import ruby-2.7.4-137.module+el8.4.0+12025+f744ca41

.gitignore

@@ -1 +1,2 @@
-SOURCES/ruby-2.7.3.tar.xz
+SOURCES/ruby-2.7.4.tar.xz
+SOURCES/ruby-rubygems-bundler-v2.2.24.txz

.ruby.metadata

@@ -1 +1,2 @@
-ce3d5203d5ab734df01e602c05f68f25249dc3e0 SOURCES/ruby-2.7.3.tar.xz
+6e044d835f9f432cfa9441241c1ef66e3d607cbf SOURCES/ruby-2.7.4.tar.xz
+da17623116cb189baeb3251f828d679e5570a938 SOURCES/ruby-rubygems-bundler-v2.2.24.txz

SOURCES/ruby-2.1.0-Enable-configuration-of-archlibdir.patch

@@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac
 index d261ea57b5..3c13076b82 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3115,6 +3115,11 @@ AS_IF([test ${multiarch+set}], [
+@@ -3121,6 +3121,11 @@ AS_IF([test ${multiarch+set}], [
  ])
  
  archlibdir='${libdir}/${arch}'

SOURCES/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch

@@ -14,7 +14,7 @@ diff --git a/configure.ac b/configure.ac
 index c42436c23d..d261ea57b5 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3753,7 +3753,8 @@ AS_CASE(["$ruby_version_dir_name"],
+@@ -3759,7 +3759,8 @@ AS_CASE(["$ruby_version_dir_name"],
  ruby_version_dir=/'${ruby_version_dir_name}'
  
  if test -z "${ruby_version_dir_name}"; then

SOURCES/ruby-2.1.0-always-use-i386.patch

@@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac
 index 3c13076b82..93af30321d 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3817,6 +3817,8 @@ AC_SUBST(vendorarchdir)dnl
+@@ -3823,6 +3823,8 @@ AC_SUBST(vendorarchdir)dnl
  AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl
  AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl
  

SOURCES/ruby-2.1.0-custom-rubygems-location.patch

@@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac
 index 93af30321d..bc13397e0e 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3789,6 +3789,10 @@ AC_ARG_WITH(vendorarchdir,
+@@ -3795,6 +3795,10 @@ AC_ARG_WITH(vendorarchdir,
              [vendorarchdir=$withval],
              [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}])
  
@@ -26,7 +26,7 @@ index 93af30321d..bc13397e0e 100644
  AS_IF([test "${LOAD_RELATIVE+set}"], [
      AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
      RUBY_EXEC_PREFIX=''
-@@ -3813,6 +3817,7 @@ AC_SUBST(sitearchdir)dnl
+@@ -3819,6 +3823,7 @@ AC_SUBST(sitearchdir)dnl
  AC_SUBST(vendordir)dnl
  AC_SUBST(vendorlibdir)dnl
  AC_SUBST(vendorarchdir)dnl

SOURCES/ruby-2.3.0-ruby_version.patch

@@ -20,7 +20,7 @@ diff --git a/configure.ac b/configure.ac
 index 80b137e380..63cd3b4f8b 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -3704,9 +3704,6 @@ AS_CASE(["$target_os"],
+@@ -3710,9 +3710,6 @@ AS_CASE(["$target_os"],
      rubyw_install_name='$(RUBYW_INSTALL_NAME)'
      ])
  
@@ -30,7 +30,7 @@ index 80b137e380..63cd3b4f8b 100644
  rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'}
  AC_ARG_WITH(rubyarchprefix,
  	    AS_HELP_STRING([--with-rubyarchprefix=DIR],
-@@ -3729,56 +3726,62 @@ AC_ARG_WITH(ridir,
+@@ -3735,56 +3732,62 @@ AC_ARG_WITH(ridir,
  AC_SUBST(ridir)
  AC_SUBST(RI_BASE_NAME)
  
@@ -120,7 +120,7 @@ index 80b137e380..63cd3b4f8b 100644
  
  AS_IF([test "${LOAD_RELATIVE+set}"], [
      AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
-@@ -3795,6 +3798,7 @@ AC_SUBST(sitearchincludedir)dnl
+@@ -3801,6 +3804,7 @@ AC_SUBST(sitearchincludedir)dnl
  AC_SUBST(arch)dnl
  AC_SUBST(sitearch)dnl
  AC_SUBST(ruby_version)dnl

