Uploaded image for project: 'Dev - Nexus Repo'
  1. Dev - Nexus Repo
  2. NEXUS-17477

Unable to install hosted gem which has multiple version requirements

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.6.2, 3.12.1, 3.16.1
    • Fix Version/s: 3.21.0
    • Component/s: RubyGems
    • Labels:
    • Environment:
    • Story Points:
      3

      Description

      Bug description

      If a ruby gem is hosted on Sonatype Nexus 3 Rubygems repository

      and that ruby gem contains multiple version requirements for a dependency in its gemspec

      and the project which uses the ruby gem does not have a Gemfile.lock

      Then bundler will fail to install the project gems with the following message:

      jp440p:testproject $ bundle install --path .bundle
      Fetching gem metadata from http://localhost:8081/repository/gems-test/...
      Fetching gem metadata from https://rubygems.org/..............
      Fetching gem metadata from http://localhost:8081/repository/gems-test/..
      Resolving dependencies...
      Fetching concurrent-ruby 1.0.5
      Fetching minitest 5.11.3
      Fetching thread_safe 0.3.6
      Installing minitest 5.11.3
      Installing concurrent-ruby 1.0.5
      Installing thread_safe 0.3.6
      Using bundler 1.16.2
      Fetching tzinfo 1.2.5
      Fetching i18n 1.0.1
      Installing tzinfo 1.2.5
      Installing i18n 1.0.1
      Fetching activesupport 5.2.0
      Installing activesupport 5.2.0
      Fetching test-gem-requirement-bug 0.1.0
      Downloading test-gem-requirement-bug-0.1.0 revealed dependencies not in the API or the lockfile (activesupport (< 5.2, >= 5.0)).
      Either installing with `--full-index` or running `bundle update test-gem-requirement-bug` should fix the problem.
      
      In Gemfile:
        test-gem-requirement-bug
      

       

      We noticed this bug on our production ruby gem repositories (hosted on Sonatype Nexus3 v3.6.2) then I reproduced with the latest version of SNRM : v3.12.1

       

      This issue has been reported on bundler github (see https://github.com/bundler/bundler/issues/6048 ). The original bug report mentions Sonatype Nexus but was closed without having been properly investigated.

       

      Reproducing the bug

       

      Nexus Setup

       

      I installed an instance of Sonatype Nexus3 using docker like this:

      docker run --name nexus3 -d -v /data/nexus-data:/nexus-data -p 8081:8081 -e INSTALL4J_ADD_VM_PARAMS="-Xms1536M -Xmx1536M -XX:MaxDirectMemorySize=2g" sonatype/nexus3:3.12.1

      Once the instance has booted, I open http://localhost:8081 with browser, log to nexus using default credentials (admin/admin123), then I create a hosted rubygems repository which I name "gems-test".

      The URL of the gems-test repository on the local nexus is http://localhost:8081/repository/gems-test/

       

      Test ruby gem

       

      I generated a sample ruby gem using the `bundle gem test-gem-requirement-bug` command on my workstation.

       

      I edited the generate gem to supply the following gemspec:

      lib = File.expand_path("../lib", __FILE__)
      $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
      require "test/gem/requirement/bug/version"
      
      Gem::Specification.new do |spec|
        spec.name          = "test-gem-requirement-bug"
        spec.version       = Test::Gem::Requirement::Bug::VERSION
        spec.authors       = ["Julien Pervillé"]
        spec.email         = ["julien.perville@perfect-memory.com"]
      
        spec.summary       = %q{Attempts to reproduce a bug with gem requirement parsing}
        spec.homepage      = 'https://rubygems.org'
      
        # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
        # to allow pushing to a single host or delete this section to allow pushing to any host.
        if spec.respond_to?(:metadata)
          spec.metadata["allowed_push_host"] = "https://rubygems.org"
        else
          raise "RubyGems 2.0 or newer is required to protect against " \
            "public gem pushes."
        end
      
        # Specify which files should be added to the gem when it is released.
        # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
        spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
          `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
        end
        spec.bindir        = "exe"
        spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
        spec.require_paths = ["lib"]
      
        spec.add_runtime_dependency "activesupport", ">= 5.0", "< 5.2"
      end
      

       

      Note the multiple version requirement on the activesupport dependency above.

       

      Then I `gem build *gemspec` to produce the gem.

       

      Then I upload the produced gem to Nexus using the upload interface at http://localhost:8081/#browse/upload:gems-test

       

      If everything was successful the ruby gem should be listed in the "browse" view of the gems-test repository (URL http://localhost:8081/#browse/browse:gems-test )

      Test ruby project

       

      I create a sample ruby project on my workstation, which uses the "test-gem-requirement-bug" gem.

       

      
      mkdir testproject
      cd testproject
      cat <<EOF > Gemfile
      source 'https://rubygems.org'
      
      source 'http://localhost:8081/repository/gems-test/' do
        gem 'test-gem-requirement-bug', '~> 0.1.0'
      end
      EOF

       

      Then, still in the testproject directory, I run:

      
      bundle install --path .bundle

       

      To install the project dependencies.

       

      The "bundle install" command fails with the trace at the top of project.

       

       

       

      Note that running "bundle install --path .bundle --full-index" succeeds to install the gem and its dependencies (even if it is inefficient).

       

       

       

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              mmartz Michael Martz
              Reporter:
              jperville Julien Pervillé
              Last Updated By:
              Ophelia Hernandez
              Team:
              NXRM - Neo
              Votes:
              8 Vote for this issue
              Watchers:
              14 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Date of First Response:

                  tigCommentSecurity.panel-title