Gemcutter.org as a RubyGem source scares me

http://stream.btucker.org/post/211562256/gemcutter-as-a-rubygem-source-scares-me

by btucker • 17 years ago

13 9 17 years ago

stream.btucker.org

rufo2• 17 years ago

This is dealt with in the FAQ - but the short answer is that Gemcutter mirrors all gems from RubyForge. If you want to push directly to Gemcutter instead of letting Gemcutter mirror it, you need to go through a migration process to verify you are the owner.

So no, you can't just upload a gem titled "rails" to Gemcutter and have it override the Rails team's gems.

btucker2• 17 years ago

But is that also true for previously github-hosted gems? Can I push a gem called 'why-hpricot' for example?

rufo2• 17 years ago

Is there any reason you can't post a gem called why-hpricot to RubyForge and have it override GitHub?

This doesn't seem like a new problem to me. If this concerns you, just edit the sources list of your .gemrc file manually and make sure RubyForge is at the top and Gemutter is at the bottom.

pjhyett• 17 years ago

We added code at least a year ago to prevent people from building gems with the name of a gem already hosted on rubyforge. That being said, the rubygem library itself really needs some type of namespacing solution to solve the problem once and for all instead of requiring gem hosts to implement hacks like we did. Fortunately, I've heard rumblings that they may be working on something.

melito• 17 years ago

Heh, if you think that is wild and crazy, a long time ago the 'script/plugin' command in Rails pulled its' svn sources from a public wiki that anyone could edit.

mattmcknight• 17 years ago

I enjoy how RubyForge is run by RubyCentral. I don't know if this is the long term replacement for gem hosting, but it would be good if there were some sort of (hopefully transparent) organization behind the service (beyond a temporary alliance of companies) to guarantee funding.

qrush2• 17 years ago

I've been talking to RubyCentral about supporting the project, patience has been key here.

More details on what I want to do: http://rubyforge.org/pipermail/rubygems-developers/2009-Augu...

qrush2• 17 years ago

To be honest, the same problem exists for RubyForge, since you could build/release a gem with a user name prefix and it doesn't check.

The short answer is: be explicit with what source you're looking at, and start looking into gem signing/certs since it's the way we can trust gems.

More info here: http://litanyagainstfear.com/blog/2009/10/09/on-gem-forking/

*Edit: Looks like rufo already cleared this up...thanks man!

Gemcutter.org as a RubyGem source scares me

Related Stories