12

In my own gem, I have a Gemfile that looks basically like this:

source 'https://my.gemserver.com'
source 'https://rubygems.org'

gemspec

My .gemspec has all dependencies listed as add_dependency and add_development_dependency.

As of Bundler 1.8, I get the warning:

Warning: this Gemfile contains multiple primary sources. Using `source` more than
once without a block is a security risk, and may result in installing unexpected gems.
To resolve this warning, use a block to indicate which gems should come from the
secondary source. To upgrade this warning to an error,
run `bundle config disable_multisource true`.

Is there a way to resolve this warning (without muting via bundle config)? I cannot find anything about a source option in the Rubygems specification.

sam
  • 40,318
  • 2
  • 41
  • 37
Christoph Petschnig
  • 4,047
  • 1
  • 37
  • 46
  • 2
    Have you tried using a source block like this [example](http://stackoverflow.com/a/25300592)? – O-I Mar 10 '15 at 13:28
  • 2
    The thing is, I don't list my gem dependencies in the Gemfile. They are all listed in the .gemspec. Do I have to duplicate them in the Gemfile? Then what's the point of referring to the gemspec? – Christoph Petschnig Mar 10 '15 at 14:08
  • @ChristophPetschnig [Here](http://yehudakatz.com/2010/12/16/clarifying-the-roles-of-the-gemspec-and-gemfile/) is a nice article on roles that `Gemfile` and `.gemspec` hold. – engineersmnky Mar 10 '15 at 14:41
  • 2
    @engineersmnky Thank you. Still, it talks about avoiding duplication. Using the source block (which makes a lot of sense) means duplication. Also, I am getting more and more doubts on `add_development_dependency` in the .gemspec. I believe this comes from a pre-bundler era and gems there should belong to the Gemfile. – Christoph Petschnig Mar 10 '15 at 15:59

3 Answers3

7

No, you'll either need to mute the warning or add the source block to your Gemfile with the specific gems you want to come from your private server. There isn't a need to duplicate the ones that come from rubygems.org (or you could do it the other way around, if you depend on more private gems than public ones, and your private gems do not themselves depend on public ones).

The problem is that the gemspec format has no support for specifying the source for each gem, so without duplicating them into the Gemfile, there is no way to specify which gems come from each source.

Tim Moore
  • 8,958
  • 2
  • 23
  • 34
6

Kind of sad, but one has to move it out to Gemfile :-(

Gemfile:

source 'https://my.gemserver.com' do
  your_gem1
  your_gem2
  #...
end

source 'https://rubygems.org'

gemspec

but then, if some of your gems should be included in :development or :test group, following could be used

Gemfile:

your_gem1, :source => 'https://my.gemserver.com'
#...
group :development do
  your_gem2, :source => 'https://my.gemserver.com'
  #...
end

source 'https://rubygems.org'

gemspec
Tomasz Nazar
  • 448
  • 6
  • 8
2

To elaborate on the discussion on the bundler issue, as previous answers have stated, you must include the gem in you Gemfile. However, you only need to specify the version of the gem in your .gemspec. If you change versions more often than private dependencies this isn't a terrible solution.

Reference the gem without version in Gemfile:

# Gemfile
source 'https://rubygems.org'

source 'https://xxx@gem.fury.io/me/' do
  gem 'my-private-dependency'
end

gemspec

Reference the gem with version specification in the .gemspec:

# my-gem.gemspec
lib = File.expand_path('../lib', __FILE__)
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)

Gem::Specification.new do |spec|
  spec.add_dependency 'my-private-dependency', '~> 0.1.5'
end
jwadsack
  • 5,708
  • 2
  • 40
  • 50