RubyGems Blog

Post-Mortem of Today's Partial Outage

2013-04-06T00:00:00-07:00

Over a period of around 12 hours, from late last night (April 5th) eastern US time until approximately 10:45am this morning there was a partial outage of Rubygems.org. The root disk on the application server filled up completely because of some logs that didn’t get rotated. This prevented new account signups, password resets, and gem pushes from taking place. I’m sorry that this happened and will personally ensure steps are taken to alert the Rubygems.org operations team before outages of this nature happen again.

Right now there isn’t systems monitoring in place for the servers that run Rubygems.org, which makes debugging issues very difficult without accessing a remote machine and manually surfacing the problem. We were planning on deploying the Datadog agent onto the instances tonight even before this incident. In tandem with Pagerduty, Datadog will allow us to setup an on-call schedule for those contributors with access to the infrastructure. We’ll also be taking a look at the logrotate configurations and tune them appropriately to prevent disks from filling up in the future.

I’m very sorry this happened and prevented gem maintainers from being able to effectively use the service.

New blog design

2013-03-18T00:00:00-07:00

We have a brand new blog design courtesy of thoughtbot and Edwin Morris!

Some neat facts about this design:

The code for the blog is all open source and content is Creative Commons licensed.
It’s now responsive, so it will look great on any device!
It’s a great example for using Bourbon, a simple set of SCSS mixins
All generated with no Jekyll plugins!

Huge thanks to thoughtbot for a continued commitment to making RubyGems awesome.

2.0.3 Released

2013-03-11T00:00:00-07:00

RubyGems 2.0.3 is a bug-fix release. To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

If you installed 2.0.1 and are unable to upgrade please follow the how to upgrade/downgrade RubyGems instructions.

Bug fixes:

Reverted automatic upgrade to HTTPS as it breaks RubyGems APIs. Fixes #506 by André Arko
Use File.realpath to remove extra / while checking if files are installable. Issue #508 by Jacob Evans.
When installing RubyGems on JRuby, the standard library is no longer deleted. Fixes #504 by Juan Sanchez, #507 by Charles Oliver Nutter.
When building extconf.rb extensions use the intermediate destination directory. This addresses further issues with C extension building.
Use the absolute path to the generated siteconf in case the extension changes directories to run extconf.rb (like memcached). Fixes #498 by Chris Morris.
Fixed default gem key and cert locations. Pull request #511 by Samuel Cochran.

2.0.2 Released

2013-03-06T00:00:00-08:00

RubyGems 2.0.2 is a bug-fix release. To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page.

If you installed 2.0.1 and are unable to upgrade please follow the how to upgrade/downgrade RubyGems instructions.

Bug fixes:

SSL Certificates are now installed properly. Fixes #491 by hemanth.hm
Fixed HTTP to HTTPS upgrade for rubygems.org.

2.0.1 Released

2013-03-05T00:00:00-08:00

NOTE: This release has been yanked due to a bug in HTTPS handling that may leave you unable to install gems or upgrade RubyGems. 2.0.2 has been released to address these issues.

RubyGems 2.0.1 is a bug-fix release. To update to the latest RubyGems you can run:

gem update --system

To install RubyGems by hand see the Download RubyGems page. To downgrade RubyGems see how to upgrade/downgrade RubyGems.

Bug fixes:

HTTPS URLs are preferred over HTTP URLs. RubyGems will now attempt to upgrade any HTTP source to HTTPS. Credit to Alex Gaynor.
Lazily load RubyGems.org API credentials to avoid failure during RubyGems installation. Bug #465 by Isaac Sanders.
RubyGems now picks the latest prerelease to install. Fixes bug #468 by Santiago Pastorino.
Improved detection of missing Zlib::GzipReader encoding support. Works around JRuby-only bug #472 by Matt Beedle.
“Done installing documentation” is no longer displayed when documentation generation is disabled. Fixes bug #469 by Jeff Sandberg
The existing executable check now respects –format-executable. Pull request #471 by Jeremy Evans.
RubyGems no longer creates gem subdirectories when fetching gems. Fixes #482 by Loren Segal.
RubyGems does not require OpenSSL like RubyGems 1.8, but still prefers it. Fixes #481 by André Arko.
RubyGems only fetches specs for list, search and query commands when needed like RubyGems 1.x. Fixes bug #487 by bitbuerster, Ruby bug #8019 by Ike Miller.
Allow specification of mode for gem subdirectory creation. Ruby bug #7713 by nobu
Fix tests when an ‘a.rb’ exists. Ruby bug #7749 by nobu.

