dwradcliffe changed the topic of #rubygems-aws to: RubyGems.org Ops | Log: http://irclog.whitequark.org/rubygems-aws | https://github.com/rubygems/rubygems-aws
<dwradcliffe> postmodern: we're using the ubuntu package right now
<dwradcliffe> postmodern: and we'll be building our own packages soon
<postmodern> dwradcliffe, awesome
<dwradcliffe> yeah, rbenv is only used on the jenkins server
<postmodern> dwradcliffe, and is unattended_updates enabled?
<dwradcliffe> I don't think so
<postmodern> dwradcliffe, might want to update and see if libyaml is bumped
<postmodern> it should be at libyaml-0.1.4-3, which contains the security patch
<postmodern> if it's been updated, also restart rubygems.org
<postmodern> this is potentially a very epic vulnerability for anything that handles yaml
<dwradcliffe> fun
<dwradcliffe> let me check
<dwradcliffe> I don't see a new package
<postmodern> ouch
<postmodern> dwradcliffe, what's the plan to mitigate this before an exploit gets written?
<postmodern> dwradcliffe, manually install the debian package, wait for the libyaml-0.1.5 package, wait for canonical?
postmodern has quit [Quit: Leaving]
<dwradcliffe> samkottler: any chance we could get our builds up and running this week?
seanlinsley has quit [Quit: …]
seanlinsley has joined #rubygems-aws
seanlinsley has quit [Client Quit]
seanlinsley has joined #rubygems-aws
mocara1 has joined #rubygems-aws
mocara2 has joined #rubygems-aws
mocara1 has quit [Ping timeout: 250 seconds]
mocara2 has quit [Quit: Leaving.]
mocara1 has joined #rubygems-aws
mocara2 has joined #rubygems-aws
mocara1 has quit [Ping timeout: 245 seconds]
mocara2 has quit [Quit: Leaving.]
mocara1 has joined #rubygems-aws
mocara1 has quit [Quit: Leaving.]
postmodern has joined #rubygems-aws
<postmodern> good news everybody, ubuntu finally updated libyaml
<postmodern> highly suggest you apt-get update and restart rubygems.org to load the new libyaml
<dwradcliffe> awesome
<dwradcliffe> postmodern: updating the package and restarting is enough?
<postmodern> dwradcliffe, yeah
<postmodern> dwradcliffe, the vuln is in libyaml, which psych links to
<dwradcliffe> ok
<postmodern> dwradcliffe, so a restart should pull in the new libyaml code
<dwradcliffe> done
<dwradcliffe> any good way to verify?
<postmodern> probably just checking that you have the updated ubuntu package installed
<postmodern> since canonical just patched libyaml, they didn't bump the version
<postmodern> so Psych::LIBYAML_VERSION will still be 0.1.4
<dwradcliffe> right
<postmodern> but now that we got upstream to release 0.1.5, there should be another update soon