Bug #15384: ssl_certs are duplicated in RubyGems and Bundler

• Status: Closed
• Assignee: hsbt (Hiroshi SHIBATA)
• Target version: -
• ruby -v: ruby 2.6.0dev (2018-11-29 trunk 66092) [x86_64-linux]
• Backport: 2.4: DONTNEED, 2.5: DONTNEED, 2.6: DONTNEED

[vo.x (Vit Ondruch)]

It is pity that the same ssl_certs are shipped on multiple places, once as part of RubyGems and the other set as part of Bundler. This makes the security review much harder (actually, in Fedora/RHEL packages, we are not supposed to ship any certificates, so it makes it harder to remove them).

Therefore, please ship just one copy of the certificates if really necessary (it should not be necessary on properly maintained systems).

[shevegen (Robert A. Heiler)]

Agree on the "one rather than two". It is probably redundant after the merge.

I can't answer the second sentence since there may have been (different?)
reasons for adding certificates - but it would make sense to require only
one rather than two either way.

[hsbt (Hiroshi SHIBATA)]

• Status changed from Open to Assigned
• Assignee set to hsbt (Hiroshi SHIBATA)

[hsbt (Hiroshi SHIBATA)]

• File unify-certification-bundler.patch unify-certification-bundler.patch added

I made a patch that unifies both certificates. I propose it to bundler upstream.

[vo.x (Vit Ondruch)]

Is the patch correct? Will it work when RubyGems are updated via gem update --system? I have not tested it, just wondering ...

Moreover, I don't understand why Bundler does not use RubyGems facilities for such functionality (but I understand the patch would be probably more complex :) ).

[vo.x (Vit Ondruch)]

vo.x (Vit Ondruch) wrote:

Is the patch correct? Will it work when RubyGems are updated via gem update --system? I have not tested it, just wondering ...

Gem::RUBYGEMS_DIR should be probably used to initialize the rubygems_certs_dir

https://github.com/rubygems/rubygems/blob/master/lib/rubygems.rb#L116

[vo.x (Vit Ondruch)]

There is even Gem::Request.get_cert_files

[hsbt (Hiroshi SHIBATA)]

I did update the latest patch: https://github.com/bundler/bundler/pull/7035

[hsbt (Hiroshi SHIBATA)]

• Status changed from Assigned to Closed
• Backport changed from 2.4: UNKNOWN, 2.5: UNKNOWN to 2.4: DONTNEED, 2.5: DONTNEED, 2.6: DONTNEED

I fixed it at r67539