SOURCES/ruby-2.7.0-Remove-RubyGems-dependency.patch

@@ -1,32 +0,0 @@
-From 6532dbecf36d1f24dab1f2143afd171e0b7699eb Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?V=C3=ADt=20Ondruch?= <vondruch@redhat.com>
-Date: Wed, 4 Sep 2019 15:07:07 +0200
-Subject: [PATCH] Remove RubyGems dependency.
-
-Since `Process::RLIMIT_NOFILE` is platform specific, better to use Ruby
-introspection than detecting platform.
----
- .../vendor/net-http-persistent/lib/net/http/persistent.rb   | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent.rb b/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent.rb
-index a54be2a..06739f1 100644
---- a/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent.rb
-+++ b/lib/bundler/vendor/net-http-persistent/lib/net/http/persistent.rb
-@@ -197,10 +197,10 @@ class Bundler::Persistent::Net::HTTP::Persistent
-   ##
-   # The default connection pool size is 1/4 the allowed open files.
- 
--  if Gem.win_platform? then
--    DEFAULT_POOL_SIZE = 256
--  else
-+  if Process.const_defined? :RLIMIT_NOFILE
-     DEFAULT_POOL_SIZE = Process.getrlimit(Process::RLIMIT_NOFILE).first / 4
-+  else
-+    DEFAULT_POOL_SIZE = 256
-   end
- 
-   ##
--- 
-2.23.0
-

SOURCES/rubygems-3.2.13-test-gem-message.patch

@@ -0,0 +1,54 @@
+From 7efc7afcae6720e1af7ab49986d789b6f9d6fe0a Mon Sep 17 00:00:00 2001
+From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
+Date: Mon, 8 Mar 2021 12:17:52 +0900
+Subject: [PATCH] Merge RubyGems-3.2.13 and Bundler-2.2.13
+
+---
+ lib/bundler/cli/gem.rb                        |  40 +++---
+ lib/bundler/definition.rb                     |  47 ++++---
+ lib/bundler/dsl.rb                            |  58 +++++---
+ lib/bundler/inline.rb                         |   1 +
+ lib/bundler/lockfile_parser.rb                |  20 +--
+ lib/bundler/plugin.rb                         |   1 +
+ lib/bundler/plugin/installer.rb               |  18 ++-
+ lib/bundler/plugin/source_list.rb             |   4 +
+ lib/bundler/resolver.rb                       |  70 +++++-----
+ lib/bundler/source_list.rb                    |  33 ++---
+ lib/bundler/templates/newgem/README.md.tt     |   8 +-
+ lib/bundler/version.rb                        |   2 +-
+ lib/rubygems.rb                               |   2 +-
+ lib/rubygems/core_ext/tcpsocket_init.rb       |   5 +-
+ lib/rubygems/platform.rb                      |  10 +-
+ spec/bundler/bundler/plugin_spec.rb           |   1 +
+ spec/bundler/commands/exec_spec.rb            | 131 ++++++++++++++---
+ spec/bundler/commands/newgem_spec.rb          |  94 +++++--------
+ .../commands/post_bundle_message_spec.rb      |  11 +-
+ spec/bundler/install/gemfile/gemspec_spec.rb  |  15 +-
+ spec/bundler/install/gemfile/sources_spec.rb  | 132 +++++++++++++++---
+ spec/bundler/support/indexes.rb               |   2 +-
+ test/rubygems/test_gem.rb                     |  10 +-
+ test/rubygems/test_gem_platform.rb            |  29 ++++
+ 24 files changed, 477 insertions(+), 267 deletions(-)
+
+diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb
+index 1c6d790b25e6..8b028d3495a8 100644
+--- a/test/rubygems/test_gem.rb
++++ b/test/rubygems/test_gem.rb
+@@ -1885,15 +1885,9 @@ def test_use_gemdeps_missing_gem
+       io.write 'gem "a"'
+     end
+ 
+-    platform = Bundler::GemHelpers.generic_local_platform
+-    if platform == Gem::Platform::RUBY
+-      platform = ''
+-    else
+-      platform = " #{platform}"
+-    end
+-
+     expected = <<-EXPECTED
+-Could not find gem 'a#{platform}' in any of the gem sources listed in your Gemfile.
++Could not find gem 'a' in locally installed gems.
++The source does not contain any versions of 'a'
+ You may need to `gem install -g` to install missing gems
+ 
+     EXPECTED

