[pull] master from ruby:master - #1274
Merged
Merged
Conversation
`rb_w32_open_osfhandle` is defined only on mingw/mswin. ruby/io-console@3043df5241
Bumps [github.com/microsoft/vcpkg](https://github.com/microsoft/vcpkg) from 2026.06.24 to 2026.07.29. - [Release notes](https://github.com/microsoft/vcpkg/releases) - [Commits](microsoft/vcpkg@master...9e593bb) --- updated-dependencies: - dependency-name: github.com/microsoft/vcpkg dependency-version: 2026.07.29 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
The assertion for change_c_events < 0 compares ruby_vm_c_events_enabled against -change_iseq_events instead of -change_c_events, so it fires on a normal case where the iseq-event decrement happens to exceed the number of enabled C events. It trips flakily in irb's tracer test on RUBY_DEBUG builds. Use -change_c_events, mirroring the first assertion. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The splat rebuild in compile_massign_lhs passes the arena-allocated INSN (iobj) to RB_OBJ_WRITTEN (since f228692). iobj is not a heap object, so the barrier touches the page it happens to land on, which is undefined. It is harmless by luck today; with a GC that records an edge for shareable iseqs, GET_HEAP_PAGE(iobj) dereferences garbage and segfaults (deterministic in btest test_insns #358/#553 under --parser=parse.y). Pass the ci that actually became the operand, which is the edge being recorded. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…951] Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…write_certificate
Gem::Security.write managed the following 2 cases.
* pemmable is RSA/DSA/EC private key, an instance of OpenSSL::PKey::{RSA,DSA,EC}
* pemmable is certificate, an instance of OpenSSL::X509::Certificate
There was no case that pemmable was public RSA/DSA/EC key, an instance of
OpenSSL::PKey::{RSA,DSA,EC}.
This situation is not convenient in the case that pemmable is ML-DSA
private key, an instance of OpenSSL::PKey::PKey which doesn't have #to_pem, and instead
has #public_to_pem and #private_to_pem as alternative.
The Gem::Security.write with optional passphrase and cipher in certificate case
is not intuitive.
So, refactored the code as follows:
* Add Gem::Security.write_private_key for writing private keys, with optional
passphrase and cipher for encryption
* Add Gem::Security.write_certificate for writing certificates, without
passphrase and cipher. Certificates are never encrypted.
OpenSSL::X509::Certificate#to_pem doesn't have passphrase/cipher arguments
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_x509cert.c#L169
* Remove Gem::Security.write
* Update all callers to use the new methods
* Rename test methods to test Gem::Security.write_private_key and add
test_class_write_certificate
Assisted-by: Claude:claude-opus-4-6[1m]
ruby/rubygems@f0073e29ce
Replace OpenSSL::PKey::{RSA,DSA,EC}#to_pem with
OpenSSL::PKey::{RSA,DSA,EC}#private_to_pem or #public_to_pem.
Continue to use OpenSSL::X509::Certificate#to_pem.
This makes the code ML-DSA compatible since OpenSSL::PKey::PKey used for ML-DSA
doesn't have #to_pem but has #private_to_pem and #public_to_pem.
Note this changes the private key's output format from the following formats to
more common PKCS #8 format.[1][2][3][4]
* RSA: PKCS #1 RSAPrivateKey
* DSA: traditional OpenSSL DSAPrivateKey
* EC: SEC 1/RFC 5915 ECPrivateKey
OpenSSL::PKey.read has supported PKCS #8 format as well as previous RSA/DSA/EC
formats since the beginning.
OpenSSL::PKey::{RSA,DSA,EC}#to_pem are not encouraged to use.[1][2][3]
The public key is format is unchanged.[1][2][3][5]
[1] OpenSSL::PKey::RSA#to_pem
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_pkey_rsa.c#L223-L280
[2] OpenSSL::PKey::DSA#to_pem
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_pkey_dsa.c#L213-L271
[3] OpenSSL::PKey::EC#to_pem
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_pkey_ec.c#L402-L459
[4] OpenSSL::PKey::PKey#private_to_pem
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_pkey.c#L991-L1010
[5] OpenSSL::PKey::PKey#public_to_pem
https://github.com/ruby/openssl/blob/27c59a4cc8a652004184182f734de0161ba08b41/ext/openssl/ossl_pkey.c#L1082-L1093
Assisted-by: Claude:claude-opus-4-6[1m]
ruby/rubygems@785ed98c85
As I modified logic related to output format in tool/create_certs.rb and tool/create_encrypted_key.rb at the last commit, I ran these scripts to recreate the testing .pem files as follows. Now the private .pem files are PKCS #8 format. ``` $ ruby tool/create_certs.rb $ ruby tool/create_encrypted_key.rb ``` ruby/rubygems@99de0940d8
Because these hardcoded values make the tests fail when recreating the keys. This is not convenient. * Remove hardcoded subjectKeyIdentifier value assertions. * In test_sign, replace assertion with hardcoded value with PRIVATE_KEY.verify (OpenSSL::PKey::RSA#verify) to assert signature Assisted-by: Claude:claude-opus-4-6[1m] ruby/rubygems@873a5bd82c
…k in Gem::Security.sign
Remove the OpenSSL::PKey::{RSA,DSA,EC}#private? check in open_private_key. This
makes the code ML-DSA compatible since OpenSSL::PKey::PKey used for ML-DSA
doesn't have #private?.
According to the discussion on <ruby/openssl#1085>,
there is no reliable way to check if key is private or not in
OpenSSL::PKey::PKey for now. We shouldn't use
OpenSSL::PKey::{RSA,DSA,EC}#private?.
If a public key is passed, the subsequent signing operations will raise
ArgumentError in Gem::Security.sign. Rescue the ArgumentError and
OpenSSL::PKey::PKeyError too in a more reliable way, and raise
Gem::Security::Exception in Gem::Security.sign.
Add the following 2 bad key tests.
* test_execute_build_bad_key to test --build with a public key (bad key) as
--private-key
* test_execute_sign_bad_key to test --sign with a public key (bad key) as
--private-key
Assisted-by: Claude:claude-opus-4-6[1m]
ruby/rubygems@cef0fe7b2b
When the same Gem::YAMLSerializer copy is shipped in two gems (RubyGems and Bundler) and required from different paths, the second load redefines its constants and emits "already initialized constant" warnings. Add an idempotent guard at the top of yaml_serializer.rb so a second load from any path short-circuits. This prepares Bundler to reuse RubyGems' copy. ruby/rubygems@268da379ad Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add lib/rubygems/yaml_serializer.rb to the gem's file list so the Bundler gem carries its own copy of Gem::YAMLSerializer. This keeps Bundler self-contained on RubyGems versions that predate it, the same way the vendored URI and SecureRandom are shipped. ruby/rubygems@50ea015c82 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bundler now uses Gem::YAMLSerializer unconditionally for settings and the plugin index instead of falling back to its own stub serializer. The fallback is no longer reachable because the Bundler gem ships a copy of Gem::YAMLSerializer for RubyGems versions that predate it. ruby/rubygems@60b7f819dc Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…test suite The RubyGems test suite already covers almost all of the Bundler yaml_serializer spec through test_gem_safe_yaml.rb. Port the two missing cases (URL mapping keys as used by mirror settings, and Psych interoperability in both directions) and drop the Bundler spec. ruby/rubygems@e24041cb5e Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bundler::YAMLSerializer is no longer referenced anywhere now that Bundler uses Gem::YAMLSerializer everywhere. ruby/rubygems@b74a1987db Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The stub serializer dumped an empty hash as a bare "key:" line and loaded
such a line back as an empty hash. Gem::YAMLSerializer dumps it as
"key: {}" and correctly loads a bare key as nil, so index files written
by older Bundler versions would crash load_index with a TypeError. Treat
nil sections as empty when loading, and update the index spec to the new
dump format for hook arrays.
ruby/rubygems@720cc8ac56
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )