Skip to content

Commit 9c33cbf

Browse files
voltechsvoltechs
authored
Merge pull request #14 from TwilightCoders/release/v0.4.0
🚀 Modern Security & Configuration Overhaul (v0.4.0) Complete modernization (2025) with security fixes, flexible configuration system, Ruby 3.2+ compatibility, and automated CI/CD publishing to both RubyGems.org and GitHub Packages. Key improvements: command injection prevention, global/per-wrapper configuration, graphical sudo prompts, comprehensive test coverage (78%), and GitHub Actions with branch-specific version publishing. Ready for production use with significant security and usability improvements while maintaining backward compatibility for core functionality.
2 parents 64396fe + dcf9c70 commit 9c33cbf

25 files changed

Lines changed: 933 additions & 137 deletions

‎.github/workflows/ci.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main, develop, 'release/**']
6+
pull_request:
7+
branches: [main, develop]
8+
9+
permissions:
10+
actions: write
11+
contents: read
12+
id-token: write
13+
packages: write
14+
15+
jobs:
16+
test:
17+
runs-on: ubuntu-latest
18+
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
ruby-version: ["2.7", "3.0", "3.1", "3.2", "3.3"]
23+
24+
steps:
25+
- uses: actions/checkout@v4
26+
27+
- name: Set up Ruby ${{ matrix.ruby-version }}
28+
uses: ruby/setup-ruby@v1
29+
with:
30+
ruby-version: ${{ matrix.ruby-version }}
31+
bundler-cache: true
32+
33+
- name: Run tests with coverage
34+
run: bundle exec rspec
35+
36+
- name: Upload coverage to Qlty
37+
if: matrix.ruby-version == '3.3'
38+
uses: qltysh/qlty-action/coverage@v1
39+
continue-on-error: true
40+
env:
41+
QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
42+
with:
43+
oidc: true
44+
files: coverage/coverage.json
45+
46+
- name: Run Qlty code quality checks
47+
if: matrix.ruby-version == '3.3'
48+
run: |
49+
curl -sSfL https://qlty.sh | sh
50+
echo "$HOME/.qlty/bin" >> $GITHUB_PATH
51+
~/.qlty/bin/qlty check || true
52+
continue-on-error: true
53+
54+
- name: Run RuboCop (Ruby 3.3 only)
55+
if: matrix.ruby-version == '3.3'
56+
run: bundle exec rubocop || true
57+
continue-on-error: true
58+
59+
security:
60+
runs-on: ubuntu-latest
61+
62+
steps:
63+
- uses: actions/checkout@v4
64+
65+
- name: Set up Ruby
66+
uses: ruby/setup-ruby@v1
67+
with:
68+
ruby-version: "3.3"
69+
bundler-cache: true
70+
71+
- name: Run bundle audit
72+
run: |
73+
gem install bundler-audit
74+
bundle audit --update || true
75+
continue-on-error: true
76+
77+
publish:
78+
runs-on: ubuntu-latest
79+
needs: [test, security]
80+
if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release/'))
81+
82+
steps:
83+
- uses: actions/checkout@v4
84+
85+
- name: Set up Ruby
86+
uses: ruby/setup-ruby@v1
87+
with:
88+
ruby-version: "3.3"
89+
bundler-cache: true
90+
91+
- name: Modify version for develop branch
92+
if: github.ref == 'refs/heads/develop'
93+
run: |
94+
sed -i "s/VERSION = '\([^']*\)'/VERSION = '\1.dev'/" lib/sudo/constants.rb
95+
96+
- name: Modify version for release branch
97+
if: startsWith(github.ref, 'refs/heads/release/')
98+
run: |
99+
sed -i "s/VERSION = '\([^']*\)'/VERSION = '\1.rc'/" lib/sudo/constants.rb
100+
101+
- name: Build gem
102+
run: gem build sudo.gemspec
103+
104+
- name: Publish to GitHub Packages
105+
run: |
106+
mkdir -p ~/.gem
107+
cat << EOF > ~/.gem/credentials
108+
---
109+
:github: Bearer ${{ secrets.GITHUB_TOKEN }}
110+
EOF
111+
chmod 600 ~/.gem/credentials
112+
# Temporarily remove allowed_push_host restriction for GitHub Packages
113+
sed -i "s/spec.metadata\['allowed_push_host'\].*$//" sudo.gemspec
114+
gem build sudo.gemspec
115+
gem push --key github --host https://rubygems.pkg.github.com/TwilightCoders *.gem

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
.rvmrc
3434
.env
3535
.ruby-version
36+
.claude
37+
spec/results.txt
3638

3739
# Compiled source #
3840
###################
@@ -56,6 +58,7 @@
5658
*.rar
5759
*.tar
5860
*.zip
61+
*.gem
5962

6063
# Logs and databases #
6164
######################

‎.qlty/.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
*
2+
!configs
3+
!configs/**
4+
!hooks
5+
!hooks/**
6+
!qlty.toml
7+
!.gitignore

‎.qlty/configs/.yamllint.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
rules:
2+
document-start: disable
3+
quoted-strings:
4+
required: only-when-needed
5+
extra-allowed: ["{|}"]
6+
key-duplicates: {}
7+
octal-values:
8+
forbid-implicit-octal: true

‎.qlty/qlty.toml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# This file was automatically generated by `qlty init`.
2+
# You can modify it to suit your needs.
3+
# We recommend you to commit this file to your repository.
4+
#
5+
# This configuration is used by both Qlty CLI and Qlty Cloud.
6+
#
7+
# Qlty CLI -- Code quality toolkit for developers
8+
# Qlty Cloud -- Fully automated Code Health Platform
9+
#
10+
# Try Qlty Cloud: https://qlty.sh
11+
#
12+
# For a guide to configuration, visit https://qlty.sh/d/config
13+
# Or for a full reference, visit https://qlty.sh/d/qlty-toml
14+
config_version = "0"
15+
16+
exclude_patterns = [
17+
"*_min.*",
18+
"*-min.*",
19+
"*.min.*",
20+
"**/.yarn/**",
21+
"**/*.d.ts",
22+
"**/assets/**",
23+
"**/bower_components/**",
24+
"**/build/**",
25+
"**/cache/**",
26+
"**/config/**",
27+
"**/db/**",
28+
"**/deps/**",
29+
"**/dist/**",
30+
"**/extern/**",
31+
"**/external/**",
32+
"**/generated/**",
33+
"**/Godeps/**",
34+
"**/gradlew/**",
35+
"**/mvnw/**",
36+
"**/node_modules/**",
37+
"**/protos/**",
38+
"**/seed/**",
39+
"**/target/**",
40+
"**/templates/**",
41+
"**/testdata/**",
42+
"**/vendor/**",
43+
]
44+
45+
test_patterns = [
46+
"**/test/**",
47+
"**/spec/**",
48+
"**/*.test.*",
49+
"**/*.spec.*",
50+
"**/*_test.*",
51+
"**/*_spec.*",
52+
"**/test_*.*",
53+
"**/spec_*.*",
54+
]
55+
56+
[smells]
57+
mode = "comment"
58+
59+
[[source]]
60+
name = "default"
61+
default = true
62+
63+
64+
[[plugin]]
65+
name = "actionlint"
66+
67+
[[plugin]]
68+
name = "checkov"
69+
70+
[[plugin]]
71+
name = "markdownlint"
72+
mode = "comment"
73+
74+
[[plugin]]
75+
name = "prettier"
76+
77+
[[plugin]]
78+
name = "ripgrep"
79+
mode = "comment"
80+
81+
[[plugin]]
82+
name = "rubocop"
83+
84+
[[plugin]]
85+
name = "trivy"
86+
drivers = [
87+
"config",
88+
]
89+
90+
[[plugin]]
91+
name = "trufflehog"
92+
93+
[[plugin]]
94+
name = "yamllint"

‎.travis.yml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎CHANGELOG.md‎

Lines changed: 58 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,64 @@
11
# Sudo
22

3-
## 0.3.0 _(July 04, 2023)_
4-
- Works on ruby 3.2
3+
<!--
4+
Emoji Legend:
5+
🎉 Initial Release ✨ Feature 🐛 Bug Fix 🔒 Security
6+
🚀 Compatibility 💥 Breaking 🔧 Internal ✅ Testing
7+
📚 Documentation 📄 License 🗑️ Removed
8+
-->
59

