Interest in potentially reading ruby version from Gemfile.lock? about ruby_audit HOT 4 CLOSED

Hey @colinxfleming, sorry for the long wait. Can you elaborate on the use case for scanning ruby and rubygems versions that aren't in the current environment?

from ruby_audit.

I found an explanation of the issue here: coinbase/salus#56 (comment)

Since this runs within the context of a docker container, I think that means it'll really be scanning the docker container for ruby and rubygems vulns rather than the lockfile, making it sorta useless.

In a docker container, we don't have access to anything but the filesystem.
https://github.com/coinbase/salus seems to be built with this assumption.

Unfortunately, Gemfile.lock doesn't store the Rubygems version, and only stores the Ruby version if it is specified in Gemfile. I'm not sure how to get this information reliably from within a container.

from ruby_audit.

hi, sorry for taking so long to come back to this. thanks @skomanduri for topping it - that's pretty much the use case.

I did some experimentation and found that doing this reliably would probably require a bundler change. I doubt this issue will get a lot of traction bundler-side, so we can close this down if you'd like to keep the issues list clean.

from ruby_audit.

It's no problem. I'll close the issue, but if a reliable way to do this appears, feel free to reopen this or open another issue!

from ruby_audit.