80 gems.nottobetrusted.wtf
-
-The fix, detailed at https://github.com/rubygems/rubygems/commit/6bbee35,
-shows that we validate the record now to be under the original domain. This
-restricts the client to be using the original trust/security domain as they
-would have otherwise.
-
-RubyGems versions between 2.0 and 2.4.6 are vulnerable.
-
-RubyGems version 2.0.16, 2.2.4, and 2.4.7 have been released that fix this
-issue.
-
-Ruby versions 1.9.0 through 2.2.0 are vulnerable as they contain embedded
-versions of RubyGems.
-
-This vulnerability was reported by Jonathan Claudius <JClaudius@trustwave.com>.
-