[
https://issues.apache.org/jira/browse/THRIFT-6128?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dmytro Shteflyuk resolved THRIFT-6128.
--------------------------------------
Fix Version/s: 0.25.0
Resolution: Fixed
> Ruby: exclude development files from the thrift gem
> ---------------------------------------------------
>
> Key: THRIFT-6128
> URL: https://issues.apache.org/jira/browse/THRIFT-6128
> Project: Thrift
> Issue Type: Bug
> Components: Ruby - Library
> Reporter: Dmytro Shteflyuk
> Assignee: Dmytro Shteflyuk
> Priority: Major
> Fix For: 0.25.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h3. Problem
> The Ruby gemspec includes development-only material in the released gem. It
> explicitly adds {{spec/}} through {{s.files}} and adds {{test/}}, {{spec/}},
> and {{benchmark/}} through the obsolete {{s.test_files}} attribute.
> RubyGems builds the payload from the union of {{files}}, {{test_files}},
> executables, extra RDoc files, and extensions. Therefore {{s.test_files}}
> still increases the released archive even though RubyGems no longer uses it
> to run a gem's tests.
> h3. Client impact
> Installing the thrift gem downloads Ruby specs, fuzz-test sources,
> benchmarks, and their fixtures although none are needed at runtime. This
> increases the package size and exposes development-only files to downstream
> package scanners.
> h3. Reproduction
> From {{lib/rb}}, build and list the package:
> {code}
> gem build thrift.gemspec
> tar -xOf thrift-0.25.0.gem data.tar.gz | tar -tzf -
> {code}
> The current listing contains {{spec/}}, {{test/fuzz/}}, and {{benchmark/}}.
> The native extension remains packageable without adding {{ext/}} to
> {{s.files}}: {{s.extensions}} includes {{ext/extconf.rb}}, while
> {{s.extra_rdoc_files}} explicitly includes the C and header files under
> {{ext/}}.
> h3. Expected behavior
> The released gem contains the Ruby runtime and the native-extension sources
> required to build it, but excludes {{spec/}}, {{test/}}, and {{benchmark/}}.
> A packaging regression check should compare the built archive's file list and
> enforce those boundaries.
> Reference: https://github.com/rubygems/guides/issues/90
> Prior art: https://github.com/rubysec/bundler-audit/pull/395
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
