validation_hints 8.1.53 → 8.1.55

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 49aca61415cd7b149eda369369bafbd1e69bc10fb8c689fe94ce23bbee00b1f5
-  data.tar.gz: a17f3a05ef555962d0492ec27357a05d9498881e39eae3741af5e100387281f3
+  metadata.gz: b00528564dc763c66657356d4b08594551ee86bf698a02fa57ee532a44e0ef71
+  data.tar.gz: b23ff8bf829e423fdf807474113a4df261f7643c95975f14d8cf3a6ee5ac2ac0
 SHA512:
-  metadata.gz: b13fb5bf25dd6311ba4fdf3ec8b5b105132bde1a58e657a4c763fd1f0040b6156d6abfc2fedcb84ae75d64c362abdb7fae9658a1a1280b11ed68c6c4eceebd9a
-  data.tar.gz: be50e09b531540d326291b5ce4030aa68b478bf05902ab98f318829e8f82dd8a07ddc3deefb8b04b8e513250f17b125e4b7018bb9fafe1310525d30412f2e333
+  metadata.gz: b81c7341844b612933df4321be3b0342ce2cd3470035fbbd22836a4383dfff601284600ee98e88023a281c2a2faa2bce909f78622eebccbab0e5fb6d294d4138
+  data.tar.gz: 4a599c1f2bfa3195081513d453e66154af98b2a583b70e5339123756c5d4d1c438664f8aa5b7218f00886e53e7f1eca62126eacc0474650bfb402161e72cd34f

data/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project are documented here.
 
+## 8.1.55
+
+### Fixed
+
+- **The published gem is world-readable again.** RubyGems packages each file with its on-disk mode and `gem install` restores it; the release checkout is group-only, so 8.1.53 shipped every file as `0660`, unreadable for anyone but the installing user and group. New `ValidationHints::GemBuild` (loaded by the gemspec) packages files as `0644`, or `0755` if executable. Tested in `test/gem_build_test.rb`. Lockstep with **inline_forms** / **inline_forms_installer** / **inline_forms_schema_edit** **8.1.55**.
+
+## 8.1.54
+
+### Changed
+
+- **Version numbering:** aligned with **inline_forms** / **inline_forms_installer** / **inline_forms_schema_edit** **8.1.54** (companion release: Devise password views no longer call the removed `devise_error_messages!`; no API changes in validation_hints).
+
 ## 8.1.53
 
 ### Changed

data/lib/validation_hints/gem_build.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "delegate"
+require "rubygems/package"
+
+# Build-time only (loaded by validation_hints.gemspec): package every file
+# world-readable, 0755 if the owner may execute it, else 0644.
+#
+# RubyGems packages each file's on-disk mode (File.lstat) and `gem install`
+# restores it. The dev checkout is group-only (rw-rw----), so 8.1.53 shipped
+# every file as 0660: only the installing user and group could read the
+# installed gem, and a Docker image that installs as root and runs as another
+# user could not load it. Same fix as InlineFormsGemFiles in inline_forms.
+module ValidationHints
+  module GemBuild
+    module_function
+
+    def packaged_mode(mode)
+      (mode & 0o100).zero? ? 0o644 : 0o755
+    end
+
+    class ReadableTar < SimpleDelegator
+      def add_file_simple(name, mode, size, &block)
+        __getobj__.add_file_simple(name, GemBuild.packaged_mode(mode), size, &block)
+      end
+    end
+
+    module ReadablePackage
+      def add_files(tar)
+        super(ReadableTar.new(tar))
+      end
+    end
+  end
+end
+
+Gem::Package.prepend(ValidationHints::GemBuild::ReadablePackage) unless Gem::Package <= ValidationHints::GemBuild::ReadablePackage

