
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
Thermite is a Rake-based helper for building and distributing Rust-based Ruby extensions.
cargo
commands.cargo
installations via the CARGO
environment variable.spec.extensions << 'ext/Rakefile'
spec.add_runtime_dependency 'thermite', '~> 0'
ext/Rakefile
with the following code, assuming that the Cargo project root is the same
as the Ruby project root:require 'thermite/tasks'
project_dir = File.dirname(File.dirname(__FILE__))
Thermite::Tasks.new(cargo_project_path: project_dir, ruby_project_path: project_dir)
task default: %w(thermite:build)
Rakefile
, integrate Thermite into your build-test workflow:require 'thermite/tasks'
Thermite::Tasks.new
desc 'Run Rust & Ruby testsuites'
task test: ['thermite:build', 'thermite:test'] do
# …
end
Run rake -T thermite
to view all of the available tasks in the thermite
namespace.
Task configuration for your project can be set in two ways:
Thermite::Tasks.new
package.metadata.thermite
section to Cargo.toml
. These settings override the
arguments passed to the Tasks
class. Due to the conflict, it is infeasible for
cargo_project_path
or cargo_workspace_member
to be set in this way. Example section:[package.metadata.thermite]
github_releases = true
Possible options:
binary_uri_format
- if set, the interpolation-formatted string used to construct the download
URI for the pre-built native extension. If the environment variable THERMITE_BINARY_URI_FORMAT
is set, it takes precedence over this option. Either method of setting this option overrides the
github_releases
option.
Example: https://example.com/download/%{version}/%{filename}
. Replacement variables:
filename
- The value of Config.tarball_filename
version
- the crate version from Cargo.toml
cargo_project_path
- the path to the top-level Cargo project. Defaults to the current working
directory.cargo_workspace_member
- if set, the relative path to the Cargo workspace member. Usually used
when it is part of a repository containing multiple crates.github_releases
- whether to look for Rust binaries via GitHub releases when installing
the gem, and cargo
is not found. Defaults to false
.github_release_type
- when github_releases
is true
, the mode to use to download the Rust
binary from GitHub releases. 'cargo'
(the default) uses the version in Cargo.toml
, along with
the git_tag_format
option (described below) to determine the download URI. 'latest'
takes the
latest release matching the git_tag_regex
option (described below) to determine the download
URI.git_tag_format
- when github_release_type
is 'cargo'
(the default), the
format string used to determine the tag used
in the GitHub download URI. Defaults to v%s
, where %s
is the version in Cargo.toml
.git_tag_regex
- when github_releases
is enabled and github_release_type
is 'latest'
, a
regular expression (expressed as a String
) that determines which tagged releases to look for
precompiled Rust tarballs. One group must be specified that indicates the version number to be
used in the tarball filename. Defaults to vN.N.N
, where N
is any n-digit number. In this case,
the group is around the entire expression.optional_rust_extension
- prints a warning to STDERR instead of raising an exception, if Cargo
is unavailable and github_releases
is either disabled or unavailable. Useful for projects where
either fallback code exists, or a native extension is desirable but not required. Defaults
to false
.ruby_project_path
- the top-level directory of the Ruby gem's project. Defaults to the
current working directory.Using the cliché Rust+Ruby example, the rusty_blank
repository contains an example of using Thermite with ruru
to provide a String.blank?
speedup extension. While the example uses ruru, this gem should be
usable with any method of integrating Rust and Ruby that you choose.
Debug statements can be written to a file specified by the THERMITE_DEBUG_FILENAME
environment
variable.
According to Wikipedia:
This gem is licensed under the MIT license.
FAQs
Unknown package
We found that thermite demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.