{"action":"created","issue":{"url":"https://api.github.com/repos/rubygems/rubygems/issues/2313","repository_url":"https://api.github.com/repos/rubygems/rubygems","labels_url":"https://api.github.com/repos/rubygems/rubygems/issues/2313/labels{/name}","comments_url":"https://api.github.com/repos/rubygems/rubygems/issues/2313/comments","events_url":"https://api.github.com/repos/rubygems/rubygems/issues/2313/events","html_url":"https://github.com/rubygems/rubygems/issues/2313","id":330486459,"node_id":"MDU6SXNzdWUzMzA0ODY0NTk=","number":2313,"title":"Explicit use of `--source` should not fallback to other sources","user":{"login":"jacobbednarz","id":283234,"node_id":"MDQ6VXNlcjI4MzIzNA==","avatar_url":"https://avatars2.githubusercontent.com/u/283234?v=4","gravatar_id":"","url":"https://api.github.com/users/jacobbednarz","html_url":"https://github.com/jacobbednarz","followers_url":"https://api.github.com/users/jacobbednarz/followers","following_url":"https://api.github.com/users/jacobbednarz/following{/other_user}","gists_url":"https://api.github.com/users/jacobbednarz/gists{/gist_id}","starred_url":"https://api.github.com/users/jacobbednarz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacobbednarz/subscriptions","organizations_url":"https://api.github.com/users/jacobbednarz/orgs","repos_url":"https://api.github.com/users/jacobbednarz/repos","events_url":"https://api.github.com/users/jacobbednarz/events{/privacy}","received_events_url":"https://api.github.com/users/jacobbednarz/received_events","type":"User","site_admin":false},"labels":[{"id":307374455,"node_id":"MDU6TGFiZWwzMDczNzQ0NTU=","url":"https://api.github.com/repos/rubygems/rubygems/labels/status:%20triage","name":"status: triage","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-08T01:12:09Z","updated_at":"2018-06-15T04:04:46Z","closed_at":null,"author_association":"NONE","body":"This morning I encountered some unexpected behaviour however upon stewing on it for a bit and thinking about it further, I'm unsure if it's an issue or just something to be more conscious of. I thought I'd raise it here and get some additional views on it.\r\n\r\nThe scenario was that I was looking to install a gem from a private repository using `gem install my_gem --source \"https://my.private.gemserver.com\"` however unknown to me at the time, our private gem server was blocking traffic and silently failing requests. I wasn't paying a great deal of attention at the time and the end of the output showed that the gem I was after was successfully installed. A while later, I started debugging why a bunch of the expected functionality wasn't working and eventually I ran a bunch of checksums and found that this wasn't the intended gem.\r\n\r\nThere were a couple of contributing factors here that made this slightly more difficult to identify:\r\n\r\n- Our private gem server was blocking traffic at the time and failing to respond with the required resources. This failure was silent and not apparent without the additional checksums or using using `--vebose` on the `gem install`.\r\n- The gem I was looking to install was named the same as a publicly available gem.\r\n\r\nQuestions:\r\n\r\n- Should calling `gem install` with `--source` be more restrictive on where it gets the requested source gem from? I understand the dependencies may need to come from other sources however would a \"only try in this location for the gem I'm requesting\" policy be useful? Or should this be an additional flag to provide with `--source`?\r\n- Should rubygems fail loudly when the requested source is not returning the expected response and ends up falling back to another? Right now it just moves onto the next source. Here is an example of what I get if the private gem server 403's but is present in rubygems.org. Note: This isn't the gem version (or code) that I am expecting.\r\n\r\n    ```\r\n    $ gem install gem_name --source \"https://my.private.gemserver.com/\"\r\n    Successfully installed gem_name-0.1.2\r\n    1 gem installed\r\n    ```\r\n\r\n    `gem sources -a` makes it very obvious when a source is unavailable.\r\n\r\n    ```\r\n    $ gem source -a \"https://my.private.geserver.com\"\r\n    Error fetching https://my.private.geserver.com: \r\n        bad response Forbidden 403 (https://my.private.geserver.com/specs.4.8.gz)\r\n    ```\r\n- Would it be worth while adding a `--checksum` flag that you could provide an expected checksum and should it mismatch, fail to complete the installation?\r\n\r\nLooking forward to hearing your 2 cents on this!"},"comment":{"url":"https://api.github.com/repos/rubygems/rubygems/issues/comments/397507475","html_url":"https://github.com/rubygems/rubygems/issues/2313#issuecomment-397507475","issue_url":"https://api.github.com/repos/rubygems/rubygems/issues/2313","id":397507475,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzUwNzQ3NQ==","user":{"login":"segiddins","id":1946610,"node_id":"MDQ6VXNlcjE5NDY2MTA=","avatar_url":"https://avatars1.githubusercontent.com/u/1946610?v=4","gravatar_id":"","url":"https://api.github.com/users/segiddins","html_url":"https://github.com/segiddins","followers_url":"https://api.github.com/users/segiddins/followers","following_url":"https://api.github.com/users/segiddins/following{/other_user}","gists_url":"https://api.github.com/users/segiddins/gists{/gist_id}","starred_url":"https://api.github.com/users/segiddins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/segiddins/subscriptions","organizations_url":"https://api.github.com/users/segiddins/orgs","repos_url":"https://api.github.com/users/segiddins/repos","events_url":"https://api.github.com/users/segiddins/events{/privacy}","received_events_url":"https://api.github.com/users/segiddins/received_events","type":"User","site_admin":false},"created_at":"2018-06-15T04:04:46Z","updated_at":"2018-06-15T04:04:46Z","author_association":"MEMBER","body":"Just copy/pasting this from `gem help install` (not saying the way it is now is ideal):\r\n\r\n```\r\n        --clear-sources              Clear the gem sources\r\n    -s, --source URL                 Append URL to list of remote gem sources\r\n```"}}
{"actor":{"display_login":"segiddins"}}