drbrain changed the topic of #rubygems to: RubyGems 2.1.5: http://bit.ly/rubygems-2-1-5 CVE-2013-4363: http://bit.ly/CVE-2013-4363 - Latest status: http://twitter.com/rubygems_status and http://status.rubygems.org
mattwynne has quit [Ping timeout: 256 seconds]
<dwradcliffe> evan: what was it?
mattwynn_ has quit [Remote host closed the connection]
mattwynne has joined #rubygems
jfoy has quit [Quit: jfoy]
jfoy has joined #rubygems
vinay_ has quit [Quit: Leaving]
mattwynne has quit [Ping timeout: 246 seconds]
havenwood has joined #rubygems
imperator has quit [Quit: Valete!]
tjbiddle has quit [Ping timeout: 240 seconds]
jfoy has quit [Quit: jfoy]
jcaudle has joined #rubygems
imperator has joined #rubygems
havenwood has quit [Remote host closed the connection]
lsegal has quit [Read error: Connection reset by peer]
lsegal has joined #rubygems
lsegal` has joined #rubygems
lsegal has quit [Read error: Connection reset by peer]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 246 seconds]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 240 seconds]
imperator has quit [Quit: Leaving]
jonahR has joined #rubygems
antichatter has joined #rubygems
huoxito has quit [Quit: Leaving]
antichatter has quit [Quit: Colloquy for iPhone - http://colloquy.mobi]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 264 seconds]
DanKnox is now known as DanKnox_away
jcaudle has quit [Quit: jcaudle]
havenwood has joined #rubygems
lsegal` has quit [Read error: Connection reset by peer]
lsegal has joined #rubygems
havenwood has quit [Ping timeout: 264 seconds]
tenderlove has joined #rubygems
tenderlove has quit [Client Quit]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 256 seconds]
Elhu has joined #rubygems
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 264 seconds]
Elhu has quit [Quit: Computer has gone to sleep.]
DanKnox_away is now known as DanKnox
jonahR has quit [Ping timeout: 252 seconds]
jonahR has joined #rubygems
jonahR has quit [Quit: jonahR]
mattwynne has joined #rubygems
Elhu has joined #rubygems
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
havenwood has joined #rubygems
workmad3 has joined #rubygems
mattwynne has quit [Ping timeout: 264 seconds]
DanKnox is now known as DanKnox_away
havenwood has quit [Ping timeout: 256 seconds]
lsegal has quit [Read error: Connection reset by peer]
lsegal has joined #rubygems
mattwynne has joined #rubygems
Guest88749 is now known as karlfreeman_
karlfreeman_ is now known as karlfreeman
karlfreeman is now known as Guest98448
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
lsegal has quit [Quit: Quit: Quit: Quit: Stack Overflow.]
mattwynne has quit [Ping timeout: 260 seconds]
havenwood has joined #rubygems
havenwood has quit [Read error: Connection reset by peer]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 240 seconds]
mattwynne has joined #rubygems
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 240 seconds]
tekin has joined #rubygems
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 240 seconds]
Guest98448 is now known as karlfreeman
tekin has quit [Quit: Computer has gone to sleep.]
workmad3 has quit [Ping timeout: 240 seconds]
imperator has joined #rubygems
Boohbah has quit [Write error: Connection reset by peer]
Boohbah has joined #rubygems
Ferr has joined #rubygems
havenwood has joined #rubygems
huoxito has joined #rubygems
Elhu has quit [Quit: Computer has gone to sleep.]
havenwood has quit [Ping timeout: 256 seconds]
Ferr has quit [Ping timeout: 245 seconds]
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
mattwynne has quit [Ping timeout: 260 seconds]
Elhu has joined #rubygems
mattwynne has joined #rubygems
tekin has joined #rubygems
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
mattwynne has quit [Read error: Connection reset by peer]
mattwynne has joined #rubygems
workmad3 has joined #rubygems
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 246 seconds]
Ferr has joined #rubygems
mattwynne has quit [Ping timeout: 256 seconds]
almostwhitehat has joined #rubygems
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 240 seconds]
marpaia has joined #rubygems
stevenharman has quit [Quit: Leaving...]
arthurnn has joined #rubygems
tbuehlmann has joined #rubygems
havenwood has joined #rubygems
stevenharman has joined #rubygems
codezomb has joined #rubygems
<codezomb> this morning I seem to be getting this error with rubygems, any thoughts?
<codezomb> Gem::RemoteFetcher::FetchError: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed (https://s3.amazonaws.com/production.s3.rubygems.org/gems/method_source-0.8.2.gem)
<codezomb> switching to http seems to fix it
<Rotonen> your certs are not up to date
<codezomb> Rotonen: never got that memo, is there documentation anywhere?
<codezomb> gem update --system tells me lastest version is installed
<codezomb> nvm, rvm osx-ssl-certs update all fixes it
mattwynne has joined #rubygems
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
<mjc__> rbx made its standard lib gems, interesting
havenwood has quit [Remote host closed the connection]
havenwood has joined #rubygems
havenwood has quit [Ping timeout: 245 seconds]
<imperator> i thought they were doing that for 2.x eventually
havenwood has joined #rubygems
arthurnn has quit [Remote host closed the connection]
jfoy has joined #rubygems
x1337807x has joined #rubygems
arthurnn has joined #rubygems
adambeynon has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
tekin has quit [Ping timeout: 240 seconds]
Elhu has quit [Quit: Computer has gone to sleep.]
tekin has joined #rubygems
jfoy has quit [Quit: jfoy]
mattwynne has quit [Remote host closed the connection]
jfoy has joined #rubygems
tekin has quit [Ping timeout: 256 seconds]
mattwynne has joined #rubygems
tekin has joined #rubygems
mattwynne has quit [Remote host closed the connection]
mattwynne has joined #rubygems
mattwynne has quit [Ping timeout: 252 seconds]
DanKnox_away is now known as DanKnox
Ferr has quit [Ping timeout: 245 seconds]
huoxito has quit [Ping timeout: 246 seconds]
tekin has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
mattwynne has joined #rubygems
Ferr has joined #rubygems
arthurnn has quit [Remote host closed the connection]
huoxito has joined #rubygems
mando has joined #rubygems
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
havenwood has quit [Remote host closed the connection]
x1337807x has joined #rubygems
Sc0rp10n has joined #rubygems
workmad3 has quit [Ping timeout: 252 seconds]
arthurnn has joined #rubygems
jfoy has quit [Quit: jfoy]
havenwood has joined #rubygems
tbuehlmann has quit [Ping timeout: 245 seconds]
mattwynne has quit [Remote host closed the connection]
jfoy has joined #rubygems
mattwynne has joined #rubygems
mattwynne has quit [Ping timeout: 252 seconds]
tjbiddle has joined #rubygems
eighthbit has joined #rubygems
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
Ferr has quit []
x1337807x has joined #rubygems
TheComrade has joined #rubygems
_whitelogger has joined #rubygems
<TheComrade> Pretty new to Ruby and gems… Question is: i have a test gem hosted on a private repo that has a dependency. I'm installing it using the --source param to specify the repo.. but it fails because it cannot find the dependency (thor). I've been googling but the terms are too generic and haven't been able to figure it out .. any pointers appreciated. :) thanks.
jfoy has joined #rubygems
jfoy has quit [Client Quit]
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
tjbiddle has quit [Ping timeout: 240 seconds]
dvu has quit [Ping timeout: 241 seconds]
tjbiddle has joined #rubygems
mando has joined #rubygems
x1337807x has joined #rubygems
x1337807x has quit [Client Quit]
<imperator> TheComrade, the dependency is not stored locally i take it?
<imperator> in the private repo, i mean
<drbrain> TheComrade: ↑
<TheComrade> Correct. Is that a requirement? Like, I can clearly do 'gem install thor' without a problem.. but if I gem install --source http://myrepo my_gem it does not know how to get thor, it appears.
<drbrain> rubygems is supposed to work cross-repository
<drbrain> TheComrade: does `gem install my_gem --clear-sources --source http://myrepo --source https://rubygems.org` work?
<drbrain> TheComrade: and, what version of RubyGems are you using?
<TheComrade> drbrain: 1.3.7 --clear-sources invalid option
<drbrain> TheComrade: why 1.3.7?
jfoy has joined #rubygems
<drbrain> I think the behavior in 1.3.7 requires you to list both sources
<drbrain> TheComrade: does `gem install my_gem --source http://myrepo --source https://rubygems.org` work?
gen0cide_ has joined #rubygems
<TheComrade> drbrain: this is what Centos provides.
<gen0cide_> Looks like the rubygems spec is hosted on S3 now, anyone else getting a cert error?
<drbrain> gen0cide_: I've been seeing sporadic reports from users, evan was going to look into it
<TheComrade> drbrain: specifying rubygems source works.