data/lib/validation_hints/version.rb

@@ -1,5 +1,5 @@
 # -*- encoding : utf-8 -*-
 
 module ValidationHints
-  VERSION = "8.1.53"
+  VERSION = "8.1.55"
 end

data/test/gem_build_test.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "tmpdir"
+require "zlib"
+require_relative "../lib/validation_hints/gem_build"
+
+# 8.1.53 shipped every file as 0660 (the checkout's group-only modes), so an
+# installed gem was unreadable for anyone outside the installing user and
+# group. Gem builds now package 0644 / 0755 whatever the on-disk modes.
+class GemBuildTest < Minitest::Test
+  REPO_ROOT = File.expand_path("..", __dir__)
+
+  def packaged_modes(gem_path)
+    modes = {}
+    File.open(gem_path, "rb") do |io|
+      Gem::Package::TarReader.new(io).each do |entry|
+        next unless entry.full_name == "data.tar.gz"
+
+        Gem::Package::TarReader.new(Zlib::GzipReader.new(entry)).each do |file|
+          modes[file.full_name] = file.header.mode & 0o777
+        end
+      end
+    end
+    modes
+  end
+
+  def build(spec, dir, gem_dir)
+    gem_path = File.join(gem_dir, "#{spec.full_name}.gem")
+    Dir.chdir(dir) do
+      package = Gem::Package.new(gem_path)
+      package.spec = spec
+      Gem::DefaultUserInteraction.use_ui(Gem::SilentUI.new) { package.build(true) }
+    end
+    gem_path
+  end
+
+  def test_group_only_files_are_packaged_world_readable
+    Dir.mktmpdir do |src|
+      Dir.mktmpdir do |out|
+        File.write(File.join(src, "plain.rb"), "# plain\n")
+        File.write(File.join(src, "tool"), "#!/bin/sh\n")
+        File.chmod(0o660, File.join(src, "plain.rb"))
+        File.chmod(0o700, File.join(src, "tool"))
+
+        spec = Gem::Specification.new do |s|
+          s.name = "modes_probe"
+          s.version = "0.0.1"
+          s.summary = "probe"
+          s.authors = ["probe"]
+          s.files = %w[plain.rb tool]
+        end
+
+        modes = packaged_modes(build(spec, src, out))
+
+        assert_equal({ "plain.rb" => 0o644, "tool" => 0o755 }, modes)
+      end
+    end
+  end
+
+  def test_the_gemspec_packages_world_readable_files
+    path = File.join(REPO_ROOT, "validation_hints.gemspec")
+    spec = Gem::Specification.load(path)
+    refute_nil spec
+
+    Dir.mktmpdir do |out|
+      modes = packaged_modes(build(spec, REPO_ROOT, out))
+
+      refute_empty modes
+      unreadable = modes.reject { |_, mode| (mode & 0o444) == 0o444 }
+      assert_empty unreadable, "not world-readable in the .gem"
+    end
+  end
+end

data/validation_hints.gemspec

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require_relative "lib/validation_hints/version"
+# Build-time: package world-readable file modes (see ValidationHints::GemBuild).
+require_relative "lib/validation_hints/gem_build"
 
 Gem::Specification.new do |s|
   s.name        = "validation_hints"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: validation_hints
 version: !ruby/object:Gem::Version
-  version: 8.1.53
+  version: 8.1.55
 platform: ruby
 authors:
 - Ace Suares
@@ -159,6 +159,7 @@ files:
 - Rakefile
 - lib/active_model/hints.rb
 - lib/validation_hints.rb
+- lib/validation_hints/gem_build.rb
 - lib/validation_hints/locale/en.yml
 - lib/validation_hints/railtie.rb
 - lib/validation_hints/validations_patch.rb
@@ -166,6 +167,7 @@ files:
 - stuff/rails-8-checklist.md
 - test/active_model/hints_test.rb
 - test/active_model/i18n_test.rb
+- test/gem_build_test.rb
 - test/test_helper.rb
 - test/validation_hints_test.rb
 - validation_hints.gemspec