ruby / ruby/rubygems

Checksums are not stored without internet access

Open
#9,119 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bundler
Dominant language
Ruby
Stars
4k
Forks
1.9k
Avg merge
1d 2h
Merged PRs (30d)
81

Description

I have this package on my system:

$ gem info minitest

*** LOCAL GEMS ***

minitest (5.26.2)
    Author: Ryan Davis
    Homepage: https://github.com/minitest/minitest
    License: MIT
    Installed at: /builddir/.local/share/gem/ruby

    minitest provides a complete suite of testing facilities supporting
    TDD, BDD, mocking, and benchmarking

This system does not have access to internet:

$ dig www.rubygems.org
;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused

; <<>> DiG 9.18.41 <<>> www.rubygems.org
;; global options: +cmd
;; no servers could be reached

$ traceroute www.rubygems.org
www.rubygems.org: Temporary failure in name resolution
Cannot handle "host" cmdline arg `www.rubygems.org' on position 1 (argc 1)

Now trying to lock the gems:

$ cat << EOF > Gemfile                      
source "https://rubygems.org"   

gem "minitest"     
EOF

$ bundle lock --local
Writing lockfile to /builddir/b/Gemfile.lock
Resolving dependencies...

$ cat Gemfile.lock 
GEM
  remote: https://rubygems.org/
  specs:
    minitest (5.26.2)

PLATFORMS
  ruby
  x86_64-linux

DEPENDENCIES
  minitest

CHECKSUMS
  minitest (5.26.2)

BUNDLED WITH
  4.0.0.beta1

And I wonder why the CHECKSUMS section for minitest gem is empty?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reported Gemfile and reproduce the behavior using bundle lock --local without internet access; inspect how that command generates the CHECKSUMS section in Gemfile.lock. Done means the checksum behavior is explained and, if it is a bug, the resulting lockfile contains the expected checksum data with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.