CVS commit: pkgsrc/lang/ruby24-base

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Mar 12 04:23:45 UTC 2019

Modified Files:
        pkgsrc/lang/ruby24-base: Makefile distinfo

Log Message:
lang/ruby24-base: Add security patch for rubygems

Add security patch for rubygems, fixing these problem.

* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handlin
g
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors

https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/

Since original patch included in official announce dose not cleanly applied to
Ruby 2.4.5, use a local version which drop patch to none existing test.

Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 pkgsrc/lang/ruby24-base/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/lang/ruby24-base/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/ruby24-base/Makefile
diff -u pkgsrc/lang/ruby24-base/Makefile:1.9 pkgsrc/lang/ruby24-base/Makefile:1.10
--- pkgsrc/lang/ruby24-base/Makefile:1.9        Tue Jul 17 10:56:24 2018
+++ pkgsrc/lang/ruby24-base/Makefile    Tue Mar 12 04:23:45 2019
@@ -1,10 +1,14 @@
-# $NetBSD: Makefile,v 1.9 2018/07/17 10:56:24 jperkin Exp $
+# $NetBSD: Makefile,v 1.10 2019/03/12 04:23:45 taca Exp $
 
 DISTNAME=      ${RUBY_DISTNAME}
 PKGNAME=       ${RUBY_PKGPREFIX}-base-${RUBY_VERSION}
 CATEGORIES=    lang ruby
 MASTER_SITES=  ${MASTER_SITE_RUBY}
 
+# announced patch is failed to apply, so use local version.
+PATCHFILES=    ruby-2.4.5-rubygems.patch-20190311
+PATCH_SITES=   ${MASTER_SITE_LOCAL}
+
 MAINTAINER=    taca%NetBSD.org@localhost
 HOMEPAGE=      ${RUBY_HOMEPAGE}
 COMMENT=       Ruby ${RUBY_VERSION} release minimum base package

Index: pkgsrc/lang/ruby24-base/distinfo
diff -u pkgsrc/lang/ruby24-base/distinfo:1.11 pkgsrc/lang/ruby24-base/distinfo:1.12
--- pkgsrc/lang/ruby24-base/distinfo:1.11       Thu Jan  3 05:19:03 2019
+++ pkgsrc/lang/ruby24-base/distinfo    Tue Mar 12 04:23:45 2019
@@ -1,5 +1,9 @@
-$NetBSD: distinfo,v 1.11 2019/01/03 05:19:03 taca Exp $
+$NetBSD: distinfo,v 1.12 2019/03/12 04:23:45 taca Exp $
 
+SHA1 (ruby-2.4.5-rubygems.patch-20190311) = 3205fcafc9ff8b76b1f0ae31a87c3847bc93e69d
+RMD160 (ruby-2.4.5-rubygems.patch-20190311) = 9748f8de0d57930522fd9d423d08fa938a7467f7
+SHA512 (ruby-2.4.5-rubygems.patch-20190311) = 4273fe6fbf9a27720a243453723ddb7d6e7268b7f4d6a0d65af72a06d712fa18552bafca676e4aae92dc057e86a0c1628e056d0475fa20e0f5b57364b8408c67
+Size (ruby-2.4.5-rubygems.patch-20190311) = 12191 bytes
 SHA1 (ruby-2.4.5.tar.xz) = b5be590b37487248da3a85541a62fb81f7f7e29a
 RMD160 (ruby-2.4.5.tar.xz) = b0704071c12223b416ca5bd52a52671376d8ad5c
 SHA512 (ruby-2.4.5.tar.xz) = 658f676c623109f4c7499615e191c98c3dd72cfcaeeaf121337d0b8a33c5243145edd50ec5e2775f988e3cd19788984f105fa165e3049779066566f67172c1b4