2.0.0 Released

2013-02-24T00:00:00-08:00

RubyGems 2.0 includes several new features and many breaking changes. Some of these changes will cause existing software to break. These changes are a result of improvements to the internals of RubyGems that make it more maintainable and improve APIs for RubyGems users.

If you are using bundler be sure to install a 1.3.0.prerelease version or newer. Older versions of bundler will not work with RubyGems 2.0.

Changes since RubyGems 1.8.25 (including past pre-releases):

Breaking changes:

Deprecated Gem.unresolved_deps in favor of Gem::Specification.unresolved_deps
Merged Gem::Builder into Gem::Package. Use Gem::Package.build(spec) instead of Gem::Builder.new(spec).build
Merged Gem::Format into Gem::Package. Use Gem::Package.new instead of Gem::Format.from_file_by_path
Moved Gem::OldFormat to Gem::Package::Old. Gem::Package will automatically detect old gems for you, so there is no need to refer to it.
Removed Gem::DocManager, replaced by Gem::RDoc and done_installing hook
Removed Gem::Package::TarInput in favor of Gem::Package
Removed Gem::Package::TarOutput in favor of Gem::Package
Removed Gem::RemoteFetcher#open_uri_or_path. (steveklabnik)
Removed Gem::SSL in favor of using OpenSSL directly
Removed Gem.loaded_path
Removed RSS generation from the gem indexer
Removed benchmark option from .gemrc
Removed broken YAML gemspec support in gem build
Removed support for Ruby 1.9.1
Removed many deprecated methods

Major enhancements:

Improved support for default gems shipping with ruby 2.0.0+
A gem can have arbitrary metadata through Gem::Specification#metadata
gem search now defaults to –remote and is anchored like gem list. Fixes #166
Added –document to replace –rdoc and –ri. Use –no-document to disable documentation, –document=rdoc to only generate rdoc.
Only ri-format documentation is generated by default.
gem server uses RDoc::Servlet from RDoc 4.0 to generate HTML documentation.
Add ability to install gems directly from a compatible gemdep file (Gemfile, Isolate, gem.deps.rb) gem install --file path
Add ability to load gem activation information from a gemdeps file (Gemfile, Isolate, gem.deps.rb). Set RUBYGEMS_GEMDEPS=path to have it loaded. Use - as the path to autodetect (current and parent directories are searched).

Minor enhancements:

Added gem check --doctor to clean up after failed uninstallation. Bug #419 by Erik Hollensbe
RubyGems no longer defaults to uninstalling gems if a dependency would be broken. Now you must manually say “yes”. Pull Request #406 by Shannon Skipper.
Gem::DependencyInstaller now passes build_args down to the installer. Pull Request #412 by Sam Rawlins.
Added a cmake builder. Pull request #265 by Allan Espinosa.
Removed rubyforge page from gem list output
Added –only-executables option to gem pristine. Fixes #326
Added -I flag for ‘gem query’ to exclude installed items
Added Gem.install(name, version=default) for interactive sessions
Added Gem::FilePermissionError#directory
Added Gem::rubygems_version which is like Gem::ruby_version
Added RUBYGEMS_HOST documentation to gem env
Added a post_installs hook that runs after Gem::DependencyInstaller finishes installing a set of gems
Added a usage method for Gem::Commands::OwnerCommand. (ffmike)
Added an optional type parameter to Gem::Specification#doc_dir.
Added announcements url and clarified how to file tickets
Added guidance for how to use rdoc and ri in setup command. (jjb)
Attempting to install multiple gems with –version is now an error. You can specify per-gem versions like rake:0.9.5
Clarified Gem::CommandManager example code to avoid multi load problems. (baroquebobcat)
Corrupt or bad cached specs are now re-downloaded. (cookrn)
Extension build arguments are saved from install and reused for pristine
If the OS allows it, documentation is built in a forked background process. (alexch)
Imported gem yank from the gemcutter gem. Fixes #177, #343
Packaged gems now contain and verify SHA1 checksums
Removed commas from gem update summary so you can paste it back to cleanup. (amatsuda)
RubyGems will now warn when building gems with prerelease dependencies. Fixes #255
The RUBYGEMS_HOST environment variable is used to determine appropriate API key for pushing or yanking gems
Uninstall is now performed in reverse topological order.
Users are told what to type when they try to uninstall a gem outside GEM_HOME
When building gems with non-world-readable files a warning is shown.

Bug fixes:

Gem.refresh now maintains the active gem list. Clearing the list would cause double-loads which would cause other bugs. Pull Request #427 by Jeremy Evans
RubyGems now refuses to read the gem push credentials file if it has insecure permissions. Pull Request #438 by Shannon Skipper
RubyGems now requires a local gem name to end in ‘.gem’. Issue #407 by Santiago Pastorino.
Do not allow old-format gems to be installed with a security policy that verifies data.
Gem installation will fail if RubyGems cannot load the specification from the gem. Bug #419 by Erik Hollensbe
RubyGems tests now run in FIPS mode. Issue #365 by Vít Ondruch
Only update the spec cache when we have permission. Ruby Bug #7509
gem install now ignores directories and non .gem files that match the gem to install. Bug #407 by Santiago Pastorino.
Added PID to setup bin_file while installing RubyGems to protect against errors. Fixes #328 by ConradIrwin
Added missing require in Gem::Uninstaller when format_executable is set. (sakuro)
Exact gem command name matches are now chosen even if a longer command overlaps the exact name
Fixed Gem.loaded_path? with a Pathname instance. (mattetti)
Fixed Gem::Dependency.new mismatch with rubygems.org checks
Fixed SecurityError in Gem::Specification.load when $SAFE=1. (ged)
Fixed SystemStackError with “gem list -r -a” on 1.9 (cldwalker)
Fixed gem owners command so that exceptions don’t stop the rest of the command from completing
Fixed gem unpack uninstalled_gem default version picker.
Fixed defunct rubyforge urls in gem command line help
Fixed documentation for the various hooks collections
Fixed documentation generation on setup when the gem directory does not exist. Fixes #253
Fixed documentation to reflect where defaults overrides are loaded from. (ferrous26)
Fixed editing of a Makefile with 8-bit characters. Fixes #181
Fixed gem loading issue caused by dependencies not resolving.
Fixed independent testing of test_gem_package_tar_output. Ruby Bug #4686 by Shota Fukumori
Fixed typo in uninstall message. (sandal)
Gem::Requirement#<=> returns nil on non-requirement arg.
Gem::Requirement.satisfied_by? raises ArgumentError if given a non-version argument
Gem::Version#initialize no longer modifies its parameter. (miaout17)
Group-writable permissions are now allowed for gem repositories. (ctcherry)
Memoized values in Gem::Specification are now reset the version or platform changes. Fixes #78
More specific errors are raised for bad requirements. (arsduo)
Removed reference to ‘sources’ gem in documentation
Removed unused block arguments to avoid creating Proc objects. (k-tsj)
RubyGems now asks before overwriting executable wrappers. Ruby Bug #1800
The bindir is now created with mkdir_p during install. (voxik)
URI scheme matching is no longer case-sensitive. Fixes #322
ext/builder now checks $MAKE as well as $make (okkez)

Changes since RubyGems 2.0.0.rc.2:

Bug fixes:

Gem.gzip and Gem.gunzip now return strings with BINARY encoding. Issue #450 by Jeremy Kemper
Fixed placement of executables with –user-install. Ruby bug #7779 by Jon Forums.
Fixed gem update with –user-install. Ruby bug #7779 by Jon Forums.
Fixed test_initialize_user_install for windows. Ruby bug #7885 by Luis Lavena.
Create extension destination directory before building extensions. Ruby Bug #7897 and patch by Kenta Murata.
Fixed verification of gems at LowSecurity due to missing signature. Thanks to André Arko.

2.0.0.rc.2 Released

2013-02-08T00:00:00-08:00

As a preview release, please file bugs for any problems you have with RubyGems at https://github.com/rubygems/rubygems/issues. To update to this preview release use:

gem update --system=2.0.0.rc.2

If you are using bundler be sure to install version 1.3.0.pre. Older versions of bundler will not work with RubyGems 2.0.

Changes since RubyGems 1.8.25 (including past pre-releases):

Breaking changes:

Deprecated Gem.unresolved_deps in favor of Gem::Specification.unresolved_deps
Merged Gem::Builder into Gem::Package. Use Gem::Package.build(spec) instead of Gem::Builder.new(spec).build
Merged Gem::Format into Gem::Package. Use Gem::Package.new instead of Gem::Format.from_file_by_path
Moved Gem::OldFormat to Gem::Package::Old. Gem::Package will automatically detect old gems for you, so there is no need to refer to it.
Removed Gem::DocManager, replaced by Gem::RDoc and done_installing hook
Removed Gem::Package::TarInput in favor of Gem::Package
Removed Gem::Package::TarOutput in favor of Gem::Package
Removed Gem::RemoteFetcher#open_uri_or_path. (steveklabnik)
Removed Gem::SSL in favor of using OpenSSL directly
Removed Gem.loaded_path
Removed RSS generation from the gem indexer
Removed benchmark option from .gemrc
Removed broken YAML gemspec support in gem build
Removed support for Ruby 1.9.1
Removed many deprecated methods

Major enhancements:

Improved support for default gems shipping with ruby 2.0.0+
A gem can have arbitrary metadata through Gem::Specification#metadata
gem search now defaults to –remote and is anchored like gem list. Fixes #166
Added –document to replace –rdoc and –ri. Use –no-document to disable documentation, –document=rdoc to only generate rdoc.
Only ri-format documentation is generated by default.
gem server uses RDoc::Servlet from RDoc 4.0 to generate HTML documentation.
Add ability to install gems directly from a compatible gemdep file (Gemfile, Isolate, gem.deps.rb) gem install --file path
Add ability to load gem activation information from a gemdeps file (Gemfile, Isolate, gem.deps.rb). Set RUBYGEMS_GEMDEPS=path to have it loaded. Use - as the path to autodetect (current and parent directories are searched).

Minor enhancements:

Added gem check --doctor to clean up after failed uninstallation. Bug #419 by Erik Hollensbe
RubyGems no longer defaults to uninstalling gems if a dependency would be broken. Now you must manually say “yes”. Pull Request #406 by Shannon Skipper.
Gem::DependencyInstaller now passes build_args down to the installer. Pull Request #412 by Sam Rawlins.
Added a cmake builder. Pull request #265 by Allan Espinosa.
Removed rubyforge page from gem list output
Added –only-executables option to gem pristine. Fixes #326
Added -I flag for ‘gem query’ to exclude installed items
Added Gem.install(name, version=default) for interactive sessions
Added Gem::FilePermissionError#directory
Added Gem::rubygems_version which is like Gem::ruby_version
Added RUBYGEMS_HOST documentation to gem env
Added a post_installs hook that runs after Gem::DependencyInstaller finishes installing a set of gems
Added a usage method for Gem::Commands::OwnerCommand. (ffmike)
Added an optional type parameter to Gem::Specification#doc_dir.
Added announcements url and clarified how to file tickets
Added guidance for how to use rdoc and ri in setup command. (jjb)
Attempting to install multiple gems with –version is now an error. You can specify per-gem versions like rake:0.9.5
Clarified Gem::CommandManager example code to avoid multi load problems. (baroquebobcat)
Corrupt or bad cached specs are now re-downloaded. (cookrn)
Extension build arguments are saved from install and reused for pristine
If the OS allows it, documentation is built in a forked background process. (alexch)
Imported gem yank from the gemcutter gem. Fixes #177, #343
Packaged gems now contain and verify SHA1 checksums
Removed commas from gem update summary so you can paste it back to cleanup. (amatsuda)
RubyGems will now warn when building gems with prerelease dependencies. Fixes #255
The RUBYGEMS_HOST environment variable is used to determine appropriate API key for pushing or yanking gems
Uninstall is now performed in reverse topological order.
Users are told what to type when they try to uninstall a gem outside GEM_HOME
When building gems with non-world-readable files a warning is shown.

Bug fixes:

Gem.refresh now maintains the active gem list. Clearing the list would cause double-loads which would cause other bugs. Pull Request #427 by Jeremy Evans
RubyGems now refuses to read the gem push credentials file if it has insecure permissions. Pull Request #438 by Shannon Skipper
RubyGems now requires a local gem name to end in ‘.gem’. Issue #407 by Santiago Pastorino.
Do not allow old-format gems to be installed with a security policy that verifies data.
Gem installation will fail if RubyGems cannot load the specification from the gem. Bug #419 by Erik Hollensbe
RubyGems tests now run in FIPS mode. Issue #365 by Vít Ondruch
Only update the spec cache when we have permission. Ruby Bug #7509
gem install now ignores directories and non .gem files that match the gem to install. Bug #407 by Santiago Pastorino.
Added PID to setup bin_file while installing RubyGems to protect against errors. Fixes #328 by ConradIrwin
Added missing require in Gem::Uninstaller when format_executable is set. (sakuro)
Exact gem command name matches are now chosen even if a longer command overlaps the exact name
Fixed Gem.loaded_path? with a Pathname instance. (mattetti)
Fixed Gem::Dependency.new mismatch with rubygems.org checks
Fixed SecurityError in Gem::Specification.load when $SAFE=1. (ged)
Fixed SystemStackError with “gem list -r -a” on 1.9 (cldwalker)
Fixed gem owners command so that exceptions don’t stop the rest of the command from completing
Fixed gem unpack uninstalled_gem default version picker.
Fixed defunct rubyforge urls in gem command line help
Fixed documentation for the various hooks collections
Fixed documentation generation on setup when the gem directory does not exist. Fixes #253
Fixed documentation to reflect where defaults overrides are loaded from. (ferrous26)
Fixed editing of a Makefile with 8-bit characters. Fixes #181
Fixed gem loading issue caused by dependencies not resolving.
Fixed independent testing of test_gem_package_tar_output. Ruby Bug #4686 by Shota Fukumori
Fixed typo in uninstall message. (sandal)
Gem::Requirement#<=> returns nil on non-requirement arg.
Gem::Requirement.satisfied_by? raises ArgumentError if given a non-version argument
Gem::Version#initialize no longer modifies its parameter. (miaout17)
Group-writable permissions are now allowed for gem repositories. (ctcherry)
Memoized values in Gem::Specification are now reset the version or platform changes. Fixes #78
More specific errors are raised for bad requirements. (arsduo)
Removed reference to ‘sources’ gem in documentation
Removed unused block arguments to avoid creating Proc objects. (k-tsj)
RubyGems now asks before overwriting executable wrappers. Ruby Bug #1800
The bindir is now created with mkdir_p during install. (voxik)
URI scheme matching is no longer case-sensitive. Fixes #322
ext/builder now checks $MAKE as well as $make (okkez)

Changes since RubyGems 2.0.0.rc.1:

Bug fixes:

Fixed signature verification of gems which was broken only on master. Thanks to Brian Buchanan.
Proper exceptions are raised when verifying an unsigned gem. Thanks to André Arko.

Data Verification

2013-01-31T00:00:00-08:00

TL;DR: We were able to verify that all gems served by rubygems.org are tamper-free.

The Incident

As most people are aware, on January 30th rubygems.org was hit with a rogue code execution vulnerability. Much has been written (and will be written) about why the bug existed and how we’re going to be dealing with making sure it never happens again.

Data Verification

Right now, I want to let everyone know about the state of all the gem files. The biggest worry with a compromise like this is that an attacker could tamper with gem files and infect anyone who installed a gem. This was our biggest worry and we spent the majority of the last 36 hours working to try and detect any gems that were tampered with.

Exploits and Checksums

To begin with, Mark Imbriaco (@markimbriaco) pulled down 100% of the gems from Amazon S3, where we store all the gems. He then performed 2 actions on all the gems:

Audit the gem metadata to detect any other gems using the vulnerability.
Generate a SHA512 checksums of the gem file.

Mark did not detect any other gems using the vulnerability, which was our first bit of good news.

He then posted all the checksums which became our checksum set 1 (CS1).

Mirrors

Mirrors provide us with our best validation mechanism. A number of people run rubygems.org mirrors for various reasons and they offered up data to help us verify the gem data.

