Bundler uses rubygems.org to install itself ignoring remote sources configuration

Describe the problem as clearly as you can

Bundler always use rubygems.org to install itself. After bundler 2.3 was released with locking the bundler version we encountered an issue with running bundle install.

Our environment forbids use of rubygems source, we use Nexus repo server instead. Because of this issue #5446 we now locked bundler to 2.3.4 in our projects. We have some machines with latest bundler and access to rubygems.org and it works fine. However in our docker builds we can't use latest bunder, because it trying to download drom rubygems.org by default.
See hardcoded source: https://github.com/rubygems/rubygems/blob/master/bundler/lib/bundler/self_manager.rb#L114

As workaround maybe we can do the following

gem install bundler -v '2.3.4'
export BUNDLER_VERSION='2.3.4' # that disables locking bundler?
bundle install

Did you try upgrading rubygems & bundler?

Yes

Post steps to reproduce the problem

Use docker environment:

FROM ruby:2.7.5
ENV HTTP_PROXY='proxy.company.com:80'
ENV HTTPS_PROXY='proxy.company.com:80'
RUN \
    gem source --clear-all \
    && gem source --remove 'https://rubygems.org/' \
    && gem source --add 'https://nexus.company.com/repository/ruby-gems-group-repo/' \
    && gem update --system

Run bundle init and change bundled with version to 2.3.4, then bundle install

Which command did you run?

bundle install

What were you expecting to happen?

Succesfull installation of bundler 2.3.4 used in Gemfile.lock from used gem source

What actually happened?

Bundler 2.3.12 is running, but your lockfile was generated with 2.3.4. Installing Bundler 2.3.4 and restarting using that version.
Fetching source index from https://rubygems.org/

Retrying fetcher due to error (2/4): Bundler::Fetcher::CertificateFailureError Could not verify the SSL certificate for https://rubygems.org/.
There is a chance you are experiencing a man-in-the-middle attack, but most likely your system doesn't have the CA certificates needed for verification. For information about OpenSSL certificates, see https://railsapps.github.io/openssl-certificate-verify-failed.html. To connect without using SSL, edit your Gemfile sources and change 'https' to 'http'.

...

There was an error installing the locked bundler version (2.3.4), rerun with the `--verbose` flag for more details. Going on using bundler 2.3.12.
The Gemfile specifies no dependencies
Bundle complete! 0 Gemfile dependencies, 1 gem now installed.
Use `bundle info [gemname]` to see where a bundled gem is installed.

If not included with the output of your command, run bundle env and paste the output below

Environment

Bundler       2.3.12
  Platforms   ruby, x86_64-linux
Ruby          2.7.5p203 (2021-11-24 revision f69aeb83146be640995753667fdd6c6f157527f5) [x86_64-linux]
  Full Path   /usr/local/bin/ruby
  Config Dir  /usr/local/etc
RubyGems      3.3.12
  Gem Home    /usr/local/bundle
  Gem Path    /root/.gem/ruby/2.7.0:/usr/local/lib/ruby/gems/2.7.0:/usr/local/bundle
  User Home   /root
  User Path   /root/.gem/ruby/2.7.0
  Bin Dir     /usr/local/bundle/bin
Tools         
  Git         2.30.2
  RVM         not installed
  rbenv       not installed
  chruby      not installed

Bundler Build Metadata

Built At          2022-04-20
Git SHA           75031e03f4
Released Version  true

Bundler settings

app_config
  Set via BUNDLE_APP_CONFIG: "/usr/local/bundle"
silence_root_warning
  Set via BUNDLE_SILENCE_ROOT_WARNING: true

Gemfile

Gemfile

# frozen_string_literal: true

source "https://nexus.company.com/repository/ruby-gems-group-repo/"

# gem "rails"

Gemfile.lock

GEM
  remote: https://nexus.company.com/repository/ruby-gems-group-repo/
  specs:

PLATFORMS
  x86_64-darwin-21
  x86_64-linux

DEPENDENCIES

BUNDLED WITH
   2.3.4

Start at bundler/lib/bundler/self_manager.rb around the hardcoded source at line 114, then reproduce with the provided Docker setup and bundle install command. Done means the locked Bundler version installs from the configured Nexus source instead of rubygems.org.