Formats and running it
A RubyGems mirror for Bundler and gem install
Switch on RubyGems source under Settings, Registries, Package types, add rubygems.org as an upstream, and the box answers /rubygems/ for Bundler and gem install.
Send Bundler through it with a mirror, so every Gemfile keeps source "https://rubygems.org" and nothing in the project changes:
bundle config set --global mirror.https://rubygems.org https://packages.example.com/rubygems/
bundle config set --global packages.example.com your-user-name:"$REPO_TOKEN"For plain gem install, add the box with gem sources --add and remove rubygems.org. gem keeps that address in ~/.gemrc, token included, so use a token made for that machine.
Bundler talks the compact index. Each gem's info file is rebuilt from the lines of its allowed versions, keeping the sha256 the source gave, and a .gem is refused unless it hashes to exactly that. A gem the source lists no checksum for is refused too. Gemspecs are passed on as bytes and never read.
Bundler reads the info of every dependency of every version it weighs, so a gem with nothing allowed answers with an empty version list rather than an error. Only the download of an unapproved gem is refused, with a 451 whose reason Bundler prints, and that opens a request for an approver. Rules take gem requirements like ~> 4.0 or >= 1.2, < 2, and names like rails-*.
What applies, and what does not
Rules, the kill switch, quarantine, cooling off, malware scanning (the OSV known malicious check included), license policy from the gem's license list, requests, auto approve and safe version resolution all apply. Advisories come from OSV's RubyGems feed.
Honest limits: gem push is not taken, so private gems need another home for now. Typosquat checks, provenance checks and the tree walk are not offered for gems.
In short
- Bundler and gem install through the compact index
- A Bundler mirror, so Gemfiles stay as they are
- Info files rebuilt from allowed versions only
- Every
.gemchecked against the source's sha256 - Refusals as a
451Bundler prints, with a request opened - No
gem pushyet
In the documentation
- Set up Bundler Developer Guide
- Set up gem install Developer Guide
- When bundler cannot find a gem Developer Guide
- Gem sources Administrator Guide
Goes well with
- Composer and Packagist proxy Composer through Packagist. Each release is fetched once from its exact commit, scanned and kept.
- Allow lists and block lists Whitelist or blacklist by name, scope, wildcard or version range, for every type. A blocked version is not even listed to the client.
- Malware scanning ClamAV, a hash blocklist, your own scanner and the OpenSSF known malicious feed, on every cached file. Optionally before the first download.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.