RubyForge website

[S. Robert James]

A lot of projects in RubyForge have no website, other than the
"Hopefully coming soon..." message. Might I suggest that the site
default to the RDoc of that gem (or gems)?

Advantages:
* Every project has a site letting you know what it does (sometimes
there is next to no info on the project page).
* Encourages developers to keep the RDoc up to date
* The most common site that projects do have is simply their RDoc. So,
we've removed one step for all of those projects.

Disadvantages:
* Requires a little processing on the rubyforge server (to extract the
RDoc)

 

[Paul Duncan]

--qXCixuLMVvZDruUh
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

=20
Yup, or have that in one of the tabs for each project.
=20
=20
Is there any security aspect to this - does running RDoc on a gem
require installing it or executing any of the code in the gem? I
suppose it could be done on a different machine and uploaded to
RubyForge, though...

Don't do this unless you either hard-code the RDoc template or limit it
to a pre-selected list. Using the options specified in the Gem
specification allows Gem authors to run arbitrary Ruby code on the=20
RubyForge server.

I've written about this several times on the RubyGems mailing list in
the last week or so. For those of you not subscribed to the RubyGems
mailing list, you can find the relevant posts at the following URLs:

http://rubyforge.org/pipermail/rubygems-developers/2007-January/002433.ht=
ml
http://rubyforge.org/pipermail/rubygems-developers/2007-January/002454.ht=
ml
http://rubyforge.org/pipermail/rubygems-developers/2007-January/002459.ht=
ml
http://rubyforge.org/pipermail/rubygems-developers/2007-January/002466.ht=
ml
http://rubyforge.org/pipermail/rubygems-developers/2007-January/002471.ht=
ml

Fair warning: Each post is longer and more detailed than the previous
one, so do yourself a favor and grab a soda or beer before diving in.

PS. I have a mostly working patch for RubyGems that creates a protected
chroot() environment for generating documentation. Since this seems to
be a topic of interest I'll get it clean enough to post for discussion.

Yours,
=20
Tom

--=20
Paul Duncan <[email protected]> pabs in #ruby-lang (OPN IRC)
http://www.pablotron.org/ OpenPGP Key ID: 0x82C29562

--qXCixuLMVvZDruUh
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFFrtKKzdlT34LClWIRAtH5AKCWkLcGO8nL3556o3xzMH1uaDBcAwCdFVHM
7D2xIMVBSh7wTNF11IeG/iM=
=ArAg
-----END PGP SIGNATURE-----

--qXCixuLMVvZDruUh--