Skip to content

Conversation

@zirni
Copy link

@zirni zirni commented Nov 5, 2025

GitHub's private gem registry expects the first path segment after the host
to represent the namespace, typically the organization or user name. [1]

When adding a source with

  gem sources --add https://user:password@rubygems.pkg.github.com/my-org

without a trailing slash, the last path segment ("my-org") is interpreted as a
file and removed during relative path resolution. This causes the resulting
URI to become

  https://user:password@rubygems.pkg.github.com/gems/foo.gem

instead of the correct

  https://user:password@rubygems.pkg.github.com/my-org/gems/foo.gem. [2]

Example error:

  gem source -a https://user:password@rubygems.pkg.github.com/my-org
  gem install -rf foo.gem
  rubygems/remote_fetcher.rb:238:in `fetch_http': bad response Not Found 404 (https://user:REDACTED@rubygems.pkg.github.com/gems/foo-0.7.1.gem) (Gem::RemoteFetcher::FetchError)

Although this behavior complies with RFC 2396, it's incompatible with GitHub's
gem registry requirements.

The remote fetcher is just append a relative path without using ./ [3]

To address this, we automatically append a trailing slash when adding new gem
sources.

As illustrated in [4] and [5], given the base URI

  http://a/b/c/d;p?q

and a relative path

  g/f

the resolution process replaces "d;p?q" and yields

  http://a/b/c/g/f

[1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry#authenticating-with-a-personal-access-token
[2] https://github.com/ruby/rubygems/blob/master/lib/rubygems/vendor/uri/lib/uri/generic.rb#L1053
[3] https://github.com/ruby/rubygems/blob/master/lib/rubygems/remote_fetcher.rb#L148
[4] https://www.rfc-editor.org/rfc/rfc2396#section-5.2
[5] https://www.rfc-editor.org/rfc/rfc2396#appendix-C

zirni added 2 commits November 5, 2025 11:33
GitHub's private gem registry expects the first path segment after the host
to represent the namespace, typically the organization or user name. [1]

When adding a source with
```
  gem sources --add https://user:password@rubygems.pkg.github.com/my-org
```

without a trailing slash, the last path segment ("my-org") is interpreted as a
file and removed during relative path resolution. This causes the resulting
URI to become
```
  https://user:password@rubygems.pkg.github.com/gems/foo.gem
```

instead of the correct
```
  https://user:password@rubygems.pkg.github.com/my-org/gems/foo.gem. [2]
```

Example error:
```
  gem source -a https://user:password@rubygems.pkg.github.com/my-org
  gem install -rf foo.gem
  rubygems/remote_fetcher.rb:238:in `fetch_http': bad response Not Found 404 (https://user:REDACTED@rubygems.pkg.github.com/gems/foo-0.7.1.gem) (Gem::RemoteFetcher::FetchError)
```

Although this behavior complies with RFC 2396, it's incompatible with GitHub's
gem registry requirements.

The remote fetcher is just append a relative path without using ./ [3]

To address this, we automatically append a trailing slash when adding new gem
sources.

As illustrated in [4] and [5], given the base URI
```
  http://a/b/c/d;p?q
```
and a relative path
```
  g/f
```
the resolution process replaces "d;p?q" and yields
```
  http://a/b/c/g/f
```

[1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry#authenticating-with-a-personal-access-token
[2] https://github.com/ruby/rubygems/blob/master/lib/rubygems/vendor/uri/lib/uri/generic.rb#L1053
[3] https://github.com/ruby/rubygems/blob/master/lib/rubygems/remote_fetcher.rb#L148
[4] https://www.rfc-editor.org/rfc/rfc2396#section-5.2
[5] https://www.rfc-editor.org/rfc/rfc2396#appendix-C
Co-authored-by: Sutou Kouhei <kou@cozmixng.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants