Bug #22480: Ruby's release tarballs are not POSIX compliant since 2018

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED

[stabbles (Harmen Stoppels)]

Hi,

This is a bit of a curiosity, but I noticed that Ruby's release tarballs are not POSIX compliant, because they're missing an end-of-archive marker.

See https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html#:~:text=At%20the%20end%20of%20the%20archive%20file%20there%20shall%20be%20two%20512-byte%20blocks

Apparently Ruby has custom code to create its release tarballs, and it does not close the tar writer, which would add this.

I noticed this cause I'm working on https://stoppels.ch/tar/, a test suite with dozens of tricky tar files, plus a table that maps the differences between tar implementations.

For security purposes, some package managers (like uv), are looking to harden tar parsers, and Ruby's release tarballs would not be accepted.

The release tarballs from Ruby 2.6.0 onwards are not POSIX compliant, basically since 2018.

[nobu (Nobuyoshi Nakada)]

• Backport changed from 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN to 3.3: REQUIRED, 3.4: REQUIRED, 4.0: REQUIRED

[stabbles (Harmen Stoppels)]

• Status changed from Open to Closed

Applied in changeset git|130c9ec44bd35c7319cdc99c301419188510e3a9.

---

[Bug #22480] make release tarballs POSIX compliant

Ruby's own release tarballs are not POSIX compliant since 2018, because
the end-of-archive marker (two blocks of zeros) were missing.

The end-of-archive is written when the TarWriter is closed, which is
what this commit does explicitly.

Signed-off-by: Harmen Stoppels [e-mail]