gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rubyPackages: Add command to audit packages

Browse Source 
For known security vulnerabilities.

Converts `pkgs/top-level/ruby-packages.nix` to a minimal `Gemfile.lock`
for `bundler-audit`.
This commit is contained in:
Victor Engmark
2025-09-17 15:11:01 +02:00
parent 51c9362eea
commit 82c23622c7
3 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/languages-frameworks/ruby.section.md
View File

@@ -273,6 +273,8 @@ To test that it works, you can then try using the gem with:
NIX_PATH=nixpkgs=$PWD nix-shell -p "ruby.withPackages (ps: with ps; [ name-of-your-gem ])" NIX_PATH=nixpkgs=$PWD nix-shell -p "ruby.withPackages (ps: with ps; [ name-of-your-gem ])"
``` ```
To check the gems for any security vulnerabilities, run `./maintainers/scripts/audit-ruby-packages/audit-ruby-packages.bash`.
### Packaging applications {#packaging-applications} ### Packaging applications {#packaging-applications}
A common task is to add a Ruby executable to Nixpkgs; popular examples would be `chef`, `jekyll`, or `sass`. A good way to do that is to use the `bundlerApp` function, that allows you to make a package that only exposes the listed executables. Otherwise, the package may cause conflicts through common paths like `bin/rake` or `bin/bundler` that aren't meant to be used. A common task is to add a Ruby executable to Nixpkgs; popular examples would be `chef`, `jekyll`, or `sass`. A good way to do that is to use the `bundlerApp` function, that allows you to make a package that only exposes the listed executables. Otherwise, the package may cause conflicts through common paths like `bin/rake` or `bin/bundler` that aren't meant to be used.

6
maintainers/scripts/audit-ruby-packages/audit-ruby-packages.bash Executable file
View File

@@ -0,0 +1,6 @@
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p bundler-audit
set -o errexit -o nounset -o pipefail
bundle-audit check "$(nix-build --no-out-link maintainers/scripts/audit-ruby-packages/default.nix)"

15
maintainers/scripts/audit-ruby-packages/default.nix Normal file
View File

@@ -0,0 +1,15 @@
let
pkgs = import ../../.. { };
lockFileBody = pkgs.lib.concatStringsSep "\n" (
pkgs.lib.mapAttrsToList (name: props: " ${name} (${props.version})") (
pkgs.lib.filterAttrs (name: _props: name != "recurseForDerivations") pkgs.rubyPackages
)
);
in
pkgs.runCommand "bundle-audit" { } ''
mkdir "$out"
echo 'GEM' > "$out/Gemfile.lock"
echo ' remote: https://rubygems.org/' >> "$out/Gemfile.lock"
echo ' specs:' >> "$out/Gemfile.lock"
echo '${lockFileBody}' >> "$out/Gemfile.lock"
''