Eric Hodel (@drbrain) as well as others churned through their data and checked the data against CB1. Upon finishing this step, we had validated 95% of the gems against multiple sources. We then subtracted out the gems that had been yanked but were still available in CB1 (but because of being yanked, wouldn’t be in the mirrors). Finally, we subtracted out the gems that been added to S3 in the last 20 days as validated by the S3 log files.

Results

The result of all this checking and double checking is that we resulted in only 80 prerelease gems that we could not verify against a secondary source. We then opt’d to yank these gems and are in process of contacting the authors so they can push a new version.

Through the hard work of all our volunteers, we are able to confidently report that the gems available from rubygems.org have not been tampered with.

Data and Tools

We have posted the checksums and tools used to verify them at the rubygems-verification github repository to allow you to double-check our work.

Thanks

So many people helped with this effort in the #rubygems-verification channel on irc.freenode.net. I want to thank all of you for your time and say that your help was instrumental in making sure rubygems.org was able to continue to operate.

Rubygems 2.0.0.preview2

2012-12-03T00:00:00-08:00

The Rubygems team is proud to announce the availability of 2.0.0.preview2. This version has been merged into ruby 2.0.0-preview2 as well, in preperation for Rubygems 2.0.0 final to be included in ruby 2.0.0 final.

Breaking changes

There are a number of changes in 2.0.0 that may break code expecting deprecated features of Rubygems. Most major libraries that use the internal Rubygems APIs have been updated, but there are bound to be a number that have not.

Deprecated Gem.unresolved_deps in favor of Gem::Specification.unresolved_deps
Merged Gem::Builder into Gem::Package. Use Gem::Package.build(spec) instead of Gem::Builder.new(spec).build
Merged Gem::Format into Gem::Package. Use Gem::Package.new instead of Gem::Format.from_file_by_path
Moved Gem::OldFormat to Gem::Package::Old. Gem::Package will automatically detect old gems for you, so there is no need to refer to it.
Removed Gem::DocManager, replaced by Gem::RDoc and done_installing hook
Removed Gem::Package::TarInput in favor of Gem::Package
Removed Gem::Package::TarOutput in favor of Gem::Package
Removed Gem::RemoteFetcher#open_uri_or_path. (steveklabnik)
Removed Gem::SSL in favor of using OpenSSL directly
Removed Gem.loaded_path
Removed RSS generation from the gem indexer
Removed benchmark option from .gemrc
Removed broken YAML gemspec support in gem build
Removed support for Ruby 1.9.1
Removed many deprecated methods

Major enhancements

As is the point of most 2.0s, Rubygems continues a number of enhancements.

Improved support for default gems shipping with ruby 2.0.0+. The default gems now are properly loaded as more important that the standard library, which was the intent.
A gem can have arbitrary metadata through Gem::Specification#metadata. This feature allows users to embed their own data inside a gem easily and retrieve it. It’s possible to use this to store information about native packages needed, commit inforation, or any other structure data.
gem search now defaults to –remote and is anchored like gem list. Fixes #166
Added –document to replace –rdoc and –ri. Use –no-document to disable documentation, –document=rdoc to only generate rdoc.
Only ri-format documentation is generated by default with HTML being automatically generated by gem server. This will speed up install time.
Add gemdeps file support. A gemdeps format file is a Gemfile, Isolate, or gem.deps.rb file. This files contain information about which gems and versions are needed to run a particular application. Rubygems now has a subset of functionality provided by bundler builtin to provide easy usage of these files.
Add ability to install gems directly from a compatible gemdep file (Gemfile, Isolate, gem.deps.rb) gem install --file path
Add ability to load gem activation information from a gemdeps file (Gemfile, Isolate, gem.deps.rb). Set RUBYGEMS_GEMDEPS\=path to have it loaded. Use - as the path to autodetect (current and parent directories are searched).

Minor enhancements

Additionally, there are innumerable small enhancements. Here is a nice sampling.

Added –only-executables option to gem pristine. Fixes #326
Added -I flag for ‘gem query’ to exclude installed items
Added Gem.install(name, version=default) for interactive sessions
Added Gem::FilePermissionError#directory
Added Gem::rubygems_version which is like Gem::ruby_version
Added RUBYGEMS_HOST documentation to gem env
Added a post_installs hook that runs after Gem::DependencyInstaller finishes installing a set of gems
Added a usage method for Gem::Commands::OwnerCommand. (ffmike)
Added an optional type parameter to Gem::Specification#doc_dir.
Added announcements url and clarified how to file tickets
Added guidance for how to use rdoc and ri in setup command. (jjb)
Attempting to install multiple gems with –version is now an error. You can specify per-gem versions like rake:0.9.5
Clarified Gem::CommandManager example code to avoid multi load problems. (baroquebobcat)
Corrupt or bad cached specs are now re-downloaded. (cookrn)
Extension build arguments are saved from install and reused for pristine
If the OS allows it, documentation is built in a forked background process. (alexch)
Imported gem yank from the gemcutter gem. Fixes #177, #343
Packaged gems now contain and verify SHA1 checksums
Removed commas from gem update summary so you can paste it back to cleanup. (amatsuda)
RubyGems will now warn when building gems with prerelease dependencies. Fixes #255
The RUBYGEMS_HOST environment variable is used to determine appropriate API key for pushing or yanking gems
Uninstall is now performed in reverse topological order.
Users are told what to type when they try to uninstall a gem outside GEM_HOME
When building gems with non-world-readable files a warning is shown.

Bug fixes

And lastly, lots and lots of bugfixes. Here is a short memoriam of those bugs we’ve lost this release.

Added PID to setup bin_file while installing RubyGems to protect against errors. Fixes #328 by ConradIrwin
Added missing require in Gem::Uninstaller when format_executable is set. (sakuro)
Exact gem command name matches are now chosen even if a longer command overlaps the exact name
Fixed Gem.loaded_path? with a Pathname instance. (mattetti)
Fixed Gem::Dependency.new mismatch with rubygems.org checks
Fixed SecurityError in Gem::Specification.load when $SAFE=1. (ged)
Fixed SystemStackError with “gem list -r -a” on 1.9 (cldwalker)
Fixed gem owners command so that exceptions don’t stop the rest of the command from completing
Fixed gem unpack uninstalled\_gem default version picker.
Fixed defunct rubyforge urls in gem command line help
Fixed documentation for the various hooks collections
Fixed documentation generation on setup when the gem directory does not exist. Fixes #253
Fixed documentation to reflect where defaults overrides are loaded from. (ferrous26)
Fixed editing of a Makefile with 8-bit characters. Fixes #181
Fixed gem loading issue caused by dependencies not resolving.
Fixed independent testing of test_gem_package_tar_output. Ruby Bug #4686 by Shota Fukumori
Fixed typo in uninstall message. (sandal)
Gem::Requirement#<=> returns nil on non-requirement arg.
Gem::Requirement.satisfied_by? raises ArgumentError if given a non-version argument
Gem::Version#initialize no longer modifies its parameter. (miaout17)
Group-writable permissions are now allowed for gem repositories. (ctcherry)
Memoized values in Gem::Specification are now reset the version or platform changes. Fixes #78
More specific errors are raised for bad requirements. (arsduo)
Removed reference to ‘sources’ gem in documentation
Removed unused block arguments to avoid creating Proc objects. (k-tsj)
RubyGems now asks before overwriting executable wrappers. Ruby Bug #1800
The bindir is now created with mkdir_p during install. (voxik)
URI scheme matching is no longer case-sensitive. Fixes #322
ext/builder now checks $MAKE as well as $make (okkez)

Rubyconf / Rubygems Hackfest

2012-11-05T00:00:00-08:00

If you followed the twitter feed for Rubyconf this past week, you probably noticed that this years conference was the host of the first, of hopefully many more, Rubygems.org hackfests. The hackfest started at 6:30 PM, after Matz’s chat with Evan wrapped up, and went until almost 11:00 PM, when we had scheduled to wrap up around 8:30.

I am personally blown away by the amazing turnout we had, and especially floored that in addition to commenting and closing many issues which were no longer valid, almost every single attendee of the hackfest opened a pull request to fix either an outstanding bug, or add a new feature.

Some photos from the event:

I’m still in the process of working through the open pull requests and issues which need further commenting, but I wanted to provide some of the highlights, and welcome some of the soon-to-be Rubygems.org committers.

