Skip to content

fix(owlbot-postprocessor): remove default json gemspec to clear CVE - #464

Merged
torreypayne merged 1 commit into
googleapis:mainfrom
torreypayne:fix-json-gemspec
Aug 24, 2026
Merged

fix(owlbot-postprocessor): remove default json gemspec to clear CVE#464
torreypayne merged 1 commit into
googleapis:mainfrom
torreypayne:fix-json-gemspec

Conversation

@torreypayne

@torreypayne torreypayne commented Aug 24, 2026

Copy link
Copy Markdown
Member

Clears the json-2.18.0.gemspec file from the system Ruby default gems inside the image, mitigating the scanner alert.

Fixes b/548806296

Validation & Repro Steps

# 1. Confirm the published (vulnerable) image still triggers the alert by checking for the default json gemspec
docker pull gcr.io/cloud-devrel-public-resources/owlbot-ruby:latest
docker run --rm --entrypoint /bin/sh gcr.io/cloud-devrel-public-resources/owlbot-ruby:latest -c 'ls -l /usr/local/lib/ruby/gems/*/specifications/default/json*.gemspec'
# -> Expected output: -rw-r--r-- ... /usr/local/lib/ruby/gems/4.0.0/specifications/default/json-2.18.0.gemspec

# 2. Navigate to the owlbot-postprocessor directory in the repository
cd owlbot-postprocessor

# 3. Build the patched owlbot-ruby image locally
docker build -t owlbot-ruby:patched .

# 4. Confirm the vulnerable system default json gem has been successfully scrubbed
docker run --rm --entrypoint /bin/sh owlbot-ruby:patched -c 'ls -l /usr/local/lib/ruby/gems/*/specifications/default/json*.gemspec'
# -> Expected output: "ls: cannot access ... No such file or directory"

# 5. Confirm the securely patched json:2.19.2 gem remains installed and active
docker run --rm --entrypoint /bin/sh owlbot-ruby:patched -c 'ls -l /usr/local/bundle/specifications/json*.gemspec'
# -> Expected output: -rw-r--r-- ... /usr/local/bundle/specifications/json-2.19.2.gemspec

@torreypayne
torreypayne requested a review from a team as a code owner August 24, 2026 18:12
@torreypayne
torreypayne marked this pull request as draft August 24, 2026 18:13
@torreypayne
torreypayne marked this pull request as ready for review August 24, 2026 20:17
Comment thread owlbot-postprocessor/Dockerfile Outdated
@torreypayne
torreypayne force-pushed the fix-json-gemspec branch 2 times, most recently from 4a3bae9 to 700b67d Compare August 24, 2026 20:25

@aandreassa aandreassa left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, minor nits.

Comment thread owlbot-postprocessor/Dockerfile
@aandreassa

Copy link
Copy Markdown
Contributor

Please make sure you merge the new image SHA once a PR pops up on google-cloud-ruby later.

@aandreassa aandreassa left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect, ty!

@torreypayne
torreypayne merged commit 9aba2e8 into googleapis:main Aug 24, 2026
14 checks passed
@torreypayne
torreypayne deleted the fix-json-gemspec branch August 24, 2026 20:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants