# Opscode Upgrade to Embedded Ruby

**URL:** <https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147>\
**Category:** Chef Infra (archive)\
**Created:** [June 28, 2013, 1:32am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147 "2013-06-28T01:32:35Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tommy\_Fotak](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tommy_fotak/32/515_2.png) [@Tommy\_Fotak](https://discourse.chef.io/u/Tommy_Fotak)\
**Post date:** [June 28, 2013, 1:32am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/1 "2013-06-28T01:32:35Z")

</div>

Hi,

What is the policy of Chef releases with regard to Ruby releases?

For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that fix  
an SSL vulnerability, will Opscode make an 11.4.4 release with a new  
embedded Ruby?

Are we better off using the Chef gem in our managed Rubies over the Omnibus?

Regards,  
Tommy

---

<div class="post-metadata">

**Author:** ![coderanger](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/coderanger/32/5_2.png) [@coderanger](https://discourse.chef.io/u/coderanger)\
**Post date:** [June 28, 2013, 1:38am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/2 "2013-06-28T01:38:06Z")

</div>

On Jun 27, 2013, at 6:32 PM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au) wrote:

> Hi,
> 
> What is the policy of Chef releases with regard to Ruby releases?
> 
> For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that fix an SSL vulnerability, will Opscode make an 11.4.4 release with a new embedded Ruby?
> 
> Are we better off using the Chef gem in our managed Rubies over the Omnibus?

The relevant bug fix just blocks a potential issue in how Ruby verifies SSL certificates. Chef sets :verify\_none by default, so there is technically no risk of hitting the bug 🙂 (the astute reader will note that this is because there is never any validation)

--Noah

---

<div class="post-metadata">

**Author:** ![dcondomitti](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/dcondomitti/32/104_2.png) [@dcondomitti](https://discourse.chef.io/u/dcondomitti)\
**Post date:** [June 28, 2013, 1:53am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/3 "2013-06-28T01:53:09Z")

</div>

Are there plans to change that? I would expect that Chef server be one of the most critical services to ensure you're not being MITM'ed; especially when using hosted chef.

On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:

> On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au ([mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au))\> wrote:
> 
> > Hi,
> > 
> > What is the policy of Chef releases with regard to Ruby releases?
> > 
> > For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that fix an SSL vulnerability, will Opscode make an 11.4.4 release with a new embedded Ruby?
> > 
> > Are we better off using the Chef gem in our managed Rubies over the Omnibus?
> 
> The relevant bug fix just blocks a potential issue in how Ruby verifies SSL certificates. Chef sets :verify\_none by default, so there is technically no risk of hitting the bug 🙂 (the astute reader will note that this is because there is never any validation)
> 
> --Noah

---

<div class="post-metadata">

**Author:** ![Tommy\_Fotak](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tommy_fotak/32/515_2.png) [@Tommy\_Fotak](https://discourse.chef.io/u/Tommy_Fotak)\
**Post date:** [June 28, 2013, 1:56am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/4 "2013-06-28T01:56:26Z")

</div>

To be clear it's not so much the vulnerability that concerns me, it's  
more about keeping the Ruby up to date in general and how that works.  
For example will the next release be ruby 2.0.0 or still 1.9.3?

Daniel Condomitti wrote:

> Are there plans to change that? I would expect that Chef server be one  
> of the most critical services to ensure you're not being MITM'ed;  
> especially when using hosted chef.
> 
> On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> 
> > On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au  
> > [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> > 
> > > Hi,
> > > 
> > > What is the policy of Chef releases with regard to Ruby releases?
> > > 
> > > For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that  
> > > fix an SSL vulnerability, will Opscode make an 11.4.4 release with a  
> > > new embedded Ruby?
> > > 
> > > Are we better off using the Chef gem in our managed Rubies over the  
> > > Omnibus?
> > 
> > The relevant bug fix just blocks a potential issue in how Ruby  
> > verifies SSL certificates. Chef sets :verify\_none by default, so  
> > there is technically no risk of hitting the bug 🙂 (the astute  
> > reader will note that this is because there is never any validation)
> > 
> > --Noah

---

<div class="post-metadata">

**Author:** ![bytheway](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/bytheway/32/123_2.png) [@bytheway](https://discourse.chef.io/u/bytheway)\
**Post date:** [June 28, 2013, 2:45am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/5 "2013-06-28T02:45:55Z")

</div>

I put a pull request in that was merged for 11.6 to bump the omnibus  
installers to 1.9.3-p429. Makes a huge difference in speed, especially on  
windows.

