Precompiled ruby 2.7.8 / 3.1.7 / 3.2.11 releases; fix Release workflow for Homebrew 6#1
Merged
Conversation
Abstract/jdx-ruby-31.rb is Abstract/jdx-ruby-32.rb with the five changes required because ruby 3.1's YJIT is the C implementation (no Rust): class name, livecheck regex, rustup build dep removed, --enable-yjit configure arg removed (flag does not exist in 3.1.7's configure), and `make ruby.pc` -> `make pkgconfig-data` (3.1's Makefile has no ruby.pc alias target). The inert --without-yjit option is kept so the release workflow's build matrix works unchanged. sha256 verified against a fresh download of https://cache.ruby-lang.org/pub/ruby/3.1/ruby-3.1.7.tar.xz https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
- Drop the notify job: it requires a RESEND_API_KEY secret this fork does not have, so it always failed. - Drop the SLSA provenance job (and the combine-hashes job that only feeds it): it uses a third-party reusable workflow that org policy can block, which would prevent upload-assets from ever running. - Make the GitHub attest-build-provenance step continue-on-error so the release cannot be blocked by attestation infrastructure. mise skips attestation verification for custom precompiled_url templates anyway. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Homebrew now refuses to load external tap commands (brew jdx-package) from untrusted taps when HOMEBREW_REQUIRE_TAP_TRUST is in effect, which broke every Release build leg. brew trust is non-interactive; the || true keeps bin/setup working on older brews without the command. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Ruby 2.7's bundled openssl extension cannot build against OpenSSL 3.x,
so this adds a portable-openssl@1.1.1w formula (same runtime cert
auto-detection patch as portable-openssl@3.5.5, adapted to 1.1.1's
simpler x509_def.c; patch targets verified byte-for-byte against the
1.1.1w tarball).
Abstract/jdx-ruby-31.rb differences, each verified against the real
2.7.8 tarball:
- portable-openssl@1.1.1w build dep instead of @3.5.5
- no msgpack/bootsnap bundled-gem injection: 2.7's bundled-gems
machinery predates the 3.x behavior the injection relies on
- --enable-libedit (boolean) + --with-libedit-dir=PREFIX: 2.7's
configure has no --enable-libedit=DIR form; ext/readline/extconf.rb
uses enable_config("libedit") + dir_config("libedit")
- test block: no debug/bootsnap requires (2.7's lib/debug.rb is the
old interactive debugger), no ruby-lsp (needs ruby >= 3.0), openssl
gem pinned to ~> 3.1.0 (newest line supporting 2.7 + OpenSSL 1.1.1)
- --with-rdoc=ri, make pkgconfig-data, make extract-gems all confirmed
present in 2.7.8's configure/common.mk
sha256s computed from fresh downloads of the canonical tarballs.
https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Newer Homebrew requires a rootless bwrap (Bubblewrap) for its Linux build sandbox and aborts source builds without it; the runner images do not ship one, and bubblewrap was itself in the dependency list being installed. HOMEBREW_NO_SANDBOX_LINUX=1 is the workaround Homebrew's own error message suggests; CI runners are throwaway so the sandbox adds nothing here. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
The cert auto-detection patch wrote the C character literal for NUL via a heredoc; inreplace replacement strings go through gsub, where backslash-zero is a backreference to the entire match, so the matched function body got spliced into the character literal and the build failed on every platform. Compare against plain 0 instead and keep the replacement text free of backslashes entirely. Verified by simulating the gsub against the pristine 1.1.1w source and compiling the patched file with -Wall -Werror. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Source-building the helper toolchain (glibc, gmp, gcc, ...) with --build-bottle fails under Homebrew 6 on both Linux architectures: once the glibc bottle is poured, gmp's configure cannot run its compiled test programs. Only this tap's portable-* formulae need source builds - their outputs are what get statically linked into Ruby, and the brew linkage check verifies nothing else leaks in - so partition on that instead of an ever-growing allowlist, finishing what "ci: install Linux helper deps from bottles" (jdx#43) started. Also cuts Linux build times. Drop `make extract-gems` for ruby 2.7: its target runs via RUNRUBY (./miniruby, which does not exist before `make`; 3.x uses BASERUBY), and 2.7's rbinstall installs bundled gems from gems/*.gem directly (tool/rbinstall.rb:902), so extraction is unnecessary. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds portable Ruby 2.7 and 3.1 Homebrew formulas, a portable OpenSSL 1.1.1w formula, simplifies the release workflow by removing provenance jobs and adding a non-blocking attestation step, and updates setup/package tooling to handle portable dependencies. ChangesRelease Workflow Simplification
Portable Ruby Formulas and Infrastructure
Sequence Diagram(s): sequenceDiagram
participant PatchX509 as Patch x509_def.c
participant Configure as Configure/Build
participant Make as make
participant InstallDev as make install_dev
participant EditPc as Edit libcrypto.pc
participant InstallCACert as Install cert.pem
participant TestProg as C test program
PatchX509->>Configure: apply JDX_RUBY_SSL_CERT_FILE/DIR patch
Configure->>Make: run Configure and make
Make->>InstallDev: run make install_dev
InstallDev->>EditPc: remove Libs.private from libcrypto.pc
InstallDev->>InstallCACert: write cert.pem into openssldir
TestProg->>InstallDev: link against built libcrypto and run EVP_sha256
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
291-297: 💤 Low valueConsider adding visibility for attestation failures.
With
continue-on-error: true, attestation failures will be silent and may go unnoticed. While the comment correctly explains the rationale (advisory-only, mise skips verification), consider adding a summary annotation so failures are at least visible in the workflow run.📝 Optional: Add failure visibility
- name: Attest build provenance + id: attest # Attestation is advisory (mise skips verification for custom # precompiled_url templates); never block the release on it. continue-on-error: true uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 with: subject-path: 'rubies/*.tar.gz' + + - name: Report attestation status + if: steps.attest.outcome == 'failure' + run: echo "::warning::Build provenance attestation failed (non-blocking)"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 291 - 297, The "Attest build provenance" step uses continue-on-error: true which hides failures; add a follow-up step (e.g., "Report attestation failure" or "Annotate attestation failure") that only runs when the attestation step fails and emits a visible workflow annotation or summary so failures are surfaced. Target the existing step name "Attest build provenance" and implement the follow-up with an if-condition that checks the attestation step outcome (or uses failure() / steps.<attest-step>.outcome) and then calls a summary/annotation action or prints a ::error/::warning log to make the failure visible in the run UI. Ensure the follow-up step does not block the job (keeps advisory behavior) but makes failures easy to spot.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Abstract/jdx-ruby-27.rb`:
- Around line 78-91: The code calls an external program using shell
interpolation (%x[#{baseruby} -v]) on ENV["HOMEBREW_BASERUBY"], which risks
command injection; replace those uses (e.g., the baseruby_version assignment and
any other %x[#{baseruby} ...] occurrences in Abstract/jdx-ruby-27.rb and
jdx-ruby-31.rb) with a safe, non-shell invocation such as Open3.capture2e or
IO.popen / Process.spawn using the argument-array form (pass baseruby and "-v"
as separate args) to avoid the shell and read the output into baseruby_version,
keeping the existing odie checks and args handling intact.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 291-297: The "Attest build provenance" step uses
continue-on-error: true which hides failures; add a follow-up step (e.g.,
"Report attestation failure" or "Annotate attestation failure") that only runs
when the attestation step fails and emits a visible workflow annotation or
summary so failures are surfaced. Target the existing step name "Attest build
provenance" and implement the follow-up with an if-condition that checks the
attestation step outcome (or uses failure() / steps.<attest-step>.outcome) and
then calls a summary/annotation action or prints a ::error/::warning log to make
the failure visible in the run UI. Ensure the follow-up step does not block the
job (keeps advisory behavior) but makes failures easy to spot.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9db1b691-7fba-4c25-8a9d-ec5c5f3122ef
📒 Files selected for processing (8)
.github/workflows/release.ymlAbstract/jdx-ruby-27.rbAbstract/jdx-ruby-31.rbFormula/jdx-ruby@2.7.8.rbFormula/jdx-ruby@3.1.7.rbFormula/portable-openssl@1.1.1w.rbbin/setupcmd/jdx-package.rb
Two failures from the first full 2.7.8 build attempt: - macOS built fine but failed the portable linkage check: ext/gdbm linked the Homebrew gdbm bottle that is now installed as a helper dep (gdbm/dbm were stdlib until ruby 3.0, which is why 3.x never hit this). Exclude both via --with-out-ext. - Linux failed compiling enc/euc_jp.c: make regenerated enc/jis/props.h with the runner's gperf >= 3.1, whose size_t prototypes conflict with 2.7's unsigned int declaration (props.kwd:40). The tarball ships props.h and props.kwd with equal mtimes, so the regeneration rule fires or not depending on extraction details - macOS skipped it, Linux did not. Touch the shipped header so the rule never fires. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Same failure as 2.7 on all four Linux legs: make regenerated enc/jis/props.h with the runner's gperf >= 3.1, whose size_t prototypes conflict with 3.1's unsigned int declaration at props.kwd:40 (only fixed upstream in ruby 3.2, whose declaration already uses size_t and is therefore immune). Touch the shipped header so the regeneration rule never fires. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Abstract/jdx-ruby-27.rb (1)
217-242:⚠️ Potential issue | 🟠 Major | ⚡ Quick winMirror the portable OpenSSL cert checks here.
This
openssl.rbpatch no longer matches theportable-openssl@1.1.1wcontract: it accepts any existingJDX_RUBY_SSL_CERT_FILE/JDX_RUBY_SSL_CERT_DIRpath, and it only treats system cert files as evidence that a system trust store exists. On a host with only a readable cert directory, or with an unreadable env override, this can forceSSL_CERT_FILEto the bundled PEM and change the trust-store selection you just moved into the C layer.🩹 Suggested fix
if ENV["SSL_CERT_FILE"].to_s.empty? && ENV["SSL_CERT_DIR"].to_s.empty? jdx_cert_file = ENV["JDX_RUBY_SSL_CERT_FILE"].to_s - if !jdx_cert_file.empty? && File.exist?(jdx_cert_file) + if !jdx_cert_file.empty? && File.file?(jdx_cert_file) && File.readable?(jdx_cert_file) ENV["SSL_CERT_FILE"] = jdx_cert_file else jdx_cert_dir = ENV["JDX_RUBY_SSL_CERT_DIR"].to_s - ENV["SSL_CERT_DIR"] = jdx_cert_dir if !jdx_cert_dir.empty? && Dir.exist?(jdx_cert_dir) + if !jdx_cert_dir.empty? && Dir.exist?(jdx_cert_dir) && File.readable?(jdx_cert_dir) + ENV["SSL_CERT_DIR"] = jdx_cert_dir + end end end if ENV["SSL_CERT_FILE"].to_s.empty? && ENV["SSL_CERT_DIR"].to_s.empty? - system_certs = %w[ + system_cert_files = %w[ /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/ca-bundle.pem /opt/homebrew/etc/openssl@3/cert.pem /usr/local/etc/openssl@3/cert.pem /opt/homebrew/etc/ca-certificates/cert.pem /usr/local/etc/ca-certificates/cert.pem /home/linuxbrew/.linuxbrew/etc/openssl@3/cert.pem /home/linuxbrew/.linuxbrew/etc/ca-certificates/cert.pem /etc/ssl/cert.pem ] - unless system_certs.any? { |f| File.exist?(f) } + system_cert_dirs = %w[ + /etc/ssl/certs + /etc/pki/tls/certs + /opt/homebrew/etc/openssl@3/certs + /usr/local/etc/openssl@3/certs + /home/linuxbrew/.linuxbrew/etc/openssl@3/certs + ] + has_system_certs = + system_cert_files.any? { |f| File.file?(f) && File.readable?(f) } || + system_cert_dirs.any? { |d| Dir.exist?(d) && File.readable?(d) } + unless has_system_certs bundled = File.expand_path("../../libexec/cert.pem", RbConfig.ruby) - ENV["SSL_CERT_FILE"] = bundled if File.exist?(bundled) + ENV["SSL_CERT_FILE"] = bundled if File.file?(bundled) && File.readable?(bundled) end end🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Abstract/jdx-ruby-27.rb` around lines 217 - 242, The code currently accepts any JDX_RUBY_SSL_CERT_FILE/JDX_RUBY_SSL_CERT_DIR values and only treats system cert FILES as evidence of a system trust store; update the checks to mirror the portable OpenSSL behavior by requiring a readable cert file for JDX_RUBY_SSL_CERT_FILE (use File.file? && File.readable?) and requiring a readable cert directory for JDX_RUBY_SSL_CERT_DIR (Dir.exist? && readable by listing or File.readable? on a known file), and when detecting system trust use both common cert files and common cert directories (check for either an existing readable file in system_certs or existing cert directories) before falling back to the bundled variable (bundled); update the branches around jdx_cert_file/jdx_cert_dir, the system_certs any? check, and the bundled assignment accordingly so only truly usable system stores prevent using the bundled cert.pem.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@Abstract/jdx-ruby-27.rb`:
- Around line 217-242: The code currently accepts any
JDX_RUBY_SSL_CERT_FILE/JDX_RUBY_SSL_CERT_DIR values and only treats system cert
FILES as evidence of a system trust store; update the checks to mirror the
portable OpenSSL behavior by requiring a readable cert file for
JDX_RUBY_SSL_CERT_FILE (use File.file? && File.readable?) and requiring a
readable cert directory for JDX_RUBY_SSL_CERT_DIR (Dir.exist? && readable by
listing or File.readable? on a known file), and when detecting system trust use
both common cert files and common cert directories (check for either an existing
readable file in system_certs or existing cert directories) before falling back
to the bundled variable (bundled); update the branches around
jdx_cert_file/jdx_cert_dir, the system_certs any? check, and the bundled
assignment accordingly so only truly usable system stores prevent using the
bundled cert.pem.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0db5059e-19b8-41a3-a3f4-b7a6ce242aac
📒 Files selected for processing (1)
Abstract/jdx-ruby-27.rb
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Abstract/jdx-ruby-31.rb (1)
282-309:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftRemove live network from the formula test.
Lines 282-309 make
testdepend on outbound access togoogle.comand RubyGems. That turns relocatability/native-extension verification into a flaky integration test: DNS/egress restrictions, transient RubyGems outages, or rate limiting will fail the formula even when the package itself is fine. Please switch these checks to staged local fixtures/resources, or move the networked coverage to a separate CI job.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Abstract/jdx-ruby-31.rb` around lines 282 - 309, The test is performing live network calls (e.g. shell_output("#{ruby} -ropen-uri -e 'URI.open(\"https://google.com\")...') and multiple system calls to testpath/"bin/gem" install which relies on RubyGems network access); replace these with local staged fixtures and offline gem files: remove the URI.open/http check and instead assert against a local fixture file accessed via ruby; replace all system testpath/"bin/gem" "install" invocations (openssl, psych, byebug, ruby-lsp) with installs from pre-staged .gem files added as test resources and invoke gem install --local or point GEM_HOME/GEM_PATH to the staged vendor cache so no network is used; keep the ri/bundle/gem environment checks but use the local fixtures for ri data and bundle init, or alternatively move any remaining external-network assertions into a separate CI job and ensure the test only exercises offline verification (use the symbols shell_output(...), system ruby ..., system testpath/"bin/gem" "install", system testpath/"bin/byebug --version", and shell_output("#{ruby} #{testpath}/bin/ri ...") to locate the spots to change).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@Abstract/jdx-ruby-31.rb`:
- Around line 282-309: The test is performing live network calls (e.g.