SOURCES/rubygems-3.2.22-fix-requirement-equals.patch

@@ -0,0 +1,75 @@
+From c082c6eb7c786a432bea23cf78839f64585cb630 Mon Sep 17 00:00:00 2001
+From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
+Date: Wed, 7 Jul 2021 14:07:29 +0900
+Subject: [PATCH] Sync RubyGems and Bundler with upstream
+
+---
+ lib/bundler.rb                                |   2 +-
+ lib/bundler/cli/doctor.rb                     |  12 +-
+ lib/bundler/cli/install.rb                    |   2 +-
+ lib/bundler/compact_index_client.rb           |   4 +-
+ lib/bundler/current_ruby.rb                   |   8 +-
+ lib/bundler/definition.rb                     |  44 +-----
+ lib/bundler/dsl.rb                            |  14 +-
+ lib/bundler/installer.rb                      |   8 +-
+ lib/bundler/lockfile_parser.rb                |  22 +--
+ lib/bundler/plugin/installer.rb               |   2 +-
+ lib/bundler/rubygems_ext.rb                   |   2 +
+ lib/bundler/source/rubygems.rb                |  13 --
+ lib/bundler/source_list.rb                    |  55 +++++---
+ .../lib/connection_pool/monotonic_time.rb     |   2 +-
+ .../lib/connection_pool/timed_stack.rb        |   4 +-
+ lib/bundler/worker.rb                         |   4 +-
+ lib/rubygems.rb                               |   2 +-
+ lib/rubygems/core_ext/tcpsocket_init.rb       |   4 +-
+ lib/rubygems/deprecate.rb                     |  59 +++++++-
+ lib/rubygems/gemcutter_utilities.rb           |  13 +-
+ lib/rubygems/installer.rb                     |   2 +-
+ lib/rubygems/remote_fetcher.rb                |  15 +-
+ lib/rubygems/request/connection_pools.rb      |   2 +-
+ lib/rubygems/request/http_pool.rb             |   2 +-
+ lib/rubygems/request_set.rb                   |   2 +-
+ lib/rubygems/specification.rb                 |   2 +-
+ lib/rubygems/uri_parser.rb                    |   8 ++
+ lib/rubygems/uri_parsing.rb                   |  23 ---
+ lib/rubygems/user_interaction.rb              |   2 +-
+ spec/bundler/bundler/cli_spec.rb              |  34 +++--
+ spec/bundler/bundler/definition_spec.rb       |   2 +-
+ spec/bundler/bundler/source_list_spec.rb      |  42 +++---
+ spec/bundler/commands/doctor_spec.rb          |  24 +++-
+ spec/bundler/commands/update_spec.rb          |  88 ++++++++++++
+ .../install/gemfile/eval_gemfile_spec.rb      |  32 +++++
+ spec/bundler/install/gemfile/sources_spec.rb  |  70 +++++++++
+ .../install/gems/compact_index_spec.rb        |   4 +-
+ .../install/gems/dependency_api_spec.rb       |   4 +-
+ spec/bundler/install/global_cache_spec.rb     |   7 +-
+ spec/bundler/lock/lockfile_spec.rb            |  82 +----------
+ spec/bundler/realworld/edgecases_spec.rb      | 133 +-----------------
+ spec/bundler/realworld/slow_perf_spec.rb      |  10 +-
+ spec/bundler/spec_helper.rb                   |   2 +-
+ spec/bundler/support/api_request_limit_hax.rb |  16 +++
+ .../artifice/compact_index_rate_limited.rb    |   2 +-
+ spec/bundler/support/artifice/endpoint.rb     |   2 +-
+ spec/bundler/support/hax.rb                   |  25 ----
+ spec/bundler/support/helpers.rb               |   4 -
+ spec/bundler/support/matchers.rb              |   8 +-
+ spec/bundler/support/path.rb                  |   4 +
+ test/rubygems/helper.rb                       |   2 +-
+ test/rubygems/test_gem_gemcutter_utilities.rb |  12 ++
+ 52 files changed, 477 insertions(+), 466 deletions(-)
+ delete mode 100644 lib/rubygems/uri_parsing.rb
+ create mode 100644 spec/bundler/support/api_request_limit_hax.rb
+
+diff --git a/lib/bundler/rubygems_ext.rb b/lib/bundler/rubygems_ext.rb
+index c95664965c99..9828fc885c94 100644
+--- a/lib/bundler/rubygems_ext.rb
++++ b/lib/bundler/rubygems_ext.rb
+@@ -134,6 +134,8 @@ def to_lock
+     class Requirement
+       module OrderIndependentComparison
+         def ==(other)
++          return unless Gem::Requirement === other
++
+           if _requirements_sorted? && other._requirements_sorted?
+             super
+           else