-Ben

On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)wrote:

> To be clear it's not so much the vulnerability that concerns me, it's more  
> about keeping the Ruby up to date in general and how that works. For  
> example will the next release be ruby 2.0.0 or still 1.9.3?
> 
> Daniel Condomitti wrote:
> 
> Are there plans to change that? I would expect that Chef server be one  
> of the most critical services to ensure you're not being MITM'ed;  
> especially when using hosted chef.
> 
> On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> 
> On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au  
> [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> 
> Hi,
> 
> What is the policy of Chef releases with regard to Ruby releases?
> 
> For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that  
> fix an SSL vulnerability, will Opscode make an 11.4.4 release with a  
> new embedded Ruby?
> 
> Are we better off using the Chef gem in our managed Rubies over the  
> Omnibus?
> 
> The relevant bug fix just blocks a potential issue in how Ruby  
> verifies SSL certificates. Chef sets :verify\_none by default, so  
> there is technically no risk of hitting the bug 🙂 (the astute  
> reader will note that this is because there is never any validation)
> 
> --Noah

---

<div class="post-metadata">

**Author:** ![Morgan\_Blackthorne](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/morgan_blackthorne/32/100_2.png) [@Morgan\_Blackthorne](https://discourse.chef.io/u/Morgan_Blackthorne)\
**Post date:** [June 28, 2013, 3:20am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/6 "2013-06-28T03:20:24Z")

</div>

I would also suspect that the 1.9 branch will be maintained and security  
fixes backported to it for some time to come; jumping to 2.0 probably is  
not necessary, or desired currently with the given amount of work it will  
take to implement while 1.9.x is still supported by the Ruby folks.

I mean, if I recall, Chef still technically supports 1.8, that hasn't been  
officially EOL'd yet.

--  
~_~ StormeRider ~_~

"Every world needs its heroes [...] They inspire us to be better than we  
are. And they protect from the darkness that's just around the corner."

(from Smallville Season 6x1: "Zod")

On why I hate the phrase "that's so lame"... [http://bit.ly/Ps3uSS](http://bit.ly/Ps3uSS)

On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway [bbytheway@gmail.com](mailto:bbytheway@gmail.com)wrote:

> I put a pull request in that was merged for 11.6 to bump the omnibus  
> installers to 1.9.3-p429. Makes a huge difference in speed, especially on  
> windows.
> 
> -Ben
> 
> On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)wrote:
> 
> > To be clear it's not so much the vulnerability that concerns me, it's  
> > more about keeping the Ruby up to date in general and how that works. For  
> > example will the next release be ruby 2.0.0 or still 1.9.3?
> > 
> > Daniel Condomitti wrote:
> > 
> > Are there plans to change that? I would expect that Chef server be one  
> > of the most critical services to ensure you're not being MITM'ed;  
> > especially when using hosted chef.
> > 
> > On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> > 
> > On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au  
> > [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> > 
> > Hi,
> > 
> > What is the policy of Chef releases with regard to Ruby releases?
> > 
> > For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that  
> > fix an SSL vulnerability, will Opscode make an 11.4.4 release with a  
> > new embedded Ruby?
> > 
> > Are we better off using the Chef gem in our managed Rubies over the  
> > Omnibus?
> > 
> > The relevant bug fix just blocks a potential issue in how Ruby  
> > verifies SSL certificates. Chef sets :verify\_none by default, so  
> > there is technically no risk of hitting the bug 🙂 (the astute  
> > reader will note that this is because there is never any validation)
> > 
> > --Noah

---

<div class="post-metadata">

**Author:** ![fujin](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/fujin/32/266_2.png) [@fujin](https://discourse.chef.io/u/fujin)\
**Post date:** [June 28, 2013, 3:41am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/7 "2013-06-28T03:41:39Z")

</div>

There's a patch in 11.6.x alpha (saw on master) that is required for 2.0.0,  
iirc, something to do with rubygem/format.

You can build your own omnibus-chef packages (and screw around with the  
project/software definitions, etc) really easily, check out the following  
projects:

> **[GitHub - chef-boneyard/omnibus-chef: Omnibus packaging for Chef](https://github.com/chef-boneyard/omnibus-chef)**
>
> Omnibus packaging for Chef. Contribute to chef-boneyard/omnibus-chef development by creating an account on GitHub.

> **[GitHub - chef/omnibus-software: Open Source Software for use in Omnibus built...](https://github.com/chef/omnibus-software)**
>
> Open Source Software for use in Omnibus built packages - GitHub - chef/omnibus-software: Open Source Software for use in Omnibus built packages

> **[GitHub - chef/omnibus: Easily create full-stack installers for your project...](https://github.com/chef/omnibus)**
>
> Easily create full-stack installers for your project across a variety of platforms. - GitHub - chef/omnibus: Easily create full-stack installers for your project across a variety of platforms.

