CHEF-35182 ruby net-imap - #4227
Open
lbakerchef wants to merge 8 commits into
Open
Conversation
lbakerchef
added
the
ai-assisted
lbakerchef
force-pushed
the
CHEF-33469/lbaker
branch
3 times, most recently
from
August 4, 2026 20:26
4e0fefd to
80d3c69
Compare
Add explicit rack/rexml version floors to the three Gemfiles here that pull in chef and/or chef-zero (chef-server-ctl, oc-id, oc-chef-pedant), sourced dynamically from the same SafeVersions::MINIMUM_SAFE_RACK_VERSION / MINIMUM_SAFE_REXML_VERSION constants that ruby_gems_cleanup.rb enforces on upgrade, reached via the omnibus/ submodule's libraries/safe_versions.rb (bumped in the prior commit). This makes the safety floor a single source of truth instead of two independently maintained values that can drift apart. - src/chef-server-ctl/Gemfile: new rack + rexml floors (had none). - src/oc-id/Gemfile: replaced the previous static `gem 'rack', '>= 3.2.4'` with the dynamic floor; added a new rexml floor (had none). - oc-chef-pedant/Gemfile: new rack floor only (rexml isn't in its resolved dependency graph). Each Gemfile wraps the require_relative in begin/rescue LoadError and fails open (warns, defaults to no floor) if the submodule isn't checked out or the file can't otherwise be reached, or if the expected constants aren't defined/are blank -- so a developer who hasn't run `git submodule update --init` still gets a working `bundle install`, just without the extra floor enforced. A genuine bug in safe_versions.rb's own Ruby (syntax error, etc.) is not swallowed and will still fail the build loudly, by design. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Advance the omnibus submodule pointer to chef-server-omnibus-config@0fa4475 (CHEF-33469/lbaker branch there), which introduces libraries/safe_versions.rb -- the single source of truth for MINIMUM_SAFE_RACK_VERSION / MINIMUM_SAFE_REXML_VERSION that ruby_gems_cleanup.rb now uses -- and points ruby_gems_cleanup.rb at it instead of its own hardcoded constants. This makes the new file reachable at omnibus/files/server-ctl-cookbooks/infra-server/libraries/safe_versions.rb for the Gemfile changes in the following commit. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Companion change to chef-server-omnibus-config's copy-fix (same branch,
CHEF-33469/lbaker): that repo's build scripts now copy safe_versions.rb
directly into each of these three components' build directories, next to
the Gemfile, before `bundle install` runs -- instead of leaving each
Gemfile to reach across the omnibus/ git submodule boundary, which is
structurally absent during a real isolated-build-folder Buildkite build
(see that repo's commit for the full root cause).
Shorten each Gemfile's require_relative target from the now-unreachable
deep relative path to a bare same-folder reference, and update the doc
comment above it to describe the new copy-based mechanism.
- src/chef-server-ctl/Gemfile
- src/oc-id/Gemfile
- oc-chef-pedant/Gemfile
Also bumps the omnibus submodule to chef-server-omnibus-config commit
8d30726 ("copy safe_versions.rb next to each Gemfile during build"), the
companion commit that adds the copy step these Gemfiles now depend on.
No Gemfile.lock changes needed -- the floors these locks already record
(rack >= 3.2.5, rexml >= 3.4.2) are unaffected; this only fixes whether the
require actually succeeds during a real build.
Verified: ruby -c on all three Gemfiles, plus a local scratch test running
the exact require_relative + resolve_safe_version logic with a copy of
safe_versions.rb placed alongside it -- both floors resolve correctly with
no fallback warnings.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
lbakerchef
force-pushed
the
CHEF-33469/lbaker
branch
from
August 4, 2026 20:46
80d3c69 to
c69aed4
Compare
Add a net-imap version floor to oc-id's Gemfile using the same
resolve_safe_version.call(:CONSTANT) pattern already used for
rack/rexml, sourced from omnibus-config's safe_versions.rb (the
same file ruby_gems_cleanup.rb enforces on upgrade):
gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}"
net-imap isn't a direct oc-id dependency -- it's pulled in
transitively via mail -- but CVE-2025-XXXXX (net-imap response
injection) affects versions below 0.5.14 (Ruby < 3.2) or 0.6.4
(Ruby >= 3.2). NET_IMAP_FIX_VERSION resolves to whichever floor
applies to the Ruby this Gemfile is bundled under, so `bundle
install` refuses to resolve a vulnerable net-imap regardless of
what mail or any other dependency would otherwise pull in.
Comment updated to mention net-imap alongside rack/rexml and to
point at NET_IMAP_FIX_VERSION specifically, since (unlike the
rack/rexml floors) it's a computed value rather than a fixed one --
see safe_versions.rb for why.
Companion change in chef-server-omnibus-config (commit f38c231,
"extend safe-versions floors to net-imap") adds the
NET_IMAP_FIX_VERSION_0_4/_0_5/_0_6 constants, the generic
NET_IMAP_FIX_VERSION resolution, and generalizes ruby_gems_cleanup.rb's
vulnerable-gem sweep to cover net-imap; that repo's submodule
pointer is bumped in a separate commit here.
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extract the minimum safe rack/rexml versions used by ruby_gems_cleanup.rb into a new libraries/safe_versions.rb, so there is exactly one place these versions are declared instead of two independently-maintained copies.
chef-server's Gemfiles (chef-server-ctl, oc-id, oc-chef-pedant) require_relative this same file via the omnibus/ submodule, so their rack/rexml floors stay tied to this single source too.