Update for librnp 0.18.1: CI matrix v0.17.1/v0.18.1/main, Ruby 3.1-3.4, signature-error bindings#93
Merged
Merged
Conversation
Allow bundler >= 2, drop the sunset codecov gem (coverage upload is now handled by codecov-action with simplecov-json output), and relax the remaining version pins so current toolchains can bundle.
- Test against rnp v0.17.1, v0.18.1 (CVE-2025-13470 fix) and the default branch instead of v0.15.2/v0.16.2. - Test on Ruby 3.1-3.4 and head; 2.7 and 3.0 are EOL. - Use actions/checkout@v4 and codecov/codecov-action@v5 for the coverage leg (the codecov gem uploader is sunset). - Pass -DCRYPTO_BACKEND=botan3 on macOS, where Homebrew now ships Botan 3. - Fix the release job, which still checked out rnp's old master branch.
rnp renamed its default branch (master -> main) and moved its shell CI scripts from ci/ to ci-legacy/ without updating their internal references. Invoke the scripts from ci-legacy/ and recreate the expected ci/... layout with symlinks inside the rnp clone. The rnpgp/rnp#1654 workaround is dropped: rnp's main.sh has shipped with the fix for years. The unused DOWNLOAD_RUBYRNP environment variable is dropped as well.
State the real minimum librnp version per the FFI feature gates and recommend 0.18.1 or newer because 0.18.0 is affected by CVE-2025-13470. Also fix the stale tests.yml CI badge path and the master-branch codecov/rubydoc references.
Expose the signature verification error API added in librnp 0.18.0 as Rnp::Signature#errors, following the existing optional-symbol HAVE_* pattern. Add Rnp::Verify::Signature#handle so the full signature handle of a verified signature can be reached.
ubuntu-latest (24.04) no longer ships bzip2/zlib development files, which made the rnp cmake configure step fail (Could NOT find BZip2).
librnp installs to /usr/local/lib, which dlopen only finds via the linker cache or LD_LIBRARY_PATH; macOS legs were unaffected thanks to dyld's fallback paths. Mirrors py-rnp's workflow.
No CODECOV_TOKEN secret exists for this repo, and the protected main
branch makes Codecov require one ('Token required because branch is
protected'). Upload best-effort until a token is configured.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings ruby-rnp current with the latest librnp release 0.18.1 (security release fixing CVE-2025-13470) and with rnp's
mainbranch, and modernizes CI/dependencies. No 0.18.x behavior adaptations were needed in the test suite — explicitly-requested small RSA keys, CAST5 preferences and OCB AEAD all still behave as before.Changes
test-and-release.yml): librnp test matrixv0.15.2/v0.16.2/main→v0.17.1/v0.18.1/main; Ruby matrix → 3.1/3.2/3.3/3.4/head;actions/checkout@v3→@v4; fixed brokenref: masterin the release job; macOS legs configure rnp with-DCRYPTO_BACKEND=botan3(Homebrew botan is Botan 3 now); coverage upload migrated from the sunset codecov gem tocodecov/codecov-action@v5.< 3, broken with current bundler), drop the deadcodecovgem (simplecov +simplecov-jsoninstead), relax rake/rspec/simplecov/redcarpet pins.rakelib/platform.rake: default rnp refmaster→main; updated for rnp'sci/→ci-legacy/script move (with fallback for old clones); removed the obsolete DOWNLOAD_RUBYRNP [: -v: unary operator expected rnp#1654 workaround.master→main).rnp_signature_error_count()/rnp_signature_error_at()(new in librnp 0.18.0) exposed via the existing optional-symbol pattern asRnp::Signature#errors, plusVerify::Signature#handle— with specs.Verification (local, macOS arm64)
Notes for maintainers
fail_ci_if_error: falsebecause noCODECOV_TOKENsecret exists for this repo (the protectedmainbranch makes Codecov require a token). Add the secret and flip it totrueto enforce uploads.CHANGELOG.adocuntouched — release-time concerns.