I'd advise that if you feel the Opscode bundled omnibus installations are  
not up-to-date enough, consider modifying the Ruby software [0] definition  
in omnibus-software, pointing your omnibus-chef Gemfile at your fork/branch  
and kicking off the build -- you'll get omnibus packages out of the other  
end.. Once you have packages, it's trivial to either host them in a native  
package repository or bare HTTP.

One might even consider creating their own 'omnibus-software' repository of  
definitions to be bundled into omnibus projects for usage in other projects!

Cheers,

AJ

[0]

> <https://github.com/chef/omnibus-software/blob/main/config/software/ruby.rb#L19>

On Fri, Jun 28, 2013 at 3:20 PM, Morgan Blackthorne  
[stormerider@gmail.com](mailto:stormerider@gmail.com)wrote:

> I would also suspect that the 1.9 branch will be maintained and security  
> fixes backported to it for some time to come; jumping to 2.0 probably is  
> not necessary, or desired currently with the given amount of work it will  
> take to implement while 1.9.x is still supported by the Ruby folks.
> 
> I mean, if I recall, Chef still technically supports 1.8, that hasn't been  
> officially EOL'd yet.
> 
> --  
> ~_~ StormeRider ~_~
> 
> "Every world needs its heroes [...] They inspire us to be better than we  
> are. And they protect from the darkness that's just around the corner."
> 
> (from Smallville Season 6x1: "Zod")
> 
> On why I hate the phrase "that's so lame"... [http://bit.ly/Ps3uSS](http://bit.ly/Ps3uSS)
> 
> On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway [bbytheway@gmail.com](mailto:bbytheway@gmail.com)wrote:
> 
> > I put a pull request in that was merged for 11.6 to bump the omnibus  
> > installers to 1.9.3-p429. Makes a huge difference in speed, especially on  
> > windows.
> > 
> > -Ben
> > 
> > On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)wrote:
> > 
> > > To be clear it's not so much the vulnerability that concerns me, it's  
> > > more about keeping the Ruby up to date in general and how that works. For  
> > > example will the next release be ruby 2.0.0 or still 1.9.3?
> > > 
> > > Daniel Condomitti wrote:
> > > 
> > > Are there plans to change that? I would expect that Chef server be one  
> > > of the most critical services to ensure you're not being MITM'ed;  
> > > especially when using hosted chef.
> > > 
> > > On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> > > 
> > > On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au  
> > > [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> > > 
> > > Hi,
> > > 
> > > What is the policy of Chef releases with regard to Ruby releases?
> > > 
> > > For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that  
> > > fix an SSL vulnerability, will Opscode make an 11.4.4 release with a  
> > > new embedded Ruby?
> > > 
> > > Are we better off using the Chef gem in our managed Rubies over the  
> > > Omnibus?
> > > 
> > > The relevant bug fix just blocks a potential issue in how Ruby  
> > > verifies SSL certificates. Chef sets :verify\_none by default, so  
> > > there is technically no risk of hitting the bug 🙂 (the astute  
> > > reader will note that this is because there is never any validation)
> > > 
> > > --Noah

---

<div class="post-metadata">

**Author:** ![Tommy\_Fotak](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/tommy_fotak/32/515_2.png) [@Tommy\_Fotak](https://discourse.chef.io/u/Tommy_Fotak)\
**Post date:** [June 28, 2013, 4:05am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/8 "2013-06-28T04:05:24Z")

</div>

Thanks folks, you were all a big help.

Tommy

Aj Christensen wrote:

> There's a patch in 11.6.x alpha (saw on master) that is required for  
> 2.0.0, iirc, something to do with rubygem/format.
> 
> You can build your own omnibus-chef packages (and screw around with  
> the project/software definitions, etc) really easily, check out the  
> following projects:
> 
> [GitHub - chef-boneyard/omnibus-chef: Omnibus packaging for Chef](https://github.com/opscode/omnibus-chef)  
> [GitHub - chef/omnibus-software: Open Source Software for use in Omnibus built packages](https://github.com/opscode/omnibus-software)  
> [GitHub - chef/omnibus: Easily create full-stack installers for your project across a variety of platforms.](https://github.com/opscode/omnibus-ruby)
> 
> I'd advise that if you feel the Opscode bundled omnibus installations  
> are not up-to-date enough, consider modifying the Ruby software [0]  
> definition in omnibus-software, pointing your omnibus-chef Gemfile at  
> your fork/branch and kicking off the build -- you'll get omnibus  
> packages out of the other end.. Once you have packages, it's trivial  
> to either host them in a native package repository or bare HTTP.
> 
> One might even consider creating their own 'omnibus-software'  
> repository of definitions to be bundled into omnibus projects for  
> usage in other projects!
> 
> Cheers,
> 
> AJ
> 
> [0]  
> [omnibus-software/config/software/ruby.rb at main · chef/omnibus-software · GitHub](https://github.com/opscode/omnibus-software/blob/master/config/software/ruby.rb#L19)
> 
> On Fri, Jun 28, 2013 at 3:20 PM, Morgan Blackthorne  
> \<[stormerider@gmail.com](mailto:stormerider@gmail.com) [mailto:stormerider@gmail.com](mailto:stormerider@gmail.com)\> wrote:
> 
> I would also suspect that the 1.9 branch will be maintained and  
> security fixes backported to it for some time to come; jumping to  
> 2.0 probably is not necessary, or desired currently with the given  
> amount of work it will take to implement while 1.9.x is still  
> supported by the Ruby folks.
> 
> I mean, if I recall, Chef still technically supports 1.8, that  
> hasn't been officially EOL'd yet.
> 
> --  
> ~_~ StormeRider ~_~
> 
> "Every world needs its heroes [...] They inspire us to be better  
> than we are. And they protect from the darkness that's just around  
> the corner."
> 
> (from Smallville Season 6x1: "Zod")
> 
> On why I hate the phrase "that's so lame"... [http://bit.ly/Ps3uSS](http://bit.ly/Ps3uSS)
> 
> On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway  
> \<[bbytheway@gmail.com](mailto:bbytheway@gmail.com) [mailto:bbytheway@gmail.com](mailto:bbytheway@gmail.com)\> wrote:
> 
> I put a pull request in that was merged for 11.6 to bump the  
> omnibus installers to 1.9.3-p429. Makes a huge difference in  
> speed, especially on windows.
> 
> -Ben
> 
> On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak  
> \<Tommy.Fotak@utas.edu.au [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> 
> To be clear it's not so much the vulnerability that  
> concerns me, it's more about keeping the Ruby up to date  
> in general and how that works. For example will the next  
> release be ruby 2.0.0 or still 1.9.3?
> 
> Daniel Condomitti wrote:
> 
> > Are there plans to change that? I would expect that Chef  
> > server be one  
> > of the most critical services to ensure you're not being  
> > MITM'ed;  
> > especially when using hosted chef.
> > 
> > On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> > 
> > > On Jun 27, 2013, at 6:32 PM, Tommy Fotak  
> > > \<Tommy.Fotak@utas.edu.au [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)  
> > > \<[mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)  
> > > [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\>\> wrote:
> > > 
> > > > Hi,
> > > > 
> > > > What is the policy of Chef releases with regard to Ruby  
> > > > releases?
> > > > 
> > > > For example there are ruby 1.9.3-p448 and 2.0.0-p247  
> > > > releases that  
> > > > fix an SSL vulnerability, will Opscode make an 11.4.4  
> > > > release with a  
> > > > new embedded Ruby?
> > > > 
> > > > Are we better off using the Chef gem in our managed  
> > > > Rubies over the  
> > > > Omnibus?
> > > 
> > > The relevant bug fix just blocks a potential issue in  
> > > how Ruby  
> > > verifies SSL certificates. Chef sets :verify\_none by  
> > > default, so  
> > > there is technically no risk of hitting the bug 🙂 (the  
> > > astute  
> > > reader will note that this is because there is never any  
> > > validation)
> > > 
> > > --Noah

---

<div class="post-metadata">

**Author:** ![Andrew\_Gross](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/andrew_gross/32/320_2.png) [@Andrew\_Gross](https://discourse.chef.io/u/Andrew_Gross)\
**Post date:** [June 28, 2013, 2:24pm UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/9 "2013-06-28T14:24:30Z")

</div>

The SSL fix makes me sad. Those familiar with omnibus packaging, how hard  
would it be to create an alternate Omnibus distro with cert pinnning for  
Hosted Chef?

On Fri, Jun 28, 2013 at 12:05 AM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)wrote:

> Thanks folks, you were all a big help.
> 
> Tommy
> 
> Aj Christensen wrote:
> 
> There's a patch in 11.6.x alpha (saw on master) that is required for  
> 2.0.0, iirc, something to do with rubygem/format.
> 
> You can build your own omnibus-chef packages (and screw around with  
> the project/software definitions, etc) really easily, check out the  
> following projects:
> 
> [GitHub - chef-boneyard/omnibus-chef: Omnibus packaging for Chef](https://github.com/opscode/omnibus-chef)  
> [GitHub - chef/omnibus-software: Open Source Software for use in Omnibus built packages](https://github.com/opscode/omnibus-software)  
> [GitHub - chef/omnibus: Easily create full-stack installers for your project across a variety of platforms.](https://github.com/opscode/omnibus-ruby)
> 
> I'd advise that if you feel the Opscode bundled omnibus installations  
> are not up-to-date enough, consider modifying the Ruby software [0]  
> definition in omnibus-software, pointing your omnibus-chef Gemfile at  
> your fork/branch and kicking off the build -- you'll get omnibus  
> packages out of the other end.. Once you have packages, it's trivial  
> to either host them in a native package repository or bare HTTP.
> 
> One might even consider creating their own 'omnibus-software'  
> repository of definitions to be bundled into omnibus projects for  
> usage in other projects!
> 
> Cheers,
> 
> AJ
> 
> [0]
> 
> [omnibus-software/config/software/ruby.rb at main · chef/omnibus-software · GitHub](https://github.com/opscode/omnibus-software/blob/master/config/software/ruby.rb#L19)
> 
> On Fri, Jun 28, 2013 at 3:20 PM, Morgan Blackthorne  
> \<[stormerider@gmail.com](mailto:stormerider@gmail.com) [mailto:stormerider@gmail.com](mailto:stormerider@gmail.com)\> wrote:
> 
> ```
> I would also suspect that the 1.9 branch will be maintained and
> security fixes backported to it for some time to come; jumping to
> 2.0 probably is not necessary, or desired currently with the given
> amount of work it will take to implement while 1.9.x is still
> supported by the Ruby folks.
> 
> I mean, if I recall, Chef still technically supports 1.8, that
> hasn't been officially EOL'd yet.
> 
> --
> ~*~ StormeRider ~*~
> 
> "Every world needs its heroes [...] They inspire us to be better
> than we are. And they protect from the darkness that's just around
> the corner."
> 
> (from Smallville Season 6x1: "Zod")
> 
> On why I hate the phrase "that's so lame"... http://bit.ly/Ps3uSS
> 
> On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway
> <bbytheway@gmail.com <mailto:bbytheway@gmail.com>> wrote:
> 
> I put a pull request in that was merged for 11.6 to bump the
> omnibus installers to 1.9.3-p429. Makes a huge difference in
> speed, especially on windows.
> 
> -Ben
> 
> On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak
> <Tommy.Fotak@utas.edu.au <mailto:Tommy.Fotak@utas.edu.au>> wrote:
> 
> To be clear it's not so much the vulnerability that
> concerns me, it's more about keeping the Ruby up to date
> in general and how that works. For example will the next
> release be ruby 2.0.0 or still 1.9.3?
> 
> Daniel Condomitti wrote:
> 
> Are there plans to change that? I would expect that Chef
> server be one
> of the most critical services to ensure you're not being
> MITM'ed;
> especially when using hosted chef.
> 
> On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> 
> On Jun 27, 2013, at 6:32 PM, Tommy Fotak
> <Tommy.Fotak@utas.edu.au <mailto:Tommy.Fotak@utas.edu.au>
> <mailto:Tommy.Fotak@utas.edu.au
> 
> <mailto:Tommy.Fotak@utas.edu.au>>> wrote:
> 
> Hi,
> 
> What is the policy of Chef releases with regard to Ruby
> releases?
> 
> For example there are ruby 1.9.3-p448 and 2.0.0-p247
> releases that
> fix an SSL vulnerability, will Opscode make an 11.4.4
> release with a
> new embedded Ruby?
> 
> Are we better off using the Chef gem in our managed
> Rubies over the
> Omnibus?
> 
> The relevant bug fix just blocks a potential issue in
> how Ruby
> verifies SSL certificates. Chef sets :verify_none by
> default, so
> there is technically no risk of hitting the bug :-) (the
> astute
> reader will note that this is because there is never any
> validation)
> 
> --Noah
> 
> ```

---

<div class="post-metadata">

**Author:** ![Adam\_Edwards](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/adam_edwards/32/389_2.png) [@Adam\_Edwards](https://discourse.chef.io/u/Adam_Edwards)\
**Post date:** [June 28, 2013, 2:35pm UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/10 "2013-06-28T14:35:54Z")

</div>

Can you be more specific Andrew on what you mean by the "ssl fix? Are you concerned that the windows package still does not enforce ssl by default despite including cacert.pem?

To be clear, the work on ssl for Windows isn't yet done - the goal is to validate the server for all ssl endpoints.

-Adam  
From: Andrew Gross \<[andrew@yipit.com](mailto:andrew@yipit.com)[mailto:andrew@yipit.com](mailto:andrew@yipit.com)\>  
Reply-To: "[chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)" \<[chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)\>  
Date: Friday, June 28, 2013 7:24 AM  
To: chef \<[chef@lists.opscode.com](mailto:chef@lists.opscode.com)[mailto:chef@lists.opscode.com](mailto:chef@lists.opscode.com)\>  
Subject: [chef] Re: Re: Re: Re: Re: Re: Re: Re: Opscode Upgrade to Embedded Ruby

The SSL fix makes me sad. Those familiar with omnibus packaging, how hard would it be to create an alternate Omnibus distro with cert pinnning for Hosted Chef?

On Fri, Jun 28, 2013 at 12:05 AM, Tommy Fotak \<Tommy.Fotak@utas.edu.au[mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:  
Thanks folks, you were all a big help.

Tommy

Aj Christensen wrote:

There's a patch in 11.6.x alpha (saw on master) that is required for  
2.0.0, iirc, something to do with rubygem/format.

You can build your own omnibus-chef packages (and screw around with  
the project/software definitions, etc) really easily, check out the  
following projects:

[https://github.com/opscode/omnibus-chef](https://github.com/opscode/omnibus-chef)

> **[chef/omnibus-software](https://github.com/chef/omnibus-software)**
>
> Open Source Software for use in Omnibus built packages - chef/omnibus-software

  
[https://github.com/opscode/omnibus-ruby](https://github.com/opscode/omnibus-ruby)

I'd advise that if you feel the Opscode bundled omnibus installations  
are not up-to-date enough, consider modifying the Ruby software [0]  
definition in omnibus-software, pointing your omnibus-chef Gemfile at  
your fork/branch and kicking off the build -- you'll get omnibus  
packages out of the other end.. Once you have packages, it's trivial  
to either host them in a native package repository or bare HTTP.

One might even consider creating their own 'omnibus-software'  
repository of definitions to be bundled into omnibus projects for  
usage in other projects!

Cheers,

AJ

[0]  
[https://github.com/opscode/omnibus-software/blob/master/config/software/ruby.rb#L19](https://github.com/opscode/omnibus-software/blob/master/config/software/ruby.rb#L19)

On Fri, Jun 28, 2013 at 3:20 PM, Morgan Blackthorne  
\<[stormerider@gmail.com](mailto:stormerider@gmail.com)[mailto:stormerider@gmail.com](mailto:stormerider@gmail.com) \<[mailto:stormerider@gmail.com](mailto:stormerider@gmail.com)[mailto:stormerider@gmail.com](mailto:stormerider@gmail.com)\>\> wrote:

```
I would also suspect that the 1.9 branch will be maintained and
security fixes backported to it for some time to come; jumping to
2.0 probably is not necessary, or desired currently with the given
amount of work it will take to implement while 1.9.x is still
supported by the Ruby folks.

I mean, if I recall, Chef still technically supports 1.8, that
hasn't been officially EOL'd yet.

--
~*~ StormeRider ~*~

"Every world needs its heroes [...] They inspire us to be better
than we are. And they protect from the darkness that's just around
the corner."

(from Smallville Season 6x1: "Zod")

On why I hate the phrase "that's so lame"... http://bit.ly/Ps3uSS

On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway
<bbytheway@gmail.com<mailto:bbytheway@gmail.com> <mailto:bbytheway@gmail.com<mailto:bbytheway@gmail.com>>> wrote:

    I put a pull request in that was merged for 11.6 to bump the
    omnibus installers to 1.9.3-p429. Makes a huge difference in
    speed, especially on windows.

    -Ben

    On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak
    <Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au> <mailto:Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au>>> wrote:

        To be clear it's not so much the vulnerability that
        concerns me, it's more about keeping the Ruby up to date
        in general and how that works. For example will the next
        release be ruby 2.0.0 or still 1.9.3?

        Daniel Condomitti wrote:

        Are there plans to change that? I would expect that Chef
        server be one
        of the most critical services to ensure you're not being
        MITM'ed;
        especially when using hosted chef.

        On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:

        On Jun 27, 2013, at 6:32 PM, Tommy Fotak
        <Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au> <mailto:Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au>>
        <mailto:Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au>

        <mailto:Tommy.Fotak@utas.edu.au<mailto:Tommy.Fotak@utas.edu.au>>>> wrote:

        Hi,

        What is the policy of Chef releases with regard to Ruby
        releases?

        For example there are ruby 1.9.3-p448 and 2.0.0-p247
        releases that
        fix an SSL vulnerability, will Opscode make an 11.4.4
        release with a
        new embedded Ruby?

        Are we better off using the Chef gem in our managed
        Rubies over the
        Omnibus?

        The relevant bug fix just blocks a potential issue in
        how Ruby
        verifies SSL certificates. Chef sets :verify_none by
        default, so
        there is technically no risk of hitting the bug :-) (the
        astute
        reader will note that this is because there is never any
        validation)

        --Noah
```

---

<div class="post-metadata">

**Author:** ![Andrew\_Gross](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/andrew_gross/32/320_2.png) [@Andrew\_Gross](https://discourse.chef.io/u/Andrew_Gross)\
**Post date:** [June 28, 2013, 2:40pm UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/11 "2013-06-28T14:40:57Z")

</div>

More concerned about this statement "Chef sets :verify\_none by default", I  
presumed it was due to issues in Ruby with SSL. I also assumed it was for  
\*Nix based distros, no experience with Windows.

