linux/poky.git/meta/recipes-devtools/ruby, branch hardknott

ruby : update to 3.0.3

2022-03-10T16:39:45+00:00

Do not tweak a file that is no longer installed. Ruby 3.0.3 includes security fixes. CVE-2021-41817: Regular Expression Denial of Service Vulnerability of Date Parsing Methods CVE-2021-41816: Buffer Overrun in CGI.escape_html CVE-2021-41819: Cookie Prefix Spoofing in CGI::Cookie.parse Ruby 3.0.2 release includes security fixes. CVE-2021-31810: Trusting FTP PASV responses vulnerability in Net::FTP CVE-2021-32066: A StartTLS stripping vulnerability in Net::IMAP CVE-2021-31799: A command injection vulnerability in RDoc (From OE-Core rev: edb6df08cb47a39918d28c709675d995c9e10031) Signed-off-by: Lee Chee Yang Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

ruby: fix the reproducibility issue

2021-10-29T10:17:21+00:00

Apply some changes on the Ruby makefiles in order to fix the reproducibility: - use a fixed timestamp, - sort linked objects, - doesn't use the current date, - and use UTC date. [YOCTO #14268] (From OE-Core rev: eea2f854fdd0f036dae2671ae52ba4695a83df68) Signed-off-by: Thomas Perrot Signed-off-by: Richard Purdie (cherry picked from commit 59b07ab51ff932a4632a31675445ba4192bae36b) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

ruby: fix CVE-2021-31799

2021-09-17T20:31:37+00:00

Backport a patch to fix CVE-2021-31799. (From OE-Core rev: 97d0237e254a0d90b58fe35a1b40d549991b3779) Signed-off-by: Mingli Yu Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

ruby: Security fixes for CVE-2021-31810/CVE-2021-32066

2021-09-17T20:31:37+00:00

CVE-2021-31810: A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). CVE-2021-32066: Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.” References: https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ Patches from: https://github.com/ruby/ruby/commit/bf4d05173c7cf04d8892e4b64508ecf7902717cd https://github.com/ruby/ruby/commit/e2ac25d0eb66de99f098d6669cf4f06796aa6256 (From OE-Core rev: e14761916290c01683d72eb8e3de530f944fdfab) Signed-off-by: Yi Zhao Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

ruby: upgrade 3.0.0 -> 3.0.1

2021-05-15T16:18:21+00:00

(From OE-Core rev: 9fde0b5121b6cda894ef761a526fa4feced02d5f) Signed-off-by: Zheng Ruoqin Signed-off-by: Richard Purdie (cherry picked from commit b6949a028fd31bd04ed0478fb34a58b971f31e1f) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

ruby: Do not use ucontext implementation for coroutines on musl/riscv

2021-02-18T23:40:01+00:00

The coroutine implementation in ruby has either arch specific implementations or it falls back to slower ucontext API based implementation assuming libc will provide the needed APIs, however musl does not implement ucontext APIs like glibc, therefore fallback is to use libucontext library on musl. However, libucontext is not ported to riscv yet. which means on musl/riscv ruby is unbuildable, however a third option is to use copy implementation for coroutines, which will be not as good performance-wise, but it will do the job, therefore for now use copy implementation for rv32/rv64 when using musl (From OE-Core rev: 3b2b401dbbb8d3aa14a5fd864178f702af3c8115) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

ruby: update 2.7.2 -> 3.0.0

2021-02-09T08:56:10+00:00

Drop 0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch as files removed upstream. License-Update: formatting Drop autoconf270.patch, as no longer needed with 3.0.0 (I verified against master-next which has the new autoconf). (From OE-Core rev: 8fbf04053845aac24e0c0f1395051b60294e02a3) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

ruby: Fix to work with autoconf 2.70

2021-01-29T21:21:53+00:00

Drop a macro we don't need which was breaking with autoconf 2.70. (From OE-Core rev: 995a0421ab39d62354e56f77eca10e2d176582d4) Signed-off-by: Richard Purdie

ruby: remove tcl DEPENDS

2021-01-08T10:10:15+00:00

The integrated Tcl/Tk module was removed in Ruby 2.4[1] back in 2016, so this build dependency can be removed. [1] https://github.com/ruby/ruby/commit/303dc3c591e324b6bbc691326d8bea76fe3b8fda (From OE-Core rev: 9f4e181924a83d7b26b11de765c202a9bd036f64) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix reproducibility

2020-12-09T12:20:33+00:00

(From OE-Core rev: 07c26e3292dbaf71873f71bec2a631f880b2e76d) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie