Using the same source domain with different permissions configurations confuses Bundler.

Describe the problem as clearly as you can

Given a Gemfile that uses the same source domain but with different access tokens, a la:

gem 'public_gem', source: 'https://repo.fury.io/some_org/'
gem 'private_gem', source: 'https://some_token@repo.fury.io/some_org/'

We wind up with with this in our Gemfle.lock:

GEM
  remote: https://repo.fury.io/some_org/
  specs:
    private_gem (1.2.3)
    public_gem (1.2.3)

GEM
  remote: https://repo.fury.io/some_org/
  specs:
    private_gem (1.2.3)
    public_gem (1.2.3)

Did you try upgrading rubygems & bundler?

Yes.

Post steps to reproduce the problem

Ruby 3.1.6 is installed on macOS via rbenv / ruby-build.

~/.bundle/config:

---
BUNDLE_GEM__COC: "false"
BUNDLE_GEM__MIT: "false"
BUNDLE_GEM__TEST: "rspec"
BUNDLE_SPECIFIC_PLATFORM: "true"
#BUNDLE_LOCAL__FLUENT___PLUGIN___SQL___ENHANCED: "/Users/jfrisby/thryve/fluent-plugin-sql-enhanced"
BUNDLE_BUILD__FFI: "--with-cflags=-Wno-implicit-function-declaration"
BUNDLE_FORCE_RUBY_PLATFORM: "true"

~/.gemrc:

---
:backtrace: false
:benchmark: false
:bulk_threshold: 1000
:sources:
- http://rubygems.org/
:update_sources: true
:verbose: true
install: --no-document --no-wrappers
update: --no-document --no-wrappers
gem: --no-document

There is no project-local .bundle/ or other such configuration.

Have a Gemfile, as indicated above, and run bundle.

Which command did you run?

bundle

What were you expecting to happen?

I would've expected something like:

GEM
  remote: https://some_token@repo.fury.io/some_org/
  specs:
    private_gem (1.2.3)

GEM
  remote: https://repo.fury.io/some_org/
  specs:
    public_gem (1.2.3)

... or at least, only one GEM block for the source.

What actually happened?

See snippet of Gemfile.lock above.

If not included with the output of your command, run bundle env and paste the output below

Environment

Bundler       2.6.3
  Platforms   ruby, arm64-darwin-23
Ruby          3.1.6p260 (2024-05-29 revision a777087be612b7675fe012560bf0d8fddff20f55) [arm64-darwin-23]
  Full Path   /Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/bin/ruby
  Config Dir  /Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/etc
RubyGems      3.6.3
  Gem Home    /Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/gemsets/ironwood
  Gem Path    /Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/gemsets/ironwood:/Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/gemsets/global:/Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/lib/ruby/gems/3.1.0
  User Home   /Users/jonathonfrisby
  User Path   /Users/jonathonfrisby/.gem/ruby/3.1.0
  Bin Dir     /Users/jonathonfrisby/.rbenv/versions/ruby-3.1.6/gemsets/ironwood/bin
Tools         
  Git         2.48.1
  RVM         not installed
  rbenv       rbenv 1.3.2
  chruby      not installed

Bundler Build Metadata

Built At          2025-01-16
Git SHA           3c7c4ff2d8f
Released Version  true

Bundler settings

build.ffi
  Set for the current user (/Users/jonathonfrisby/.bundle/config): "--with-cflags=-Wno-implicit-function-declaration"
force_ruby_platform
  Set for the current user (/Users/jonathonfrisby/.bundle/config): true
gem.coc
  Set for the current user (/Users/jonathonfrisby/.bundle/config): false
gem.mit
  Set for the current user (/Users/jonathonfrisby/.bundle/config): false
gem.test
  Set for the current user (/Users/jonathonfrisby/.bundle/config): "rspec"
specific_platform
  Set for the current user (/Users/jonathonfrisby/.bundle/config): "true"

Gemfile

Gemfile

# frozen_string_literal: true

source 'https://rubygems.org'

group :development do
  gem 'bundler-audit', '~> 0.9.0', require: false
  gem 'foreman', '~> 0.87.2', require: false

  gem 'teak-dev', '~> 0.1', require: false, source: 'https://repo.fury.io/alexsc/'
  gem 'rubocop-sequel', '~> 0.3', require: false
end

group :test do
  gem 'rspec', '~> 3.11', require: false
  gem 'rack-test', require: false
  gem 'rspec_junit_formatter', '~> 0.6.0', require: false
  gem 'simplecov', '~> 0.22.0', require: false
  gem 'webmock', '~> 3.24', require: false
end

gem 'core_app', '~> 0.12.0', source: 'https://SOME_TOKEN@repo.fury.io/alexsc/'
gem 'curb', '~> 1.0.6'
gem 'get_process_mem', '~> 0.2.8', require: false, git: 'https://github.com/GoCarrot/get_process_mem'
gem 'mysql2', '~> 0.5.6'
gem 'newrelic_rpm', '~> 8.6', require: false
gem 'oj', '~> 3.13', '>= 3.13.11'
gem 'rake', '~> 13.0', '>= 13.0.6', require: false
gem 'redis-namespace', '~> 1.8', '>= 1.8.2', require: false
gem 'sentry-ruby', '~> 5.2', '>= 5.2.1', require: false
gem 'sentry-sidekiq', '~> 5.3', require: false
gem 'sidekiq', '~> 6.4', '>= 6.4.1'
gem 'unicorn', '~> 6', require: false
gem 'unicorn-worker-killer-2', require: false, git: 'https://github.com/GoCarrot/unicorn-worker-killer-2'

Gemfile.lock

GIT
  remote: https://github.com/GoCarrot/get_process_mem
  revision: 84bc86e2751b9ea14949cdeac287794fefb8ecf4
  specs:
    get_process_mem (0.2.8)
      ffi (~> 1.0)

GIT
  remote: https://github.com/GoCarrot/unicorn-worker-killer-2
  revision: 5be2b5114bcdf4f36d9f1096e4b03f6a5fe125dc
  specs:
    unicorn-worker-killer-2 (1.0.1)
      get_process_mem (~> 0)
      unicorn (>= 4)

GEM
  remote: https://repo.fury.io/alexsc/
  specs:
    core_app (0.12.0)
      activesupport
      oauth2
      oj
      rack-health
      rack-ssl
      sd_notify
      sequel
      sequel-json
      sinatra
      sinatra-cross_origin
      sinatra-param
      warden
    teak-dev (0.1.0)
      bundler-audit (~> 0.9.2)
      rubocop (~> 1.71, >= 1.71.1)
      rubocop-performance (~> 1.23, >= 1.23.1)
      rubocop-rake (~> 0.6.0)
      rubocop-rspec (~> 3.4)

GEM
  remote: https://repo.fury.io/alexsc/
  specs:
    core_app (0.12.0)
      activesupport
      oauth2
      oj
      rack-health
      rack-ssl
      sd_notify
      sequel
      sequel-json
      sinatra
      sinatra-cross_origin
      sinatra-param
      warden
    teak-dev (0.1.0)
      bundler-audit (~> 0.9.2)
      rubocop (~> 1.71, >= 1.71.1)
      rubocop-performance (~> 1.23, >= 1.23.1)
      rubocop-rake (~> 0.6.0)
      rubocop-rspec (~> 3.4)

GEM
  remote: https://rubygems.org/
  specs:
    activesupport (7.1.5.1)
      base64
      benchmark (>= 0.3)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
      logger (>= 1.4.2)
      minitest (>= 5.1)
      mutex_m
      securerandom (>= 0.3)
      tzinfo (~> 2.0)
    addressable (2.8.0)
      public_suffix (>= 2.0.2, < 5.0)
    ast (2.4.2)
    base64 (0.2.0)
    benchmark (0.4.0)
    bigdecimal (3.1.9)
    bundler-audit (0.9.2)
      bundler (>= 1.2.0, < 3)
      thor (~> 1.0)
    concurrent-ruby (1.2.3)
    connection_pool (2.4.1)
    crack (0.4.5)
      rexml
    curb (1.0.6)
    diff-lcs (1.5.1)
    docile (1.4.1)
    drb (2.2.1)
    faraday (2.12.2)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
    faraday-net_http (3.4.0)
      net-http (>= 0.5.0)
    ffi (1.15.5)
    foreman (0.87.2)
    hashdiff (1.1.2)
    hashie (5.0.0)
    i18n (1.14.7)
      concurrent-ruby (~> 1.0)
    json (2.9.1)
    jwt (2.10.1)
      base64
    kgio (2.11.4)
    language_server-protocol (3.17.0.4)
    logger (1.6.5)
    minitest (5.25.4)
    multi_xml (0.7.1)
      bigdecimal (~> 3.1)
    mustermann (3.0.3)
      ruby2_keywords (~> 0.0.1)
    mutex_m (0.3.0)
    mysql2 (0.5.6)
    net-http (0.6.0)
      uri
    newrelic_rpm (8.9.0)
    oauth2 (2.0.9)
      faraday (>= 0.17.3, < 3.0)
      jwt (>= 1.0, < 3.0)
      multi_xml (~> 0.5)
      rack (>= 1.2, < 4)
      snaky_hash (~> 2.0)
      version_gem (~> 1.1)
    oj (3.13.19)
    parallel (1.26.3)
    parser (3.3.7.0)
      ast (~> 2.4.1)
      racc
    public_suffix (4.0.7)
    racc (1.8.1)
    rack (2.2.10)
    rack-health (0.1.2)
      rack (>= 1.2.0)
    rack-protection (3.2.0)
      base64 (>= 0.1.0)
      rack (~> 2.2, >= 2.2.4)
    rack-ssl (1.4.1)
      rack
    rack-test (2.2.0)
      rack (>= 1.3)
    rainbow (3.1.1)
    raindrops (0.20.0)
    rake (13.0.6)
    redis (4.8.1)
    redis-namespace (1.8.2)
      redis (>= 3.0.4)
    regexp_parser (2.10.0)
    rexml (3.4.0)
    rspec (3.13.0)
      rspec-core (~> 3.13.0)
      rspec-expectations (~> 3.13.0)
      rspec-mocks (~> 3.13.0)
    rspec-core (3.13.2)
      rspec-support (~> 3.13.0)
    rspec-expectations (3.13.3)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
    rspec-mocks (3.13.2)
      diff-lcs (>= 1.2.0, < 2.0)
      rspec-support (~> 3.13.0)
    rspec-support (3.13.2)
    rspec_junit_formatter (0.6.0)
      rspec-core (>= 2, < 4, != 2.12.0)
    rubocop (1.71.1)
      json (~> 2.3)
      language_server-protocol (>= 3.17.0)
      parallel (~> 1.10)
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 2.9.3, < 3.0)
      rubocop-ast (>= 1.38.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
    rubocop-ast (1.38.0)
      parser (>= 3.3.1.0)
    rubocop-performance (1.23.1)
      rubocop (>= 1.48.1, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
    rubocop-rake (0.6.0)
      rubocop (~> 1.0)
    rubocop-rspec (3.4.0)
      rubocop (~> 1.61)
    rubocop-sequel (0.3.8)
      rubocop (~> 1.0)
    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
    sd_notify (0.1.1)
    securerandom (0.4.1)
    sentry-ruby (5.3.1)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      sentry-ruby-core (= 5.3.1)
    sentry-ruby-core (5.3.1)
      concurrent-ruby
    sentry-sidekiq (5.3.1)
      sentry-ruby-core (~> 5.3.1)
      sidekiq (>= 3.0)
    sequel (5.88.0)
      bigdecimal
    sequel-json (0.0.1)
      sequel
      yajl-ruby
    sidekiq (6.5.12)
      connection_pool (>= 2.2.5, < 3)
      rack (~> 2.0)
      redis (>= 4.5.0, < 5)
    simplecov (0.22.0)
      docile (~> 1.1)
      simplecov-html (~> 0.11)
      simplecov_json_formatter (~> 0.1)
    simplecov-html (0.13.1)
    simplecov_json_formatter (0.1.4)
    sinatra (3.2.0)
      mustermann (~> 3.0)
      rack (~> 2.2, >= 2.2.4)
      rack-protection (= 3.2.0)
      tilt (~> 2.0)
    sinatra-cross_origin (0.4.0)
    sinatra-param (1.6.0)
      sinatra (>= 1.3)
    snaky_hash (2.0.1)
      hashie
      version_gem (~> 1.1, >= 1.1.1)
    thor (1.3.2)
    tilt (2.6.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
    unicode-display_width (3.1.4)
      unicode-emoji (~> 4.0, >= 4.0.4)
    unicode-emoji (4.0.4)
    unicorn (6.1.0)
      kgio (~> 2.6)
      raindrops (~> 0.7)
    uri (1.0.2)
    version_gem (1.1.4)
    warden (1.2.9)
      rack (>= 2.0.9)
    webmock (3.24.0)
      addressable (>= 2.8.0)
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
    yajl-ruby (1.4.3)

PLATFORMS
  ruby

DEPENDENCIES
  bundler-audit (~> 0.9.0)
  core_app (~> 0.12.0)!
  curb (~> 1.0.6)
  foreman (~> 0.87.2)
  get_process_mem (~> 0.2.8)!
  mysql2 (~> 0.5.6)
  newrelic_rpm (~> 8.6)
  oj (~> 3.13, >= 3.13.11)
  rack-test
  rake (~> 13.0, >= 13.0.6)
  redis-namespace (~> 1.8, >= 1.8.2)
  rspec (~> 3.11)
  rspec_junit_formatter (~> 0.6.0)
  rubocop-sequel (~> 0.3)
  sentry-ruby (~> 5.2, >= 5.2.1)
  sentry-sidekiq (~> 5.3)
  sidekiq (~> 6.4, >= 6.4.1)
  simplecov (~> 0.22.0)
  teak-dev (~> 0.1)!
  unicorn (~> 6)
  unicorn-worker-killer-2!
  webmock (~> 3.24)

BUNDLED WITH
   2.6.3

Start by reproducing the issue with the provided Gemfile and bundle command, then trace how Bundler handles sources with the same domain but different access tokens and writes Gemfile.lock. Done means the lockfile no longer contains confusing duplicate GEM blocks and preserves the required source configuration.