CHEF-35182 ruby net-imap

oc-chef-pedant/Gemfile

@@ -1,5 +1,57 @@
 source "https://rubygems.org"
 
+# minimum safe rack version, single-sourced from the
+# omnibus-config repo's infra-server cookbook libraries/safe_versions.rb (the
+# same file ruby_gems_cleanup.rb uses). This ensures `bundle install` here
+# refuses to resolve rack below the version the cleanup script considers
+# safe, regardless of what chef-zero or its dependencies would otherwise
+# pull in transitively.
+#
+# safe_versions.rb is copied into this same directory by the omnibus build
+# script (config/software/oc-chef-pedant.rb in chef-server-omnibus-config)
+# before `bundle install` runs -- it cannot be reached directly via the
+# omnibus/ git submodule here, because Omnibus's `source path:` fetcher only
+# copies this repo's own named source directory into an isolated build
+# folder, never sibling directories like the submodule.
+#
+# Fails open (no floor enforced this run, warning printed) if the file
+# hasn't been copied into place or otherwise can't be reached -- a genuine
+# bug in the file's own content (e.g. a syntax error) is NOT caught here and
+# will surface loudly instead.
+begin
+  require_relative 'safe_versions'
+rescue LoadError => e
+  warn "[Gemfile] safe_versions.rb not reachable (#{e.message}) -- no rack floor enforced this run."
+end
+
+resolve_safe_version = lambda do |const_name|
+  # NOTE: intentionally *not* reopening `module SafeVersions; end` here. Bundler
+  # evaluates this Gemfile via `instance_eval(string, ...)`, which gives a bare
+  # `module SafeVersions; end` its own lexical scope -- separate from the true
+  # top-level `::SafeVersions` that require_relative above defines. Reopening
+  # it that way silently shadows the real module with an empty one, so every
+  # lookup below would always report "not defined" even when the require
+  # succeeded. Referencing `::SafeVersions` explicitly (and guarding with
+  # `defined?`) avoids the shadow entirely.
+  unless defined?(::SafeVersions) && ::SafeVersions.const_defined?(const_name, false)
+    warn "[Gemfile] SafeVersions::#{const_name} is not defined -- defaulting to no floor (>= 0)."
+    next Gem::Version.new('0')
+  end
+
+  value = ::SafeVersions.const_get(const_name, false)
+  if value.nil? || value.to_s.strip.empty?
+    warn "[Gemfile] SafeVersions::#{const_name} is nil/blank -- defaulting to no floor (>= 0)."
+    next Gem::Version.new('0')
+  end
+
+  begin
+    Gem::Version.new(value.to_s)
+  rescue StandardError, ArgumentError => e
+    warn "[Gemfile] SafeVersions::#{const_name} has an invalid value (#{value.inspect}) -- defaulting to no floor (>= 0). (#{e.class}: #{e.message})"
+    Gem::Version.new('0')
+  end
+end
+
 gemspec
 # For debugging in dvm
 gem "pry"
@@ -12,6 +64,9 @@ gem "rest-client", git: "https://github.com/chef/rest-client.git", branch: "jfm/
 # PR #352 merged to main but not released yet - use main branch
 gem 'chef-zero', git: "https://github.com/chef/chef-zero.git", branch: "main"
 
+# see the SafeVersions setup at the top of this file.
+gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}"
+
 # If you want to load debugging tools into the bundle exec sandbox,
 # # add these additional dependencies into Gemfile.local
 eval(File.read(__FILE__ + ".local"), binding) if File.exist?(__FILE__ + ".local")

oc-chef-pedant/Gemfile.lock

@@ -153,6 +153,7 @@ DEPENDENCIES
   pry
   pry-byebug
   pry-stack_explorer
+  rack (>= 3.2.5)
   rake
   rest-client!
 

src/chef-server-ctl/Gemfile

@@ -1,5 +1,57 @@
 source "https://rubygems.org"
 
+# minimum safe rack/rexml versions, single-sourced from the
+# omnibus-config repo's infra-server cookbook libraries/safe_versions.rb (the
+# same file ruby_gems_cleanup.rb uses). This ensures `bundle install` here
+# refuses to resolve rack/rexml below the versions the cleanup script
+# considers safe, regardless of what chef or its dependencies would
+# otherwise pull in transitively.
+#
+# safe_versions.rb is copied into this same directory by the omnibus build
+# script (config/software/private-chef-ctl.rb in chef-server-omnibus-config)
+# before `bundle install` runs -- it cannot be reached directly via the
+# omnibus/ git submodule here, because Omnibus's `source path:` fetcher only
+# copies this repo's own named source directory into an isolated build
+# folder, never sibling directories like the submodule.
+#
+# Fails open (no floor enforced this run, warning printed) if the file
+# hasn't been copied into place or otherwise can't be reached -- a genuine
+# bug in the file's own content (e.g. a syntax error) is NOT caught here and
+# will surface loudly instead.
+begin
+  require_relative 'safe_versions'
+rescue LoadError => e
+  warn "[Gemfile] safe_versions.rb not reachable (#{e.message}) -- no rack/rexml floor enforced this run."
+end
+
+resolve_safe_version = lambda do |const_name|
+  # NOTE: intentionally *not* reopening `module SafeVersions; end` here. Bundler
+  # evaluates this Gemfile via `instance_eval(string, ...)`, which gives a bare
+  # `module SafeVersions; end` its own lexical scope -- separate from the true
+  # top-level `::SafeVersions` that require_relative above defines. Reopening
+  # it that way silently shadows the real module with an empty one, so every
+  # lookup below would always report "not defined" even when the require
+  # succeeded. Referencing `::SafeVersions` explicitly (and guarding with
+  # `defined?`) avoids the shadow entirely.
+  unless defined?(::SafeVersions) && ::SafeVersions.const_defined?(const_name, false)
+    warn "[Gemfile] SafeVersions::#{const_name} is not defined -- defaulting to no floor (>= 0)."
+    next Gem::Version.new('0')
+  end
+
+  value = ::SafeVersions.const_get(const_name, false)
+  if value.nil? || value.to_s.strip.empty?
+    warn "[Gemfile] SafeVersions::#{const_name} is nil/blank -- defaulting to no floor (>= 0)."
+    next Gem::Version.new('0')
+  end
+
+  begin
+    Gem::Version.new(value.to_s)
+  rescue StandardError, ArgumentError => e
+    warn "[Gemfile] SafeVersions::#{const_name} has an invalid value (#{value.inspect}) -- defaulting to no floor (>= 0). (#{e.class}: #{e.message})"
+    Gem::Version.new('0')
+  end
+end
+
 gemspec
 
 gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1"
@@ -11,3 +63,7 @@ gem "knife","~> 19.0.105"
 gem "knife-ec-backup", "~> 3.0.8"
 
 gem "public_suffix", "< 7.0" # public_suffix 7.0+ requires Ruby >= 3.2; pin for Ruby 3.1 compatibility
+
+# see the SafeVersions setup at the top of this file.
+gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}"
+gem "rexml", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}"