Skip to content

Updating activesupport, rest-client and oc-chef-pedant for CVE-2023-22796 #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
johnmccrae wants to merge 13 commits into from
Closed

Updating activesupport, rest-client and oc-chef-pedant for CVE-2023-22796 #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
d2a42c9
updating rest-client and oc-chef-pedant
johnmccrae Sep 26, 2025
0699f84
updating rest-client and oc-chef-pedant
johnmccrae Sep 26, 2025
6564dfa
pinning fiddle to 1.1.0 so dependencies dont bring in newer versions
johnmccrae Sep 26, 2025
f5247a1
pinning fiddle to 1.1.0 so dependencies dont bring in newer versions
johnmccrae Sep 26, 2025
4a5cf8e
pinning fiddle to 1.1.0 so dependencies dont bring in newer versions
johnmccrae Sep 26, 2025
b9b214b
pinning fiddle to 1.1.0 so dependencies dont bring in newer versions
johnmccrae Sep 26, 2025
d302418
updating dependencies
johnmccrae Sep 29, 2025
8b2102e
updating dependencies
johnmccrae Sep 29, 2025
3cc1ac3
updating dependencies
johnmccrae Sep 29, 2025
f10a139
updating dependencies
johnmccrae Sep 29, 2025
00e9025
updating dependencies
johnmccrae Sep 29, 2025
21a77b2
updating dependencies
johnmccrae Sep 29, 2025
ca82e44
updating dependencies
johnmccrae Sep 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 15 additions & 7 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ source "https://rubygems.org"

gemspec

# gem 'rest-client', :git => 'https://github.com/chef/rest-client.git'
gem "rest-client", git: "https://github.com/chef/rest-client.git", branch: "jfm/ucrt_update1"

group :pedant do
gem "oc-chef-pedant", git: "https://github.com/chef/chef-server.git", branch: "main"
gem "oc-chef-pedant", git: "https://github.com/chef/chef-server.git", branch: "jfm/chef-activesupport-update"
end

gem "ffi", ">= 1.15.5"
Expand All @@ -21,14 +21,22 @@ group :style do
gem "cookstyle", "~> 8.2"
end

if ENV["GEMFILE_MOD"]
puts "GEMFILE_MOD: #{ENV["GEMFILE_MOD"]}"
instance_eval(ENV["GEMFILE_MOD"])
if Gem::Version.new(RUBY_VERSION) <= Gem::Version.new("3.1.7")
gem "chef-utils", git: "https://github.com/chef/chef.git", branch: "chef-18", glob: "chef-utils/chef-utils.gemspec", require: "chef-utils"
gem "chef", git: "https://github.com/chef/chef.git", branch: "chef-18"
else
gem "chef", "~> 18.7"
gem "ohai", "~> 18.1"
gem "chef-utils", git: "https://github.com/chef/chef.git", branch: "main", glob: "chef-utils/chef-utils.gemspec", require: "chef-utils"
gem "chef", git: "https://github.com/chef/chef.git", branch: "main"
end

# if ENV["GEMFILE_MOD"]
# puts "GEMFILE_MOD: #{ENV["GEMFILE_MOD"]}"
# instance_eval(ENV["GEMFILE_MOD"])
# else
# gem "chef", "~> 18.7"
# gem "ohai", "~> 18.1"
# end

group :debug do
gem "pry"
gem "pry-byebug"
Expand Down
14 changes: 10 additions & 4 deletions chef-zero.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,6 @@ Gem::Specification.new do |s|

s.required_ruby_version = ">= 3.0"

# Note: 7.1.0 does not defaults its cache_format_version to 7.1 but 6.1 instead which gives deprecation warnings
# Remove the version constraint when we can upgrade to 7.1.1 post stable release of Activesupport 7.1
# Similar issue with 7.0 existed: https://github.com/rails/rails/pull/45293
s.add_dependency "activesupport", ">= 7", "< 8.1"
s.add_dependency "mixlib-log", ">= 2.0", "< 4.0"
s.add_dependency "hashie", ">= 2.0", "< 6.0"
s.add_dependency "uuidtools", "~> 2.1"
Expand All @@ -25,6 +21,16 @@ Gem::Specification.new do |s|
s.add_dependency "rackup", "~> 2.2", ">= 2.2.1"
s.add_dependency "unf_ext", "~> 0.0.8"
s.add_dependency "webrick"
s.add_dependency "activesupport", "~> 7.1.5"
# We are running into some challenging things with activesupport and fiddle.
# Chef-18 requires Ruby 3.1 and Chef-19 requires Ruby 3.4. They have incompatible dependencies on activesupport and fiddle
# Activesupport 7.1.3.2 also has a CVE in it which requires an upgrade to 7.1.5.2. Activesupport 7.1.5 requires fiddle = 1.1.0, but Chef-19 requires fiddle >= 1.1.6.
# Also, fiddle is a built-in gem for Ruby 3.1 but is broken out into a separate gem starting in Ruby 3.2.
if Gem::Version.new(RUBY_VERSION) <= Gem::Version.new("3.1.7")
s.add_dependency "fiddle", "= 1.1.0"

@tas50 tas50 Oct 29, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can't do an if statement in a gemspec

@tpowell-progress tpowell-progress Nov 3, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

More specifically, since a gemspec is evaluated at gem build time, and chef-zero is included (at least by Chef) as a gem published to RubyGems, this dependency will match the setup of the machine that built the gem, not the setup of the machine including the gem. (We do have an if or two in gemspecs that aren't subject to this pitfall, regardless of how dubious the practice may be.) cc: @johnmccrae

@tpowell-progress tpowell-progress Nov 3, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just recalled @jaymzh removed activesupport with #349 (and then need for this PR)

else
s.add_dependency "fiddle", ">= 1.1.8"
end

s.bindir = "bin"
s.executables = ["chef-zero"]
Expand Down
Loading