SOURCES/rubygems-bundler-gemspec-for-make-test-bundler.patch

@@ -0,0 +1,15 @@
+--- a/lib/bundler/bundler.gemspec
++++ b/lib/bundler/bundler.gemspec
+@@ -37,10 +37,9 @@
+   s.files = Dir.glob("lib/bundler{.rb,/**/*}", File::FNM_DOTMATCH).reject {|f| File.directory?(f) }
+ 
+   # include the gemspec itself because warbler breaks w/o it
+-  s.files += %w[bundler.gemspec]
++  s.files += %w[lib/bundler/bundler.gemspec]
+ 
+-  s.files += %w[CHANGELOG.md LICENSE.md README.md]
+-  s.bindir        = "exe"
++  s.bindir        = "libexec"
+   s.executables   = %w[bundle bundler]
+   s.require_paths = ["lib"]
+ end

SPECS/ruby.spec

@@ -1,6 +1,6 @@
 %global major_version 2
 %global minor_version 7
-%global teeny_version 3
+%global teeny_version 4
 %global major_minor_version %{major_version}.%{minor_version}
 
 %global ruby_version %{major_minor_version}.%{teeny_version}
@@ -22,7 +22,7 @@
 %endif
 
 
-%global release 136
+%global release 137
 %{!?release_string:%define release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}}
 
 # The RubyGems library has to stay out of Ruby directory tree, since the
@@ -34,12 +34,14 @@
 %global rubygems_molinillo_version 0.5.7
 
 # Default gems.
-%global bundler_version 2.1.4
+%global bundler_version 2.2.24
 %global bundler_connection_pool_version 2.2.2
-%global bundler_fileutils_version 1.3.0
+%global bundler_fileutils_version 1.4.1
-%global bundler_molinillo_version 0.6.6
+%global bundler_molinillo_version 0.7.0
-%global bundler_net_http_persistent_version 3.1.0
+%global bundler_net_http_persistent_version 4.0.0
-%global bundler_thor_version 1.0.0
+%global bundler_thor_version 1.1.0
+%global bundler_tmpdir_version 0.1.0
+%global bundler_uri_version 0.10.0
 
 %global bigdecimal_version 2.0.0
 %global did_you_mean_version 1.4.0
@@ -50,7 +52,7 @@
 %global openssl_version 2.1.2
 %global psych_version 3.1.0
 %global racc_version 1.4.16
-%global rdoc_version 6.2.1
+%global rdoc_version 6.2.1.1
 %global xmlrpc_version 0.3.0
 
 # Bundled gems.
@@ -76,6 +78,8 @@
 %bcond_without gmp
 %bcond_without hostname
 %bcond_without systemtap
+# Enable the tests requiring internet when building on local.
+%bcond_with bundler_tests
 
 %if 0%{?fedora}
 %bcond_without hardening_test
@@ -107,6 +111,9 @@ Source11: rubygems.con
 Source13: test_abrt.rb
 # SystemTap tests.
 Source14: test_systemtap.rb
+# git clone --no-checkout git@github.com:rubygems/rubygems.git
+# git -C rubygems archive --prefix=rubygems/ -v -o ruby-rubygems-bundler-v2.2.24.txz bundler-v2.2.24
+Source15: ruby-rubygems-bundler-v%{bundler_version}.txz
 
 # The load directive is supported since RPM 4.12, i.e. F21+. The build process
 # fails on older Fedoras.
@@ -143,9 +150,6 @@ Patch6: ruby-2.7.0-Initialize-ABRT-hook.patch
 # hardening features of glibc (rhbz#1361037).
 # https://bugs.ruby-lang.org/issues/12666
 Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch
-# Revert commit which breaks bundled net-http-persistent version check.
-# https://github.com/drbrain/net-http-persistent/pull/109
-Patch10: ruby-2.7.0-Remove-RubyGems-dependency.patch
 # Prevent issues with openssl loading when RubyGems are disabled.
 # https://github.com/ruby/openssl/pull/242
 Patch13: ruby-2.8.0-remove-unneeded-gem-require-for-ipaddr.patch
@@ -156,6 +160,16 @@ Patch19: ruby-2.7.1-Timeout-the-test_bug_reporter_add-witout-raising-err.patch
 # contains leading zero
 # https://bugzilla.redhat.com/show_bug.cgi?id=1944227
 Patch20: ruby-3.0.0-Convert-ip-addresses-to-canonical-form.patch
+# Update `bundler.gemspec` from RubyGems, required to pass `make test-bundler`.
+# Compare RubyGems `bundler/bundler.gemspec` with Ruby `lib/bundler/bundler.gemspec`.
+Patch21: rubygems-bundler-gemspec-for-make-test-bundler.patch
+# A missing gem error message is changed on RubyGems 3.2.13.
+# https://github.com/ruby/ruby/commit/7efc7afcae6720e1af7ab49986d789b6f9d6fe0a
+Patch22: rubygems-3.2.13-test-gem-message.patch
+# Fix Gem::Requirement#== raising NoMethodError on RubyGems < 3.2.0.
+# https://github.com/rubygems/rubygems/commit/d62539f23aa1624ae170008e47a5a3e15f0dc2ef
+# https://github.com/ruby/ruby/commit/c082c6eb7c786a432bea23cf78839f64585cb630
+Patch23: rubygems-3.2.22-fix-requirement-equals.patch
 
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Suggests: rubypick
@@ -550,12 +564,21 @@ HTTP.
 
