Overall optimization and modernization#442
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
nodeg
force-pushed
the
rubocop_performance
branch
from
January 16, 2026 22:46
4842a41 to
8ff55f2
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #442 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 19 19
Lines 783 839 +56
=========================================
+ Hits 783 839 +56 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
nodeg
changed the title
nodeg
force-pushed
the
rubocop_performance
branch
from
January 17, 2026 16:26
9cf2729 to
a1953ff
Compare
nodeg
marked this pull request as ready for review
January 17, 2026 16:26
There was a problem hiding this comment.
Pull request overview
This PR modernizes the tetra codebase for Ruby 3.4 compatibility and hardens security through several key improvements. The changes include adding frozen_string_literal: true throughout the project, replacing deprecated URI methods, switching to binary-safe IO operations, and most importantly, replacing shell string interpolation with array-based command execution to prevent shell injection vulnerabilities.
Changes:
- Added Ruby 3.4 compatibility with frozen string literals and modernized file path handling
- Hardened security by replacing shell string interpolation with array-based command execution in Tar, Unzip, Bash, Git, and ProcessRunner facades
- Added automatic
BuildRequires: unzipfor .zip source archives (fixes issue #10) - Updated RPM spec templates with modern
%patchsyntax, removed deprecated tags, and changed Python 2 to Python 3 shebangs - Improved test coverage with new tests for unzip functionality and cleanup_description method
Reviewed changes
Copilot reviewed 65 out of 67 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tetra.gemspec | Added frozen_string_literal, MFA requirements, rubocop-performance dependency, modernized path handling |
| spec/**/*.rb | Added frozen_string_literal to all spec files, improved test descriptions, added unzip tests |
| lib/tetra/version_matcher.rb | Optimized version matching algorithm, improved regex patterns, added performance improvements |
| lib/tetra/facades/* | Replaced shell string interpolation with array-based execution for security (tar, unzip, bash, git, ant, mvn, gradle) |
| lib/tetra/facades/process_runner.rb | Complete rewrite using Open3 instead of open4, improved thread-safe output capture |
| lib/tetra/pom.rb | Refactored to use REXML::XPath correctly, added safe navigation operators |
| lib/tetra/pom_getter.rb | Added Zip Slip protection, performance improvements with SHA1 file streaming |
| lib/tetra/maven_website.rb | Added retry logic, timeout handling, and proper redirect support |
| lib/tetra/packages/package.rb | Fixed ReDoS vulnerability in cleanup_description with iterative chomp |
| lib/template/package.spec | Added conditional BuildRequires: unzip, modernized %patch syntax, updated Python shebangs |
| lib/template/kit.spec | Removed deprecated RPM tags, updated Python 2 to Python 3 |
| lib/template/bashrc | Replaced non-portable escape sequences, added tput availability check |
| .rubocop.yml | Enabled NewCops, added rubocop-performance plugin, enforced frozen_string_literal |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
nodeg
force-pushed
the
rubocop_performance
branch
from
January 17, 2026 16:53
a1953ff to
60ddc84
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 65 out of 67 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Patched shell injection vulnerabilities in Tar, Unzip, and Bash facades - Use `Dir.glob` instead of slower `Find.find` - Added `frozen_string_literal` headers and fixed Ruby 3.4 deprecations - Improved RPM spec templates with nil-safety and modern packaging standards - Cleaned up entire test suite and fixed some RuboCop offenses - Enabled all RuboCop cops and recreated the TODO filename - Extended the test cases (e.g. for unzip dependency in spec file) - Fixed uyuni-project#10 Signed-off-by: Dominik Gedon <dominik.gedon@suse.com>
nodeg
force-pushed
the
rubocop_performance
branch
from
January 17, 2026 17:18
60ddc84 to
fdcf925
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR improves the following:
Core Modernization
frozen_string_literal: truethroughout the project.URImethods and modernized file path logic using__dir__andFile.joinfor better cross-environment reliability.File.binread) to handle non-UTF-8 characters in bundled Ant/Maven metadata, preventing crashes during installation and documentation generation.rubocop-performance.Security Hardening
ProcessRunnerto ensure cleaner handling of external build tools.RPM Workflow & Templates
&.) to handle cases where source archives are absent.Tests
Packaging Logic:
BuildRequires: unzipif the source is a .zip file. Fixes Missing BuildRequires unzip #10%patchsyntax and Python shebang handling to modern standards, e.g. Python 2 to Python 3GroupandBuildRoottags.build.shworks seamlessly in restricted build environments (chroots).