On Fri, Jun 28, 2013 at 10:35 AM, Adam Edwards [adamed@opscode.com](mailto:adamed@opscode.com) wrote:

> Can you be more specific Andrew on what you mean by the "ssl fix? Are  
> you concerned that the windows package still does not enforce ssl by  
> default despite including cacert.pem?
> 
> To be clear, the work on ssl for Windows isn't yet done — the goal is to  
> validate the server for all ssl endpoints.
> 
> -Adam  
> From: Andrew Gross [andrew@yipit.com](mailto:andrew@yipit.com)  
> Reply-To: "[chef@lists.opscode.com](mailto:chef@lists.opscode.com)" [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> Date: Friday, June 28, 2013 7:24 AM  
> To: chef [chef@lists.opscode.com](mailto:chef@lists.opscode.com)  
> Subject: [chef] Re: Re: Re: Re: Re: Re: Re: Re: Opscode Upgrade to  
> Embedded Ruby
> 
> The SSL fix makes me sad. Those familiar with omnibus packaging, how  
> hard would it be to create an alternate Omnibus distro with cert pinnning  
> for Hosted Chef?
> 
> On Fri, Jun 28, 2013 at 12:05 AM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)wrote:
> 
> > Thanks folks, you were all a big help.
> > 
> > Tommy
> > 
> > Aj Christensen wrote:
> > 
> > There's a patch in 11.6.x alpha (saw on master) that is required for  
> > 2.0.0, iirc, something to do with rubygem/format.
> > 
> > You can build your own omnibus-chef packages (and screw around with  
> > the project/software definitions, etc) really easily, check out the  
> > following projects:
> > 
> > [GitHub - chef-boneyard/omnibus-chef: Omnibus packaging for Chef](https://github.com/opscode/omnibus-chef)  
> > [GitHub - chef/omnibus-software: Open Source Software for use in Omnibus built packages](https://github.com/opscode/omnibus-software)  
> > [GitHub - chef/omnibus: Easily create full-stack installers for your project across a variety of platforms.](https://github.com/opscode/omnibus-ruby)
> > 
> > I'd advise that if you feel the Opscode bundled omnibus installations  
> > are not up-to-date enough, consider modifying the Ruby software [0]  
> > definition in omnibus-software, pointing your omnibus-chef Gemfile at  
> > your fork/branch and kicking off the build -- you'll get omnibus  
> > packages out of the other end.. Once you have packages, it's trivial  
> > to either host them in a native package repository or bare HTTP.
> > 
> > One might even consider creating their own 'omnibus-software'  
> > repository of definitions to be bundled into omnibus projects for  
> > usage in other projects!
> > 
> > Cheers,
> > 
> > AJ
> > 
> > [0]
> > 
> > [omnibus-software/config/software/ruby.rb at main · chef/omnibus-software · GitHub](https://github.com/opscode/omnibus-software/blob/master/config/software/ruby.rb#L19)
> > 
> > On Fri, Jun 28, 2013 at 3:20 PM, Morgan Blackthorne  
> > \<[stormerider@gmail.com](mailto:stormerider@gmail.com) [mailto:stormerider@gmail.com](mailto:stormerider@gmail.com)\> wrote:
> > 
> > ```
> > I would also suspect that the 1.9 branch will be maintained and
> > security fixes backported to it for some time to come; jumping to
> > 2.0 probably is not necessary, or desired currently with the given
> > amount of work it will take to implement while 1.9.x is still
> > supported by the Ruby folks.
> > 
> > I mean, if I recall, Chef still technically supports 1.8, that
> > hasn't been officially EOL'd yet.
> > 
> > --
> > ~*~ StormeRider ~*~
> > 
> > "Every world needs its heroes [...] They inspire us to be better
> > than we are. And they protect from the darkness that's just around
> > the corner."
> > 
> > (from Smallville Season 6x1: "Zod")
> > 
> > On why I hate the phrase "that's so lame"... http://bit.ly/Ps3uSS
> > 
> > On Thu, Jun 27, 2013 at 7:45 PM, Benjamin Bytheway
> > <bbytheway@gmail.com <mailto:bbytheway@gmail.com>> wrote:
> > 
> > I put a pull request in that was merged for 11.6 to bump the
> > omnibus installers to 1.9.3-p429. Makes a huge difference in
> > speed, especially on windows.
> > 
> > -Ben
> > 
> > On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak
> > <Tommy.Fotak@utas.edu.au <mailto:Tommy.Fotak@utas.edu.au>>
> > 
> > ```
> > 
> > wrote:
> > 
> > ```
> > To be clear it's not so much the vulnerability that
> > concerns me, it's more about keeping the Ruby up to date
> > in general and how that works. For example will the next
> > release be ruby 2.0.0 or still 1.9.3?
> > 
> > Daniel Condomitti wrote:
> > 
> > Are there plans to change that? I would expect that Chef
> > server be one
> > of the most critical services to ensure you're not being
> > MITM'ed;
> > especially when using hosted chef.
> > 
> > On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> > 
> > On Jun 27, 2013, at 6:32 PM, Tommy Fotak
> > <Tommy.Fotak@utas.edu.au <mailto:Tommy.Fotak@utas.edu.au>
> > <mailto:Tommy.Fotak@utas.edu.au
> > 
> > <mailto:Tommy.Fotak@utas.edu.au>>> wrote:
> > 
> > Hi,
> > 
> > What is the policy of Chef releases with regard to Ruby
> > releases?
> > 
> > For example there are ruby 1.9.3-p448 and 2.0.0-p247
> > releases that
> > fix an SSL vulnerability, will Opscode make an 11.4.4
> > release with a
> > new embedded Ruby?
> > 
> > Are we better off using the Chef gem in our managed
> > Rubies over the
> > Omnibus?
> > 
> > The relevant bug fix just blocks a potential issue in
> > how Ruby
> > verifies SSL certificates. Chef sets :verify_none by
> > default, so
> > there is technically no risk of hitting the bug :-) (the
> > astute
> > reader will note that this is because there is never any
> > validation)
> > 
> > --Noah
> > 
> > ```

