Redmine

I've had two Redmine installations for a long time now and last updated to v2.5.1 on April 15th. Since then I haven't installed any gems (directly or via bundler), so when cron complained last night about 9:15 PM about a missing gem it struck me as odd.

Of the two sites just one of them (a non-public one) was the culprit for generating the error.

Confirming the missing gem¶

To confirm that I was missing the ruby-openid gem I did the following:

1. cd'd into each of the Redmine installation directories
2. Ran bundle show and piped the content to a file
3. Ran diff -u FILE1 FILE2

--- /tmp/public_site_bundle.txt      2014-05-30 10:47:33.000000000 -0500
+++ /tmp/private_site_bundle.txt  2014-05-30 10:48:27.000000000 -0500
@@ -36,7 +36,6 @@
   * rdoc (3.12.2)
   * redcarpet (2.3.0)
   * rmagick (2.13.2)
-  * ruby-openid (2.3.0)
   * sprockets (2.2.2)
   * thor (0.19.1)
   * tilt (1.4.1)

Applying a workaround¶

I was able to run bundle update in the private Redmine install directory and that "pulled in" the missing gem (which was already installed and present in the system gem list as well as the other Redmine installation).

Where are the bundle update changes recorded?¶

I also created a fresh installation of Redmine on a test VM and did a before/after filesystem diff using 'find' in an attempt to track what files are updated/created when bundle install or bundle update is run.

1. cd /opt/redmine
2. find . > /tmp/before.txt
3. bundle install --without development test postgresql
4. find . > /tmp/after.txt
5. diff -u /tmp/before.txt /tmp/after.txt

--- /tmp/before.txt    2014-05-30 11:10:43.352337264 -0500
+++ /tmp/after.txt    2014-05-30 11:19:02.243204946 -0500
@@ -5506,6 +5506,7 @@
 ./plugins/.svn/prop-base/README.svn-base
 ./plugins/.svn/entries
 ./plugins/.svn/props
+./Gemfile.lock
 ./app
 ./app/controllers
 ./app/controllers/journals_controller.rb
@@ -7633,6 +7634,8 @@
 ./app/helpers/.svn/props
 ./app/helpers/my_helper.rb
 ./app/helpers/auth_sources_helper.rb
+./.bundle
+./.bundle/config
 ./Rakefile
 ./config.ru
 ./extra

Here I can see that the /opt/redmine/Gemfile.lock file showed up along with /opt/redmine/.bundle/config. Unfortunately this doesn't show us what files changed, but since we checked out the test Redmine installation from Subversion we can use the client to show what changed:

root(none):/opt/redmine# svn st --no-ignore@

I       Gemfile.lock
I       .bundle

Same deal.

Questions¶

• Can you think of a reason that the ruby-openid would "disappear" from the bundle?
• I thought that the Gemfile.lock file was the list of what is included in the bundle, but comparing the contents of that file against bundle show I see different gems (and versions of gems) between the two of them. Where are the active gems in a bundle recorded?

I want to take and compare earlier backups of my Redmine installations against yesterday's to see if I can track down how the gem was removed from the active list. This sort of thing strikes me as really odd.

I'm not seeing other behavior on my system that indicates a breach, but this has got me a little worried. Thanks in advance for your help with this.