Skip to content

RubyGems: Remove unused ctx.tmp_dh_callback in start_ssl_server#9633

Open
junaruga wants to merge 1 commit into
ruby:masterfrom
junaruga:wip/rubygems-start-ssl-server-remove-tmp_dh_callback
Open

RubyGems: Remove unused ctx.tmp_dh_callback in start_ssl_server#9633
junaruga wants to merge 1 commit into
ruby:masterfrom
junaruga:wip/rubygems-start-ssl-server-remove-tmp_dh_callback

Conversation

@junaruga

@junaruga junaruga commented Jun 22, 2026

Copy link
Copy Markdown
Member

What was the end-user or developer problem that led to this PR?

I think the following code in start_ssl_server, test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb is possibly not used any more.

ctx.tmp_dh_callback = proc { TEST_KEY_DH2048 }

In my investigation, the code was added at the commit 5e16a54 link when the start_ssl_server method was used with WEBrick or OpenSSL versions older than version 1.1.

I confirmed that the test with Ruby compiled with OpenSSL 1.1.1w passed as follows.

$ which ruby
~/.local/ruby-4.1.0-debug-d190c264ec-openssl-1.1.1w-debug/bin/ruby

$ ruby -e 'require "openssl"; p OpenSSL::OPENSSL_VERSION'
"OpenSSL 1.1.1w  11 Sep 2023"

$ bin/test-unit test/rubygems/test_gem_remote_fetcher_local_ssl_server.rb
Loaded suite Gem::TestCase
Started
.......
Finished in 3.645390202 seconds.
----------------------------------------------------------------------------------------
7 tests, 19 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed
----------------------------------------------------------------------------------------
1.92 tests/s, 5.21 assertions/s
Coverage report generated for rubygems to /home/jaruga/var/git/ruby/rubygems2/coverage.
Line Coverage: 32.06% (1328 / 4142)

Because as far as I know, RHEL 8 server in RubyCI has the oldest version of OpenSSL 1.1.1k.

$ openssl version
OpenSSL 1.1.1k  FIPS 25 Mar 2021

So, as I confirmed the test passed with OpenSSL 1.1.1w, I guess the changed test passes in all the servers of RubyCI.

Ruby OpenSSL latest stable version 4.0.x's minimal supported OpenSSL vesion is 1.1.1. So, I think it's good enough to test with OpenSSL 1.1.1.

https://github.com/ruby/openssl

What is your fix for the problem, implemented in this PR?

Deleted the unused ctx.tmp_dh_callback logic.

Make sure the following tasks are checked

@junaruga

Copy link
Copy Markdown
Member Author

I don't think the following test failures are related to this PR.

https://github.com/ruby/rubygems/actions/runs/27963205081/job/82750000370?pr=9633

TestSetTraceFunc#test_enable_target_thread [/home/runner/work/rubygems/rubygems/ruby/ruby/test/ruby/test_settracefunc.rb:2595]

https://github.com/ruby/rubygems/actions/runs/27963205085/job/82750000864?pr=9633#step:8:39

rake aborted!
Command failed with status (1)
org/jruby/ext/monitor/Monitor.java:85:in 'synchronize'
D:/a/rubygems/rubygems/spec/support/rubygems_ext.rb:174:in 'gem_load_and_activate'
D:/a/rubygems/rubygems/spec/support/rubygems_ext.rb:16:in 'gem_load'
Tasks: TOP => test
(See full trace by running task with --trace)

@rhenium

rhenium commented Jun 22, 2026

Copy link
Copy Markdown
Member

+1. tmp_dh_callback was specified to let tests pass on RHEL 5.x (or was it 6.x?), where the ECC support in OpenSSL was explicitly disabled due to patent concerns. It's no longer relevant today.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants