Audit openssl requiring code#3816
Conversation
98c70b1 to
d55c909
Compare
|
This pull-request is useful. But I'm still not sure why we should support non-openssl environment. Is there real use-case it? |
|
Looking at the issues that came up, very few people, but still some people, have such environments. I think we could consider fully dropping support for non-openssl environments on the next major version. But the way this got broken was completely unintentional and we still have code around (what I'm unifying here) to actually support non-openssl environments. So, I think we can restore bare support for these environments for now (note that without this fix, as per the ruby-core issue, Also, note that fixing this was only a side effect, my original intention was to unify the code that requires |
2703d3e to
4906036
Compare
It's not that slow.
The `rubygems/security` require already does this.
It will give more useful information.
So it can be reused.
No check is done for the other expectation and they are completely symmetric as far as I can see.
The `openssl` require when openssl not present was having the side-effect the our custom require fallbacks would end up loading `Gem::Specification.stubs`. Co-authored-by: Alyssa Ross <hi@alyssa.is>
We patch `net-http-persistent` to not autoload `openssl`.
The whole test suite actually passes on my system, but it has weird errors in CI. Since I don't want to spend time on it, instead of running the whole test suite, I'm just adding a bare test to check that `gem list` works.
4906036 to
00ebf8c
Compare
|
This PR makes the code dealing with loading |
Description:
This PR reviews all code requiring openssl in both repos, and centralizes it as much as possible.
As a result, this PR fixes #3173, and closes #3059.
It also fixes https://bugs.ruby-lang.org/issues/16475.
I added a small test (just run
gem list bundler) to make sure that bare functionality ofrubygemsstill works without openssl.Tasks:
I will abide by the code of conduct.