Dmytro Shteflyuk created THRIFT-6128:
----------------------------------------
Summary: Ruby: exclude development files from the thrift gem
Key: THRIFT-6128
URL: https://issues.apache.org/jira/browse/THRIFT-6128
Project: Thrift
Issue Type: Bug
Components: Ruby - Library
Reporter: Dmytro Shteflyuk
Assignee: Dmytro Shteflyuk
h3. Problem
The Ruby gemspec includes development-only material in the released gem. It
explicitly adds {{spec/}} through {{s.files}} and adds {{test/}}, {{spec/}},
and {{benchmark/}} through the obsolete {{s.test_files}} attribute.
RubyGems builds the payload from the union of {{files}}, {{test_files}},
executables, extra RDoc files, and extensions. Therefore {{s.test_files}} still
increases the released archive even though RubyGems no longer uses it to run a
gem's tests.
h3. Client impact
Installing the thrift gem downloads Ruby specs, fuzz-test sources, benchmarks,
and their fixtures although none are needed at runtime. This increases the
package size and exposes development-only files to downstream package scanners.
h3. Reproduction
>From {{lib/rb}}, build and list the package:
{code}
gem build thrift.gemspec
tar -xOf thrift-0.25.0.gem data.tar.gz | tar -tzf -
{code}
The current listing contains {{spec/}}, {{test/fuzz/}}, and {{benchmark/}}.
The native extension remains packageable without adding {{ext/}} to
{{s.files}}: {{s.extensions}} includes {{ext/extconf.rb}}, while
{{s.extra_rdoc_files}} explicitly includes the C and header files under
{{ext/}}.
h3. Expected behavior
The released gem contains the Ruby runtime and the native-extension sources
required to build it, but excludes {{spec/}}, {{test/}}, and {{benchmark/}}. A
packaging regression check should compare the built archive's file list and
enforce those boundaries.
Reference: https://github.com/rubygems/guides/issues/90
Prior art: https://github.com/rubysec/bundler-audit/pull/395
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