<TheComrade> drbrain: Seems that confirms the problem
<drbrain> TheComrade: in newer rubygems --source is additive, in older rubygems (like 1.3.7) you must list all the sources you want to use
<drbrain> you can set this in ~/.gemrc if you like
<drbrain> gem help env should show you how
<TheComrade> drbrain: Cool, thanks. I think it's looking like I need to get a more recent version of ruby on here, rbenv-style, for this and other reasons.
<drbrain> TheComrade: there are two minor security issues in 1.3.7
x1337807x has joined #rubygems
TheComrade has quit [Quit: TheComrade]
<gen0cide_> @drbrain, @evan - it looks like rubygems.org/latest_specs.4.8.gz is presenting a 302 redirect to the S3 URL
<drbrain> gen0cide_: yep
<drbrain> gen0cide_: it's been that way for, I think, the entire time rubygems.org has existed
<gen0cide_> and while both the rubygems.org and the s3.amazonaws.com both are using valid certs
<gen0cide_> ruby net/http w/ openssl is not re-validating amazon's cert
<drbrain> gen0cide_: what I'm curious about is why everyone isn't reporting this issue
<drbrain> I'm sure it is real, but it may be geographically constrained?
<drbrain> anyhow, do you have an example I can use to reproduce?
<gen0cide_> was able to pull down successfully with curl -o foo.gz -v --location https://rubygems.org/latest_specs.4.8.gz
<gen0cide_> but when you attempt to do it in Ruby w/ standard net lib, it fails
<drbrain> does your curl use a different set of certificates than openssl?
<gen0cide_> @drbrain - I'm wondering if it's not cached
stevenharman has quit [Quit: Linkinus - http://linkinus.com]
arthurnn has quit [Remote host closed the connection]
<gen0cide_> Disclosure: I'm _very_ novice on how gems/rubygems works, but I wonder if there isn't something caching
<gen0cide_> (the people whom it works for are getting served cached version)
<gen0cide_> just a thought
<drbrain> rubygems always makes a HEAD request to latest_specs.4.8.gz or specs.4.8.gz
arthurnn has joined #rubygems
<drbrain> or do you mean server-side caching?
<gen0cide_> server-side
<gen0cide_> for example if they're using a CDN like CloudFlare
<gen0cide_> how often does latest_specs.4.8.gz change?
<drbrain> every time a gem is pushed (every few minutes)
<drbrain> evan could give a more exact value
<drbrain> gen0cide_: also, where are you geographically?
<gen0cide_> West coast, SF Bay Area
<drbrain> so you should be using similar routes to most users
<drbrain> what OS?
<gen0cide_> OS X
<gen0cide_> using RVM
<drbrain> mpapis: does RVM install SSL certificates with its openssl?
<gen0cide_> rvm 1.22.2 (stable) by Wayne E. Seguin <wayneeseguin@gmail.com>, Michal Papis <mpapis@gmail.com> [https://rvm.io/], gem version = 2.0.6, ruby 2.0.0p247 (2013-06-27 revision 41674) [x86_64-darwin12.3.0]
<drbrain> gen0cide_: I'm wondering if the certs have changed, but most people aren't noticing because they have the necessary certificate installed through other means
<gen0cide_> does ruby gems use a pinned ssl cert?
<gen0cide_> because my browser validates
<gen0cide_> openssl validates via cmdline
<gen0cide_> and curl -v validates as well
<gen0cide_> for both rubygems.org and s3.amazonaws.com
stevenharman has joined #rubygems
<drbrain> rubygems uses the openssl defaults and adds its own built-in trusted certificates
almostwhitehat has quit []
<gen0cide_> it looks like line 42 of that file
<gen0cide_> that I could set to not trust certs (not that I want to do that, but would be an interesting test)
<drbrain> but if RVM installs its own openssl and doesn't add any trusted certificates you may not have the necessary certificate
<drbrain> yeah, setting ssl_verify_mode to VERIFY_NONE would let this work
<gen0cide_> unfamiliar with .gemrc - needs to be in user home dir, and just ssl_verify_mode = VERIFY_NONE?
<evan> latest_specs is updated on every push
<drbrain> hrm
<evan> which, at our current rate, is around once every 2-3 mins.
