Explicit use of `--source` should not fallback to other sources

This morning I encountered some unexpected behaviour however upon stewing on it for a bit and thinking about it further, I'm unsure if it's an issue or just something to be more conscious of. I thought I'd raise it here and get some additional views on it.

The scenario was that I was looking to install a gem from a private repository using gem install my_gem --source "https://my.private.gemserver.com" however unknown to me at the time, our private gem server was blocking traffic and silently failing requests. I wasn't paying a great deal of attention at the time and the end of the output showed that the gem I was after was successfully installed. A while later, I started debugging why a bunch of the expected functionality wasn't working and eventually I ran a bunch of checksums and found that this wasn't the intended gem.

There were a couple of contributing factors here that made this slightly more difficult to identify:

• Our private gem server was blocking traffic at the time and failing to respond with the required resources. This failure was silent and not apparent without the additional checksums or using using --vebose on the gem install.
• The gem I was looking to install was named the same as a publicly available gem.

Questions:

• Should calling gem install with --source be more restrictive on where it gets the requested source gem from? I understand the dependencies may need to come from other sources however would a "only try in this location for the gem I'm requesting" policy be useful? Or should this be an additional flag to provide with --source?

• Should rubygems fail loudly when the requested source is not returning the expected response and ends up falling back to another? Right now it just moves onto the next source. Here is an example of what I get if the private gem server 403's but is present in rubygems.org. Note: This isn't the gem version (or code) that I am expecting.

  $ gem install gem_name --source "https://my.private.gemserver.com/"
  Successfully installed gem_name-0.1.2
  1 gem installed
  

  gem sources -a makes it very obvious when a source is unavailable.

  $ gem source -a "https://my.private.geserver.com"
  Error fetching https://my.private.geserver.com: 
      bad response Forbidden 403 (https://my.private.geserver.com/specs.4.8.gz)
  

• Would it be worth while adding a --checksum flag that you could provide an expected checksum and should it mismatch, fail to complete the installation?

Looking forward to hearing your 2 cents on this!

Start by reproducing the reported gem install my_gem --source behavior with an unavailable private source and a matching public gem, then compare it with gem sources -a and verbose output. The issue presents several possible policies, so the desired behavior and completion criteria need to be decided before implementation.