---

<div class="post-metadata">

**Author:** ![Peter\_Loron](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/peter_loron/32/338_2.png) [@Peter\_Loron](https://discourse.chef.io/u/Peter_Loron)\
**Post date:** [June 30, 2013, 5:12am UTC](https://discourse.chef.io/t/opscode-upgrade-to-embedded-ruby/4147/12 "2013-06-30T05:12:23Z")

</div>

Yay! This will be great for us! Been pulling my hair out waiting for the Windows boxes...

-Pete

On Jun 27, 2013, at 7:45 PM, Benjamin Bytheway [bbytheway@gmail.com](mailto:bbytheway@gmail.com) wrote:

> I put a pull request in that was merged for 11.6 to bump the omnibus installers to 1.9.3-p429. Makes a huge difference in speed, especially on windows.
> 
> -Ben
> 
> On Thu, Jun 27, 2013 at 7:56 PM, Tommy Fotak [Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au) wrote:  
> To be clear it's not so much the vulnerability that concerns me, it's more about keeping the Ruby up to date in general and how that works. For example will the next release be ruby 2.0.0 or still 1.9.3?
> 
> Daniel Condomitti wrote:
> 
> > Are there plans to change that? I would expect that Chef server be one  
> > of the most critical services to ensure you're not being MITM'ed;  
> > especially when using hosted chef.
> > 
> > On Thursday, June 27, 2013 at 6:38 PM, Noah Kantrowitz wrote:
> > 
> > > On Jun 27, 2013, at 6:32 PM, Tommy Fotak \<Tommy.Fotak@utas.edu.au  
> > > [mailto:Tommy.Fotak@utas.edu.au](mailto:Tommy.Fotak@utas.edu.au)\> wrote:
> > > 
> > > > Hi,
> > > > 
> > > > What is the policy of Chef releases with regard to Ruby releases?
> > > > 
> > > > For example there are ruby 1.9.3-p448 and 2.0.0-p247 releases that  
> > > > fix an SSL vulnerability, will Opscode make an 11.4.4 release with a  
> > > > new embedded Ruby?
> > > > 
> > > > Are we better off using the Chef gem in our managed Rubies over the  
> > > > Omnibus?
> > > 
> > > The relevant bug fix just blocks a potential issue in how Ruby  
> > > verifies SSL certificates. Chef sets :verify\_none by default, so  
> > > there is technically no risk of hitting the bug 🙂 (the astute  
> > > reader will note that this is because there is never any validation)
> > > 
> > > --Noah