Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 247790 - dev-lang/ruby-1.8.7-p72 breaks net-analyzer/metasploit
Summary: dev-lang/ruby-1.8.7-p72 breaks net-analyzer/metasploit
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Ruby Team
URL: https://bugs.launchpad.net/bugs/282302
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-11-20 17:24 UTC by H D Moore
Modified: 2008-11-26 22:13 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Changeset 18485 from Ruby SVN (ruby-1.8.6-shortname_constants.patch,1.31 KB, patch)
2008-11-22 16:13 UTC, Alex Legler (RETIRED)
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description H D Moore 2008-11-20 17:24:30 UTC
The current "stable" release of Ruby contains a bug that breaks any package which defines short-name constants inside of Ruby mixins. More information about this bug can be found in the URL:
https://bugs.launchpad.net/bugs/282302

The problem is the ruby "stable" release of 1.8.7-p72 is broken, but the latest stable snapshot is not. At some point, the patch which introduced this error made its way into Gentoo's ruby ebuild, which results in some of our users saying that Ruby is broken on Gentoo.
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2008-11-21 01:46:56 UTC
(In reply to comment #0)
> The problem is the ruby "stable" release of 1.8.7-p72 is broken

The latest stable release in the tree is 1.8.6_p287-r1 for all arches.

> , but the latest
> stable snapshot is not. At some point, the patch which introduced this error
> made its way into Gentoo's ruby ebuild, which results in some of our users
> saying that Ruby is broken on Gentoo.
Comment 2 H D Moore 2008-11-21 02:16:48 UTC
Thanks! We had a user report the issue and were not sure whether Gentoo backported the buggy patch into the 1.8.6 tree or not. The easiest way to test:

$ wget http://metasploit.com/svn/framework3/trunk/lib/msf/sanity.rb
$ ruby sanity

A buggy version will show this:
$ ruby sanity.rb 

***********************************************************************
***                                                                   *
*** This version of the Ruby interpreter has significant problems, we *
*** strongly recommend that you switch to version 1.8.6 until these   *
*** issues have been corrected. Alternatively, you can download,      *
*** build, and install the latest Ruby snapshot from:                 *
***  - http://www.ruby-lang.org/                                      *
*** For more information, please see the following URL:               *
***  - https://bugs.launchpad.net/bugs/282302                         *
***                                                                   *
***********************************************************************
Comment 3 H D Moore 2008-11-21 02:17:55 UTC
My apologies for not testing myself, the only Gentoo machine I had ate its hard drive two weeks ago and has yet to be restored.
Comment 4 Sergio D. Rodríguez Inclan 2008-11-21 03:57:32 UTC
I've tested the script with 1.8.6_p287-r1 and 1.8.7_p72 versions, both show the message.
Comment 5 Alex Legler (RETIRED) archtester gentoo-dev Security 2008-11-21 06:04:31 UTC
(In reply to comment #2)
> Thanks! We had a user report the issue and were not sure whether Gentoo
> backported the buggy patch into the 1.8.6 tree or not.
> 

To be precise, Gentoo doesn't backport any buggy patches. Gentoo ships the patch level versions that appear on ftp://ruby-lang.org. So it's not a Gentoo specific issue, it's a _Ruby_ bug.

> A buggy version will show this:
> $ ruby sanity.rb 
> 

The "buggyness" starts with 1.8.6 patchlevel 286, pl 114 still seems fine. 
I'll try to apply the patches you mentioned in the launchpad bug to pl 286 and 287 and report back.
Comment 6 Alex Legler (RETIRED) archtester gentoo-dev Security 2008-11-22 16:13:25 UTC
Created attachment 172869 [details, diff]
Changeset 18485 from Ruby SVN

(In reply to comment #5)
> I'll try to apply the patches you mentioned in the launchpad bug to pl 286 and
> 287 and report back.
> 

The attached patch fixes this issue for ruby-1.8.6_p286, _p287 and _p287-r1, too.

So, bottom line: Affected packages, all can be fixed using the aforementioned patch:
ruby-1.8.6_p286
ruby-1.8.6_p287
ruby-1.8.6_p287-r1
ruby-1.8.7_p72

(The bug's summary still states the wrong version btw)
Comment 7 Hans de Graaff gentoo-dev Security 2008-11-26 22:13:01 UTC
Fixed with ruby-1.8.6_p2867-r2 and ruby-1.8.7_p72-r1. Thanks Alex.