Checksums are not stored without internet access

[voxik]

I have this package on my system:

$ gem info minitest

*** LOCAL GEMS ***

minitest (5.26.2)
    Author: Ryan Davis
    Homepage: https://github.com/minitest/minitest
    License: MIT
    Installed at: /builddir/.local/share/gem/ruby

    minitest provides a complete suite of testing facilities supporting
    TDD, BDD, mocking, and benchmarking

This system does not have access to internet:

$ dig www.rubygems.org
;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
;; communications error to ::1#53: connection refused
;; communications error to 127.0.0.1#53: connection refused

; <<>> DiG 9.18.41 <<>> www.rubygems.org
;; global options: +cmd
;; no servers could be reached

$ traceroute www.rubygems.org
www.rubygems.org: Temporary failure in name resolution
Cannot handle "host" cmdline arg `www.rubygems.org' on position 1 (argc 1)

Now trying to lock the gems:

$ cat << EOF > Gemfile                      
source "https://rubygems.org"   

gem "minitest"     
EOF

$ bundle lock --local
Writing lockfile to /builddir/b/Gemfile.lock
Resolving dependencies...

$ cat Gemfile.lock 
GEM
  remote: https://rubygems.org/
  specs:
    minitest (5.26.2)

PLATFORMS
  ruby
  x86_64-linux

DEPENDENCIES
  minitest

CHECKSUMS
  minitest (5.26.2)

BUNDLED WITH
  4.0.0.beta1

And I wonder why the CHECKSUMS section for minitest gem is empty?

[voxik]

Not sure where to put this. Maybe it should be separate discussion. But anyway, I am afraid of the value of CHECKSUM section, for several reasons:

1. For Fedora users, there are multiple sources of gems. One of course is Rubygem.org, but the other more prominent are RPMs
2. Fedora packages typically don't ship with .gem files in cache, which are likely source for the checksums
3. Relying on online presence might be considered problematic. Specifically, Fedora builders don't have internet access and that is how I have come here acutally.

Can the CHECKSUM feature work and reflect the typical Ruby developer as well as Fedora user? The cheap solution would be "lets disable checksums", but that would be loos to everybody. So is there a way Fedora could provide the CHECKSUMS to Bundler by some way?

[tenderlove]

I guess I'm not sure what the value of the CHECKSUM would be to a Fedora user. AFAIK, the checksum feature prevents the case if someone installed minitest, then later someone was able to hack RubyGems and replace the minitest package. In other words, it's trying to make a guarantee that the package installer (bundler) got the same package it did the last time.

But in the Fedora case, if gems are installed via RPM, I would expect RPM to be making those guarantees. There might be a way to get the checksums working for the Fedora case, I'm just trying to understand what value it would add.

[voxik]

Fedora tries to be interoperable. E.g. if you developed app on Mac, handed it over to me (or of course vice versa), what should happen?

But the thing is that also on Fedora, it is expected that there will be used mix of RPMs and upstream gems. E.g. I want to have Nokogiri installed via RPM, because this allows me to not have compiler toolchain on my system. But at the same time, the gem choice on Fedora is limited, therefore it should be fine to install the rest of gems via RubyGems. And of course, two Fedora systems might not have pre-installed the same RPMs, so it might be that I have installed Nokogiri via RPM and someone else don't mind to install Nokogiri from RubyGems.

Generally, I believe that I should get the consistent result doing bundle install, bundle install --local, bundle install --prefer-local, doing it online/offline. So far, there seems to be some surprising behaviors and gaps. And one of the is having CHECKSUM section with entries without actual checksum.

[tenderlove]

Fedora tries to be interoperable. E.g. if you developed app on Mac, handed it over to me (or of course vice versa), what should happen?

Sorry, I don't follow how this is relevant.

But the thing is that also on Fedora, it is expected that there will be used mix of RPMs and upstream gems. E.g. I want to have Nokogiri installed via RPM, because this allows me to not have compiler toolchain on my system. But at the same time, the gem choice on Fedora is limited, therefore it should be fine to install the rest of gems via RubyGems. And of course, two Fedora systems might not have pre-installed the same RPMs, so it might be that I have installed Nokogiri via RPM and someone else don't mind to install Nokogiri from RubyGems.

Yes I understand that. I am trying to understand how the checksum feature helps a user that installed the gems via a package manager that isn't Bundler / RubyGems. AFAICT, that package manager (be it RPM, homebrew, whatever) would be the one providing the guarantee that the sha checksum provides for gems installed via Bundler/RubyGems. How is the checksum feature useful for gems installed via package manager that isn't Bundler / RubyGems?

[tenderlove]

Fundamentally the checksum feature is for guaranteeing the integrity of the gem that was downloaded from RubyGems.org. If the gem was installed by different means, how is the checksum useful or relevant?