shell_output("#{ruby} -ropen-uri -e 'URI.open(\"https://google.com\")...') and
multiple system calls to testpath/"bin/gem" install which relies on RubyGems
network access); replace these with local staged fixtures and offline gem files:
remove the URI.open/http check and instead assert against a local fixture file
accessed via ruby; replace all system testpath/"bin/gem" "install" invocations
(openssl, psych, byebug, ruby-lsp) with installs from pre-staged .gem files
added as test resources and invoke gem install --local or point
GEM_HOME/GEM_PATH to the staged vendor cache so no network is used; keep the
ri/bundle/gem environment checks but use the local fixtures for ri data and
bundle init, or alternatively move any remaining external-network assertions
into a separate CI job and ensure the test only exercises offline verification
(use the symbols shell_output(...), system ruby ..., system testpath/"bin/gem"
"install", system testpath/"bin/byebug --version", and shell_output("#{ruby}
#{testpath}/bin/ri ...") to locate the spots to change).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d0f7fb93-9510-47ed-b4d5-cdc5c8f0c98c
📒 Files selected for processing (1)
Abstract/jdx-ruby-31.rb
Homebrew 6 raised its Linux glibc baseline to 2.39, above ubuntu-22.04's host glibc 2.35. On 22.04 every bottle pour therefore drags in Homebrew's own glibc and gcc, which (a) breaks glibc@2.17's localedef post-install (silent exit 1 after otherwise successful installs) and (b) links the built ruby against .linuxbrew/glibc, failing the portable linkage check. ubuntu-24.04 hosts satisfy the baseline, so no brew glibc/gcc are installed and the host toolchain builds portable binaries as before. Plain assets now have a glibc 2.39 runtime floor (matching e.g. Ubuntu 24.04 sandboxes); the no_yjit variants keep the glibc 2.17 toolchain for older hosts. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
With the ubuntu-24.04 matrix, ruby 2.7.8 now builds and passes the portable linkage check on all five platforms; the only remaining test failure was `bundle init`: Homebrew's vendored bundler leaks BUNDLER_VERSION=4.x into the test environment, 2.7's RubyGems honors it in find_spec_for_exe, and bundler 4 does not support ruby 2.7. Newer RubyGems in 3.x doesn't consult the variable, which is why the 3.x tests pass unchanged. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Reproduced the failing test sequence locally on an ubuntu-24.04 host with a from-scratch ruby 2.7.8 + openssl 1.1.1w build matching the CI leg: 2.7's RubyGems errors on `gem install byebug` (latest requires ruby >= 3.2) instead of resolving to an older compatible version the way newer RubyGems does. byebug 11.1.3 installs and runs fine. The other test steps all pass locally: bundle init (with BUNDLER_VERSION unset), ri -f markdown, gem install openssl ~> 3.1.0 (compiles against OpenSSL 1.1.1w), and gem install psych 5.4.0. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
Both Linux yjit:true legs now pass the full build and test. Remaining: - yjit:false legs: the rbconfig CXX="false" fix-up is a no-op on 2.7 (its configure keeps a working C++ where 3.x's gets disabled under the glibc@2.17 toolchain), and inreplace treats no-op substitutions as errors. Pass audit_result: false for 2.7 only. - macOS: `gem install openssl -v "~> 3.1.0"` fails compiling ossl_hmac.c (incomplete evp_md_ctx_st): the gem's legacy OpenSSL 1.1 paths misdetect against the runner's preinstalled openssl@3 headers. Drop that test step for 2.7; the stdlib openssl extension is already exercised, and the copied-headers machinery is covered by psych and byebug. https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
narze
changed the title
build.yml (used by PR CI via tests.yml) needed the same two fixes
already applied to release.yml: the ubuntu-24.04 matrix (Homebrew 6
glibc baseline) and HOMEBREW_NO_SANDBOX_LINUX.
Also replace the shell-interpolated %x[#{baseruby} -v] with
Utils.safe_popen_read in the two abstracts this branch adds, per
review: HOMEBREW_BASERUBY is CI-controlled so practical risk is low,
but the argument-vector form is strictly safer and matches the
pkg-config invocation elsewhere in the same files.
https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds precompiled portable ruby releases for 2.7.8, 3.1.7, and 3.2.11 to this fork, so mise installs ruby in seconds via the
precompiled_urltemplate in the app repo'smise.tomlinstead of compiling from source (~5 min of every cold bootstrap on Claude Code on the web; also benefits Linux/mac dev machines). Upstream jdx/ruby only builds 3.2.1+, hence the fork.All three releases are published, with every asset verified (HTTP 302) and the x86_64 Linux tarballs smoke-tested on an Ubuntu 24.04 / glibc 2.39 sandbox (extract to
/tmp, run, exercise openssl/zlib/yaml):-1New formulae
Abstract/jdx-ruby-31.rb— the 3.2 abstract minus Rust YJIT (3.1's YJIT is the C implementation: no rustup dep, no--enable-yjit,make pkgconfig-datainstead of the missingruby.pcalias). All differences verified against the 3.1.7 tarball.Abstract/jdx-ruby-27.rb— 2.7 support: depends on OpenSSL 1.1.1 (2.7's openssl ext can't build against 3.x), boolean--enable-libedit+--with-libedit-dir(no--enable-libedit=DIRin 2.7),dbm/gdbmstdlib exts excluded (they link whatever libgdbm is around and fail the portability check), nomake extract-gems(2.7's target needs the not-yet-built miniruby; rbinstall installs fromgems/*.gemdirectly), and 2.7-appropriate tests (byebug pinned to 11.1.3,BUNDLER_VERSIONunset — 2.7's RubyGems honors the leaked variable and errors instead of resolving downward).Formula/portable-openssl@1.1.1w.rb— OpenSSL 1.1.1 for rubies ≤ 3.0, porting the 3.5.5 formula's runtime cert auto-detection patch to 1.1.1's simplerx509_def.c(patch targets verified byte-for-byte against the tarball; the patched file compiles under-Wall -Werror).Formula/jdx-ruby@3.1.7.rb,Formula/jdx-ruby@2.7.8.rb— sha256s computed from freshcache.ruby-lang.orgdownloads.touch enc/jis/props.hbefore make — regenerating it with gperf ≥ 3.1 yieldssize_tprototypes that conflict with theunsigned intdeclaration those rubies ship (fixed upstream in 3.2).CI fixes (Homebrew 6 broke the workflow for all versions)
These were preventing any release from this fork, including stock 3.x:
brew jdx-package) from untrusted taps;bin/setuprunsbrew trust(with a fallback for older brews).bwrap, which runner images don't ship;HOMEBREW_NO_SANDBOX_LINUX=1(Homebrew's own suggested workaround) in the workflow env.glibc@2.17's post-install and linked built rubies against.linuxbrew/glibc, correctly failing the portability check. The Linux matrix now runs on ubuntu-24.04 (host glibc satisfies the baseline, host toolchain builds, binaries link system libc). Plain assets now have a glibc ≥ 2.39 runtime floor;no_yjitvariants keep the glibc 2.17 toolchain for older hosts.cmd/jdx-package.rbnow source-builds only this tap'sportable-*formulae (the statically-linked inputs, withbrew linkageenforcing nothing else leaks in) and installs every other dependency from bottles, completing what ci: install Linux helper deps from bottles jdx/ruby#43 started. Linux legs got ~3× faster.notifyjob (needs a secret this fork lacks) and the SLSA provenance job (third-party reusable workflow that can blockupload-assets; mise skips attestation verification for custom URL templates anyway); the GitHub attestation step iscontinue-on-error.Verification
End-to-end through mise: a fresh checkout with the app repo's
precompiled_urlsetting downloads these assets directly fromgithub.com(no rate-limitedapi.github.comlisting involved).https://claude.ai/code/session_015m4jwUW8kgyeWx6XkVvxeV