Ruby security updates#1272
Ruby security updates#1272zimbatm wants to merge 5 commits intoNixOS:masterfrom zimbatm:ruby-security-updates
Conversation
|
Looks good to me, haven't tried it yet. |
|
I have tried 1.9.7 and 2.0.0 on OSX, 1.8.7 wasn't compiling in either versions |
ruby 1.8 should be phased out as it contains security issues and is unsupported by the ruby core team. This is the last update available but it doesn't fix all CVEs.
|
+1. Who wants to do the merge? :-) |
|
There seem little risk in merging, and security updates are important (I'll just test it builds, together with texLive and munin). Thanks! If there isn't a reason to keep ruby18, then it should be removed IMHO. I don't know/use ruby, so I'm leaving it for others to decide, but it seems clear as it's unsupported and vulnerable... |
|
Pushed into master. I wanted to merge it, but during testing someone updated master, so I rebased the merge commit, which resulted into a fast-forward merge and erasing my merge commit (I hope it doesn't matter). |
|
I would remove the ruby18 package but I don't feel I have the position to do it. Some old software might depend on it since ruby 1.9 is not entirely backward-compatible. |
|
Note: I see still one explicit reference to ruby18 in nixpkgs. |
|
I looked at the latest tarball release and there seem to be no mention of ruby in the source. Weird. http://klinkstatus.kdewebdev.org/releases/klinkstatus-0.3.1.tar.bz2 . Maybe it would compile without the ruby18 derivation. |
|
There's also s3sync who has a ruby18 override in the all-packages.nix |
4 participants
These commits fix the security issue described in CVE-2013-4164. Ruby 1.8.7 has also been updates but it still vulnerable to that CVE. Ruby 1.8.7 is not supported by the ruby core team and should probably be removed from the repo entirely.
The Darwin patch has also been imported from #1229