<drbrain> gen0cide_: I'm unsure how to set it in ~/.gemrc hold on
<drbrain> gen0cide_: looks like :ssl_verify_mode: 0
<drbrain> (which is the value of VERIFY_NONE)
<gen0cide_> that worked
<gen0cide_> sec I'll give CLI output
<drbrain> so you are missing a cert
<gen0cide_> yea, this RVM deployment happened around four weeks ago
<gen0cide_> never had any issue until today
<gen0cide_> and other boxes that I did an RVM deployment to, both macs and also ubuntu boxes I'm not seeing the same issue
<drbrain> what does this show:
<drbrain> otool -L `ruby -ropenssl -e 'puts $".grep /openssl.bundle/'`
<gen0cide_> ruby -ropenssl -e 'puts $".grep /openssl.bundle/' yields no output
<drbrain> try removing ".bundle"
<evan> I have to think that amazon changed their SSL cert
<evan> and thats why people are suddenly having problems
<drbrain> evan: me too
<drbrain> evan: on the plus side, I think that most people have been installing a certs.pem with a cert rubygems is missing
<evan> nice
<gen0cide_> @drbrain: without the .bundle gives openssl.so and bin.rb cipher.rb, config.rb, digest,rb. x509.rb, buffering.rb, ssl.rb, openssl.rb all inside the rvm ruby 2.0.0 lib dir
<drbrain> gen0cide_: yeah, and otool -L with the .so path should show which openssl you've linked
<gen0cide_> there actually is no path to openssl.so
<drbrain> oh
<gen0cide_> gen0 @rubygems <2.0.0@hack> $ ruby -ropenssl -e 'puts $".grep /openssl/'
<gen0cide_> openssl.so
<drbrain> ruby 1.8?
<gen0cide_> nope 2x-p247
<drbrain> that's odd
<drbrain> I think it's better to wait for mpapis' help before I stumble around in the dark further
<gen0cide_> rgr
<drbrain> hrm
<drbrain> let me see if I can try one more thing
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
<drbrain> rather, have you try
<gen0cide_> is the gem signing implemention live btw?
<gen0cide_> trying to figure out if I can sincerely trust the pry I just installed :P
<drbrain> gen0cide_: try otool -L /Users/alex/.rvm/rubies/ruby-2.0.0-p247/lib/ruby/2.0.0/x<Tab>/openssl.so
<drbrain> "x<Tab>" should complete to something like "x86_64-darwin12.4.0"
<gen0cide_> yep
<gen0cide_> in that dir is ONLY rbconfig.rb
<drbrain> I'm unsure what magic this is, then
<mpapis> someone mentioned me?
codezomb has quit [Ping timeout: 240 seconds]
<mpapis> drbrain, ^
<drbrain> mpapis: RVM builds its own openssl, right?
<drbrain> mpapis: does it also install a certs.pem?
<mpapis> you might need to run: rvm osx-ssl-certs update
Sc0rp10n has quit [Ping timeout: 260 seconds]
<mpapis> the certs.pem is pointed at /etc/openssl .. I think so
<gen0cide_> that directory didn't exist
<gen0cide_> ok
<gen0cide_> that did it
<gen0cide_> removed gemrc
<mpapis> gen0cide_, open rvm bug to update certs after installing binary ruby on osx
<drbrain> so, definitely a missing cert built-in to rubygems
<gen0cide_> was able to communicate with rubygems as a source
<gen0cide_> mpapis: github.com/rvm/rvm ?
<mpapis> wayneeseguin/rvm
<gen0cide_> rgr
x1337807x has joined #rubygems
<mpapis> rvm/rvm was a first attempt at rvm2
<mpapis> might need to rename it to avoid confusion
<mpapis> drbrain, since I see you ;) can we talk a minute about --default gems?
<drbrain> mpapis: sure
<mpapis> so there is https://github.com/rubysl
<drbrain> yes
<mpapis> it's now the standard lib for rubinius
<mpapis> and it can not be installed with --default flag
<mpapis> at least from what I read in code
<drbrain> you mean `gem install --default`?
<gen0cide_> mpapis: issue filed, thanks for the help (Y)
<mpapis> yep
<drbrain> mpapis: `gem install --default` was added by headius for use at ruby installation time
<mpapis> most notable problem - it does not install files and build extensions
<mpapis> ah so we could extend it?
<drbrain> yes, using --default implies that you have mixed up the files in the gems into your default $LOAD_PATH (like CRuby)
<drbrain> and that you want future gems to be activated on top of the stdlib sources
<drbrain> so I think it is inappropriate to use rubysl gems with --default
<mpapis> ok what if you would like to ask RG to install everytig to LOAD_PATH?
<drbrain> a) those rubysl gems are not official
<drbrain> b) they don't seem to be designed to be installed all in one place
<drbrain> hrm
<mpapis> like having --default-spec-only and --default-everything
<drbrain> it feels like a regression
<drbrain> "default" gems are supposed to be a transition step towards not having everything in $LOAD_PATH
<mpapis> hmm, I thought that's great feature because they work without adding to Gemfile
<mpapis> and rubinius now requires adding rubysl to Gemfile
workmad3 has joined #rubygems
<mpapis> so rubygems is part of rubinus and depends on optparse which is a gem
<mpapis> this builds array of problems for loading rubygems if you uninstalled something
marpaia has left #rubygems ["WeeChat 0.4.1"]
<drbrain> yes
<mpapis> if this gems were installed in LOAD_PATH it would have worked just fine because you could only add newer version of the gem but not uninstall original one
<drbrain> since optparse is only needed by `gem` it should be OK, so long as you don't `gem uninstall optparse`
<drbrain> yes
<mpapis> it is like chicken and egg problem, using --default solves it
<drbrain> I think it is better to work with CRuby/JRuby/Rubinius to come to an agreement on how to divest the standard library instead of adding this feature to rubygems
<drbrain> AFAIK, only one ruby implementation could use it, but already has a separate plan?
<mpapis> jruby uses it already, and rubinius calls it a hack and does not want to use it
<mpapis> I would use --default myself for rubygems-bundler / executable-hooks
<drbrain> yes, but, I am already working to replace rubygems-bundler / executable-hooks for you :D
<mpapis> that would be great, but if it is not going to be merged in 2.2 I would like to merge #590
<mpapis> most important - as long developers will be using bundler it is important and eliminates hacks like executable-hooks gem is
<mpapis> so even you will be able to do all the things bundler does from rubygems it's still important as long users still use bundler ... which they tend to do for now
<drbrain> yeah
<mpapis> I think the biggest problem for users is still speed, bundler works faster
<mpapis> like the incremental index I heard about - that would be nice thing - should speed things?
<mpapis> so any chance to get #590 merged for 2.2?
<drbrain> yes, I think indirect will be presenting it at RubyConf
<drbrain> yes, there is a chance, but give me some time first :D
<mpapis> help me deprecate the executable-hooks gem ;)
<drbrain> of course!
<mpapis> sure, are there any deadlines for 2.2 release so I remember to remember you about it ;)
<drbrain> I think soon after feature freeze for Ruby 2.1
<drbrain> I can probably squeeze some things in after the feature freeze
<drbrain> … especially because I have it listed in the milestone :D
<mpapis> great
TheComrade has joined #rubygems
jstr has joined #rubygems
<mpapis> drbrain, so maybee last question, are you also attending #ruby-implementers meetings? is there any chance to discuss common plan for gem install --default and rubysl ?
<drbrain> I do attend
<drbrain> someone would need to nominate it for discussion
<drbrain> (I serve mostly as moderator)
<mpapis> can anybody do that? or do I need to find someone to do that?
closer has quit [Ping timeout: 256 seconds]
<mpapis> maybe headius as he added the --default option?
<drbrain> I think gemifying stdlib is too late for 2.1, but I think anyone can do that
Sc0rp10n has joined #rubygems
<drbrain> I would enlist the help of nahi
<mpapis> I think it should be started in discussions as some steps are taken already and leaving it for later might create bigger differences that will be harder to eliminate
closer has joined #rubygems
TheComrade has quit [Quit: TheComrade]
workmad3 has quit [Ping timeout: 264 seconds]
arthurnn has quit [Remote host closed the connection]
jstr has quit [Quit: Leaving.]
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
x1337807x has joined #rubygems
mando has quit [Remote host closed the connection]
ndrst has quit [Quit: WeeChat 0.4.0]
TheComrade has joined #rubygems
arthurnn has joined #rubygems
eighthbit has quit [Quit: Peace.]
arthurnn has quit [Read error: Connection reset by peer]
arthurnn has joined #rubygems
stevenharman has quit [Quit: Leaving...]
arthurnn has quit [Remote host closed the connection]
mando has joined #rubygems
mjc__ is now known as mjc_
mando has quit [Remote host closed the connection]
jonahR has joined #rubygems
jonahR has quit [Client Quit]
x1337807x has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
antichatter has joined #rubygems