6-
## 0.2.0 _(November 05, 2018)_
7-
- Modernized
8-
- Tests
9-
- Works on ruby 2.3 - 2.5
10-
- More robust dependency loading
10+
## `v0.4.0` _(July 23, 2025)_
1111

12-
## 0.0.3 _(October 25, 2010)_
13-
-
12+
- 🔒 **Security**: Fix command injection vulnerabilities in system calls
13+
- 🔒 **Security**: Use SecureRandom for socket paths instead of predictable object_id
14+
- ✨ **Feature**: Add configuration system with global defaults
15+
- ✨ **Feature**: Implement sudo -A flag support for graphical password prompts
16+
- ✨ **Feature**: Add Sudo.as_root convenience method for better DSL
17+
- ✨ **Feature**: Add configurable timeouts
18+
- ✨ **Feature**: Add respond_to_missing? for proper method reflection
19+
- 💥 **Breaking**: Minimum Ruby version bumped to 2.7+ (EOL compliance)
20+
- 🔧 **Internal**: Modernize Ruby code with keyword arguments and array-form system calls
21+
- 🔧 **Internal**: Improve test coverage and add configuration tests
1422

15-
## 0.0.2 _(October 22, 2010)_
16-
-
23+
<details>
24+
<summary>📜 Historical Releases</summary>
1725

18-
## 0.0.1 _(October 22, 2010)_
19-
-
26+
## `v0.3.0` _(July 04, 2023)_
27+
28+
- 🚀 **Compatibility**: Add Ruby 3.2 support
29+
- 🐛 **Fix**: Resolve Bundler::StubSpecification marshaling issues
30+
31+
## `v0.2.0` _(November 05, 2018)_
32+
33+
- 🔧 **Internal**: Complete code modernization and cleanup
34+
- ✅ **Testing**: Add comprehensive RSpec test suite (98%+ coverage)
35+
- 🚀 **Compatibility**: Support Ruby 2.3, 2.4, and 2.5
36+
- 🐛 **Fix**: Improve gem and dependency loading robustness
37+
- 🐛 **Fix**: Ensure sudo process properly stops when run block ends
38+
- 🐛 **Fix**: Fix Wrapper.run to properly return values
39+
- 🐛 **Fix**: Resolve infinite recursion under Bundler
40+
- 🔒 **Security**: Restrict DRb access to localhost only
41+
- 📚 **Documentation**: Extensive README and code documentation improvements
42+
43+
## `v0.1.0` _(October 25, 2010)_
44+
45+
- 📄 **License**: Switch to MIT license
46+
- ✨ **Feature**: Add auto-require and autoload support
47+
- 🔧 **Internal**: Modularize codebase architecture
48+
- 📚 **Documentation**: Extensive documentation improvements
49+
- 🗑️ **Removed**: Remove confusing DSL features (temporarily)
50+
51+
## `v0.0.2` _(October 22, 2010)_
52+
53+
- 📚 **Documentation**: Correct RDoc options in gemspec
54+
- 🔧 **Internal**: Minor packaging improvements
55+
56+
## `v0.0.1` _(October 22, 2010)_
57+
58+
- 🎉 **Initial**: First public release
59+
- ✨ **Feature**: Core sudo wrapper functionality with DRb
60+
- ✨ **Feature**: Unix domain socket communication
61+
- ✨ **Feature**: Process spawning and management
62+
- ✨ **Feature**: Basic object proxying through sudo
63+
64+
</details>

‎Gemfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# frozen_string_literal: true
2+
13
source 'https://rubygems.org'
24

35
gemspec

‎LICENSE‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
(The MIT License)
22

3-
Copyright (c) 2010-2023 Guido De Rosa
3+
Copyright (c) 2010-2018 Guido De Rosa
4+
Copyright (c) 2018-2025 Twilight Coders
45

56
Permission is hereby granted, free of charge, to any person obtaining
67
a copy of this software and associated documentation files (the

0 commit comments

Comments
 (0)