[DRE-maint] Bug#1109407: unblock: puma/6.6.0-3

[Timo Röhling]

Package: release.debian.org
Severity: normal
X-Debbugs-Cc: puma at packages.debian.org, Debian Ruby Team <pkg-ruby-extras-maintainers at lists.alioth.debian.org>
Control: affects -1 + src:puma
User: release.debian.org at packages.debian.org
Usertags: unblock

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Please unblock package puma

[ Reason ]
Fix for RC bug #1078640

[ Impact ]
Without the fix, the package will start to FTBFS in August 2028.

[ Tests ]
I rebuilt the package and verified that the test suite passes with the
regenerated TLS certificates.

[ Risks ]
Regnerating the TLS certificates requires a few additional build 
dependencies, which I annotated with <!nocheck>. Apart from that, the 
fix is very simple and just involves calling an upstream-provided script
to generate the certificates from d/rules.

[ Checklist ]
  [x] all changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in testing

[ Other info ]
The upload happened with permission by Pirate Praveen.

unblock puma/6.6.0-3


-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmwPruYMA35fCsSO/zIxr3RQD9MoFAmh4Bs8ACgkQzIxr3RQD
9MqIug//Qj1yrMDrQAwdNOqHUlLLyQ9iyvZ5K64iXPR449FFb/+gECePVpE/iVVg
JVJPtg7aC5d2u5WiN8UiE9FiS4gunkbfh0OnX6G3d6Fh9ZV7YIqxbb9fNe8Cbyhh
hBYHEcIixQE2ERzln89UKG+JFOCGA71pOELGzLIA4MvDFhDqsHFA2EOSOcQIgWNd
e2+fqoz7ZO5Wh9Pr9JAPsAqSlFFqpVuQ8ArpGBfbppiFxXqu0FHn9oksI9MpI836
nFrXRdzWu85hOvgsLA+CJ70Mlbo/gth239lapIvxt/p/ET18DGT7kbYVaeoIC1EI
6MbNILWEgzC2q4NSGEmbE9qfbHFSWkEyBbHB5peBE+v1KBGcw8c5H77f8JWZWZtM
15e0GJG+cFJYKT7T8gZxQjgXIRoaooxugf5n9oxa82lLWIt1qywxvfkmKRIT6JQl
t8brRcmSvacRAj5OL2Mxs3RGC4KaeaVStoydS5aQ6R7nAc5TUa2+B3PqIrgfALWs
rHE0r/7iHS3bDdxXqgrPplMQPRK+9rLi8M8I2vYIup5gf/0MQU3MlVnIwCyHiZdH
0RBNUGOlgO1TYjYe4Xsc6FgdS3BW4dKKXeGO7Ln3EMDp42hzHIAmPcG7DlkCMIPo
oLUerXaVO3YKqMYSF1Vt+Muzxsx4FQlDLY+odJOG0U9juQOTu2Y=
=gbxu
-----END PGP SIGNATURE-----
-------------- next part --------------
diff --git a/debian/changelog b/debian/changelog
index 8ee3619..1a585df 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+puma (6.6.0-3) unstable; urgency=medium
+
+  * Team upload.
+  * Freshly generate example certificates for test suite (Closes: #1078640)
+
+ -- Timo R?hling <roehling at debian.org>  Wed, 16 Jul 2025 21:51:16 +0200
+
 puma (6.6.0-2) unstable; urgency=medium
 
   * Team upload
diff --git a/debian/control b/debian/control
index 659a047..136a764 100644
--- a/debian/control
+++ b/debian/control
@@ -16,7 +16,10 @@ Build-Depends: curl,
                ruby-nio4r (>= 2),
                ruby-rack,
                ruby-rackup | ruby-rack (<< 3),
-               ruby-sd-notify
+               ruby-sd-notify,
+	       default-jre-headless <!nocheck>,
+	       openssl <!nocheck>,
+	       ruby-certificate-authority <!nocheck>,
 Standards-Version: 4.7.0
 Vcs-Git: https://salsa.debian.org/ruby-team/puma.git
 Vcs-Browser: https://salsa.debian.org/ruby-team/puma
diff --git a/debian/patches/0019-do-not-download-ca-gem.patch b/debian/patches/0019-do-not-download-ca-gem.patch
new file mode 100644
index 0000000..eb900fb
--- /dev/null
+++ b/debian/patches/0019-do-not-download-ca-gem.patch
@@ -0,0 +1,24 @@
+From: =?utf-8?q?Timo_R=C3=B6hling?= <roehling at debian.org>
+Date: Wed, 16 Jul 2025 18:35:43 +0200
+Subject: Do not download certificate_authority gem
+
+---
+ examples/generate_chain_test.rb | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/examples/generate_chain_test.rb b/examples/generate_chain_test.rb
+index 2676760..dbe89ab 100644
+--- a/examples/generate_chain_test.rb
++++ b/examples/generate_chain_test.rb
+@@ -11,10 +11,7 @@ certs before date will be the first of the current month
+ =end
+ 
+ require 'bundler/inline'
+-gemfile(true) do
+-  source 'https://rubygems.org'
+-  gem 'certificate_authority'
+-end
++require 'certificate_authority'
+ 
+ module GenerateChainCerts
+ 
diff --git a/debian/patches/series b/debian/patches/series
index c5b71d5..4294a58 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@
 0017-disable-test-failing-on-armhf.patch
 0018-disable-test-failing-with-ruby3.2.patch
 0010-Disable-test-concurrency-without-concurrent_ruby.patch
+0019-do-not-download-ca-gem.patch
diff --git a/debian/rules b/debian/rules
index da15652..5951199 100755
--- a/debian/rules
+++ b/debian/rules
@@ -12,3 +12,12 @@ export TEST_CASE_TIMEOUT = 300
 
 override_dh_installchangelogs:
 	dh_installchangelogs History.md
+
+EXAMPLES_CERT_DIR = examples/puma
+execute_before_dh_auto_test:
+	cp -r $(EXAMPLES_CERT_DIR) $(EXAMPLES_CERT_DIR).upstream
+	examples/generate_all_certs
+
+execute_before_dh_clean:
+	if test -d $(EXAMPLES_CERT_DIR).upstream; then rm -r $(EXAMPLES_CERT_DIR) && mv $(EXAMPLES_CERT_DIR).upstream $(EXAMPLES_CERT_DIR); fi
+