search

rbenv / ruby-build

A tool to download, compile, and install Ruby on Unix-like systems.
https://rbenv.org/man/ruby-build.1
MIT License
3.89k stars 785 forks source link

Add CRuby security-fix releases 3.0.7, 3.1.5, 3.2.4, and 3.3.1 #2370

Closed kpfleming closed 7 months ago

kpfleming commented 7 months ago

https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-0-7-released/

https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-1-5-released/

https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-2-4-released/

https://www.ruby-lang.org/en/news/2024/04/23/ruby-3-3-1-released/

colszowka commented 6 months ago

Thanks @kpfleming @hsbt!

I have a short question - why are we going with OpenSSL 3.1.4 here specifically, instead of 3.1.5, or the newer 3.2 or 3.3 families? https://www.openssl.org/source/ lists 3.3.0 as the newest version, released ~2 weeks ago, with 3.1.5 released this january

eregon commented 6 months ago

Because https://github.com/rbenv/ruby-build/blob/346c0dccaee436a69ddd3bcf0498566982260e19/script/update-cruby#L28 and e.g. https://github.com/rbenv/ruby-build/blob/346c0dccaee436a69ddd3bcf0498566982260e19/share/ruby-build/3.3.0#L1

In general OpenSSL versions are updated in their own PR (and there is https://github.com/rbenv/ruby-build/blob/master/script/update-openssl)

eregon commented 6 months ago

IOW, please make a PR if you'd like to update openssl ;)

colszowka commented 6 months ago

@eregon Got it, thanks! I'm not sure though which version to go with, is it safe to go all the way to 3.3.0 from 3.1.4, or just 3.1.5? I'm not familiar with the versioning policies and compatibility of OpenSSL

mislav commented 6 months ago

@colszowka Thanks for pinging about this. I'm making a PR to upgrade to openssl 3.1.5.

why are we going with OpenSSL 3.1.4 here specifically, instead of 3.1.5, or the newer 3.2 or 3.3 families?

We could also update our Ruby build formulae to depend on OpenSSL 3.2 or 3.3, but since we've been depending on OpenSSL 3.1.x for a while now and since that branch is still maintained by the OpenSSL team, my vote is to stick with the 3.1.x branch for as long as it's maintained or until there is a concrete need to upgrade to OpenSSL 3.2/3.3, e.g. to gain access to a newer feature.