Skip to content

Conversation

@nmburgan
Copy link
Member

  • Update the update_gems script to also update the projects with any new components, and fixes an issue using the v2 RubyGems API.
  • Updates many components, including OpenSSL 3.0.18 which addresses CVE-2025-9230 and GHSA-76r2-c3cg-f5r9.
  • Removes the 7.x runtime and associated Ruby 2.7 references and simplifies some of the code. Should we ever need to build 7.x again, we can branch from a previous commit.
  • Removes references to AIX 7.1 and SLES 11.

@bastelfreak
Copy link
Contributor

bastelfreak commented Nov 17, 2025

stupid question: if we want to see the different version bumps in the changelog, the easiest way would be one PR per changed component. That's a bit more work during the update (until we automate that part), but I think it will provide a big benefit for the users?

Edit: When I do version bumps I always try to do $component: Update $oldver->$newver, so users can easily compare the version range with their internal CVE database, if they have any.

@nmburgan
Copy link
Member Author

We could certainly add that to the script. Probably makes sense if we plan to run this in automation.

@nmburgan
Copy link
Member Author

I suppose one problem right now is that not all components are used in both projects. So a lot of updates will be for OpenBolt and not OpenVox. But once I get around to breaking up this repo and incorporating them into the project repos, that won't be a problem.

@nmburgan nmburgan force-pushed the update_update_gems branch 4 times, most recently from 493100d to d9bc9ea Compare November 17, 2025 21:58
@nmburgan
Copy link
Member Author

Quite noisy for the commit log for this PR, but should be much quieter in the future.

@nmburgan nmburgan force-pushed the update_update_gems branch 4 times, most recently from 0060fad to ffbef26 Compare November 19, 2025 17:48
pkg.sha256sum '0c3756bca047c9270281d7c4dcdecd000b72e38a183c930661eba9690839b541'
pkg.build_requires 'python3-setuptools'
pkg.url "https://github.com/SELinuxProject/selinux/releases/download/#{pkg.get_version}/libselinux-#{pkg.get_version}.tar.gz"
when /^(debian-13|sles-16)-/
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reading through https://software.opensuse.org/package/libselinux, opensuse 16 ships 3.9. Now I don't know how that relates to SLES 16 :(

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, interesting. I was looking at openSUSE Leap 16.0 on https://pkgs.org/search/?q=selinux. So yeah, not sure how any of that translates to SLES. I wonder if they have a container image out yet...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This image has 3.8.1
https://registry.suse.com/repositories/suse-sles-16-0-toolbox-78c4fbec-c7f5-479f-8196-f5101a34cc1e
That's not that full SLES 16 container image, but I'm inclined to believe that I think.

$dest="C:\setup-x86_64.exe"
Invoke-WebRequest -Uri $url -OutFile $dest
cmd /c "C:\setup-x86_64.exe -s https://cygwin.osuosl.org -q -P ruby,ruby-devel,gcc-core,make,git,libyaml-devel"
cmd /c "C:\setup-x86_64.exe -s https://cygwin.osuosl.org -q -P ruby=3.2.2-2,ruby-devel=3.2.2-2,gcc-core,make,git,libyaml-devel"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why is this 3.2.2? configs/components/ruby-3.2.rb has 3.2.9.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the only 3.2 version available on Cygwin's repositories. They stay up to date with the latest 3.4, but this is literally the only 3.x version otherwise. Both fortunate for us, and also unfortunate it's stuck at such an old one. This ruby is only used for actually running the scripts, not for any build stuff, although I'm not 100% sure no shared libraries or whatever are used, so I wanted to stick with 3.2.

@nmburgan nmburgan force-pushed the update_update_gems branch 3 times, most recently from 76cd139 to b7b1a35 Compare November 20, 2025 00:20
@nmburgan
Copy link
Member Author

Looks like the latest ruby_smb might break OpenBolt (https://github.com/OpenVoxProject/openbolt/actions/runs/19552520911/job/55987566901?pr=140). Need to do some more investigation.

@nmburgan nmburgan force-pushed the update_update_gems branch 2 times, most recently from 51f652a to 00843c0 Compare November 21, 2025 20:34
@nmburgan
Copy link
Member Author

Reverted ruby_smb back to 1.1.0 (we already had been down this path before, my bad).

@nmburgan nmburgan force-pushed the update_update_gems branch 2 times, most recently from c87b4a7 to 8a52982 Compare November 21, 2025 21:21
Even though the openbolt runtime comment says it's needed for Augeas, it really isn't. It was only needed for Nokogiri.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants