【发布时间】:2015-02-17 08:54:37
【问题描述】:
在我的 Gemfile 中,我需要来自自定义来源的 gem,其中包含以下行:
gem 'very-secret-gem', source:'https://foo.example.com/'
bundle install 可以正常完成:
$ bundle install
Fetching source index from https://foo.example.com/
Fetching source index from https://foo.example.com/
Fetching gem metadata from https://rubygems.org/........
…
Resolving dependencies...
…
Installing very-secret-gem 1.5.1
…
Bundle complete! 47 Gemfile dependencies, 116 gems now installed.
Use `bundle show [gemname]` to see where a bundled gem is installed.
但运行使用 ruby 的命令失败(此处为空 Rakefile):
$ bundle exec rake -T
Could not find gem 'very-secret-gem (>= 0) ruby' in rubygems repository https://foo.example.com/.
Source does not contain any versions of 'very-secret-gem (>= 0) ruby'
Run `bundle install` to install missing gems.
此时按照错误消息中的建议运行 bundle install 将无济于事。
为什么会这样,如何解决?
如果我在源代码块中指定 gem,它同样会失败:
source 'https://foo.example.com/' do
gem 'very-secret-gem'
end
更有趣的是,如果我在文件开头指定源,而不是绑定到任何 gem,它可以正常工作:
source 'https://rubygems.org'
source 'https://foo.example.com/'
gem 'very-secret-gem'
...但是 bundler 建议不要这样做:
Warning: this Gemfile contains multiple primary sources. Using `source`
more than once without a block is a security risk, and may result in
installing unexpected gems. To resolve this warning, use a block to
indicate which gems should come from the secondary source. To upgrade
this warning to an error, run `bundle config disable_multisource true`.
版本:
$ ruby -v # => ruby 2.2.0p0 (2014-12-25 revision 49005) [x86_64-darwin14]
$ gem -v # => 2.4.5
$ bundle -v # => Bundler version 1.8.2
更新
看起来像一个打包程序错误。另一个gem 和:path 的存在似乎是触发它的原因。一个测试应用在这里:https://github.com/kch/bundler-source-bug
此处捆绑器的 GH 问题:https://github.com/bundler/bundler/issues/3417
【问题讨论】:
-
进一步调查使我怀疑 bundler 中存在一个错误,涉及另一个需要使用
:path的 gem -
您好,您是否向 Bundler 填写了错误?如果是这样,您能否提供相关问题的链接,以便我可以关注更新?我打开了issue about this on Rails assets,我想链接到相关的 Bundler 问题(如果有)