 
 %prep
-%setup -q -n %{ruby_archive}
+%setup -q -n %{ruby_archive} -b15
 
 # Remove bundled libraries to be sure they are not used.
 rm -rf ext/psych/yaml
 rm -rf ext/fiddle/libffi*
 
+# Update Bundler to fix CVE-2020-36327.
+# https://bugzilla.redhat.com/show_bug.cgi?id=1958999
+rm -rf lib/bundler{.rb,}
+rm -rf {spec,tool}/bundler
+cp -a %{_builddir}/rubygems/bundler/lib/bundler{.rb,} lib/
+cp -a %{_builddir}/rubygems/bundler/bundler.gemspec lib/bundler/
+cp -a %{_builddir}/rubygems/bundler/spec spec/bundler
+cp -a %{_builddir}/rubygems/bundler/tool/bundler tool/bundler
+
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
@@ -564,10 +587,12 @@ rm -rf ext/fiddle/libffi*
 %patch5 -p1
 %patch6 -p1
 %patch9 -p1
-%patch10 -p1
 %patch13 -p1
 %patch19 -p1
 %patch20 -p1
+%patch21 -p1
+%patch22 -p1
+%patch23 -p1
 
 # Provide an example of usage of the tapset:
 cp -a %{SOURCE3} .
@@ -799,7 +824,7 @@ checksec --file=libruby.so.%{ruby_version} | \
 # FileUtils.
 [ "`make runruby TESTRUN_SCRIPT=\"-e \\\" \
   module Bundler; end; \
-  require 'bundler/vendor/fileutils/lib/fileutils/version'; \
+  require 'bundler/vendor/fileutils/lib/fileutils'; \
   puts Bundler::FileUtils::VERSION\\\"\" | tail -1`" \
   == '%{bundler_fileutils_version}' ]
 
@@ -825,6 +850,17 @@ checksec --file=libruby.so.%{ruby_version} | \
   puts Bundler::Thor::VERSION\\\"\" | tail -1`" \
   == '%{bundler_thor_version}' ]
 
+# tmpdir.
+# TODO: There is no version in bundled tmpdir yet.
+#%%{global bundler_tmpdir_version}
+
+# URI.
+[ "`make runruby TESTRUN_SCRIPT=\"-e \\\" \
+  module Bundler; end; \
+  require 'bundler/vendor/uri/lib/uri/version'; \
+  puts Bundler::URI::VERSION\\\"\" | tail -1`" \
+  == '%{bundler_uri_version}' ]
+
 
 # test_debug(TestRubyOptions) fails due to LoadError reported in debug mode,
 # when abrt.rb cannot be required (seems to be easier way then customizing
@@ -883,6 +919,8 @@ sed -i '/^  def test_ignored_interrupt$/,/^  end$/ s/^/#/' \
 %{?test_timeout_scale:RUBY_TEST_TIMEOUT_SCALE="%{test_timeout_scale}"} \
   make check TESTS="-v $DISABLE_TESTS" MSPECOPT="-fs $MSPECOPTS"
 
+%{?with_bundler_tests:make test-bundler}
+
 %files
 %license BSDL
 %license COPYING
@@ -1290,6 +1328,17 @@ sed -i '/^  def test_ignored_interrupt$/,/^  end$/ s/^/#/' \
 
 
 %changelog
+* Thu Jul 15 2021 Jun Aruga <jaruga@redhat.com> - 2.7.4-137
+- Upgrade to Ruby 2.7.4.
+- Fix command injection vulnerability in RDoc.
+  Resolves: rhbz#1986768
+- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
+  Resolves: rhbz#1986812
+- Fix StartTLS stripping vulnerability in Net::IMAP.
+  Resolves: rhbz#1986813
+- Upgrade to Bundler 2.2.24.
+  Resolves: CVE-2020-36327
+
 * Wed Apr 07 2021 Pavel Valena <pvalena@redhat.com> - 2.7.3-136
 - Upgrade to Ruby 2.7.3.
   Resolves: rhbz#1951999