Please let me know if I missed you, or something you worked on in the list. It was amazing to see developers of all kinds, from companies such as Yardstick, New Relic and Bluebox step up to assist in helping build and maintain a community resource.

Mark Bennett

Amos King and Charlie Sanders

Jared McFarland and Tim Knowlton

Chris Kelly

Add per gem rss feed

Matt Simpson

Daniel Huckstep

Jack Foy and Fletcher Nichol

Clyde Law and Andrew Szczepanski

Remove librato.yml containing API credentials

Jon Guymon

Add size to versions

1.8.19 Released

2012-03-14T00:00:00-07:00

3 bug fixes:

Handle loading psych vs syck properly. Fixes #298
Make sure Date objects don’t leak in via Marshal
Perform Date => Time coercion on yaml loading. Fixes #266

1.8.16 Released

2012-02-10T00:00:00-08:00

3 bug fixes:

Fix gem specification loading when encoding is not UTF-8. #146
Allow group writable if umask allows it already.
Uniquify the spec list based on directory order priority

Shaving a YAML Yak

2011-08-31T00:00:00-07:00

Have you ever seen this error?

$ gem install rails --pre
ERROR:  While executing gem ... (NameError)
  uninitialized constant Psych::Syck
$

Yes, I have too. Today we’re going to discuss the source of this error, and what we need to do to fix it.

TL;DR

Upgrade rubygems to make this error go away. However, the long term solution is to fix rubygems.org.

Gemspecs and YAML

When you package your gem, the resulting .gem file contains a YAML representation of your gemspec. The YAML representation of your gemspec contains everything your gemspec contains, including author information and dependency information.

The generated gem file is just a tar file:

$ gem fetch rails
Fetching: rails-3.1.0.gem (100%)
Downloaded rails-3.1.0
$ file rails-3.1.0.gem 
rails-3.1.0.gem: POSIX tar archive

The tar file contains two gzipped files. One is the actual contents of your gem, the rb files, etc. The other gz file is metadata about your gem:

$ tar xvf rails-3.1.0.gem 
x data.tar.gz
x metadata.gz

The metadata is your gemspec in YAML format. We can easily examine the YAML data by using the gzcat command:

$ gzcat metadata.gz 
--- !ruby/object:Gem::Specification 
name: rails
version: !ruby/object:Gem::Version 
  hash: 3
  prerelease: 
  segments: 
  - 3
  - 1
  - 0
  version: 3.1.0
platform: ruby
...

YAML and Ruby’s standard library

Ruby has shipped with a YAML parsing library for quite a long time. The library (called “syck”) is a custom YAML 1.0 parser, and has been part of Ruby since 1.8. Unfortunately, the library was abandoned.

YAML parsing is important for Ruby, so rather than removing Syck, it is being replaced with a new library called Psych. Psych is a YAML 1.1 parser, but is powered by libyaml. libyaml is developed by the team that writes the YAML spec, and is considered to be the canonical implementation.

Unfortunately, this transition can cause subtle but annoying problems.

Dealing with `=`

The problem we see when downloading from rubygems.org is due to round tripping issues between Syck and Psych. Let’s compare how Syck and Psych serialize the = sign:

>> RUBY_VERSION
=> "1.8.7"
>> require 'yaml'
=> true
>> YAML.dump ['=']
=> "--- \n- \"=\"\n"
>>

In the example above, we’re using Syck to dump an equals sign. Notice this double quotes surrounding the equals sign. Now let’s try the same thing with Psych:

irb(main):001:0> RUBY_VERSION
=> "1.9.4"
irb(main):002:0> require 'yaml'
=> true
irb(main):003:0> YAML.dump ['=']
=> "---\n- =\n"
irb(main):004:0>

Notice in this example the lack of double quotes surrounding the equals sign. Both of these are valid YAML documents. Let’s see what happens when we feed the YAML from Psych in to Syck:

>> RUBY_VERSION
=> "1.8.7"
>> yaml = "---\n- =\n"
=> "---\n- =\n"
>> YAML.load yaml
=> [#<YAML::Syck::DefaultKey:0x1026d0210>]
>>

There we have it! We can get Syck to return a strange object even when given a valid YAML document. But how does this relate to gemspecs and rubygems.org?

Gemspec revisited

Recall that gemspecs are dumped to YAML when the gem is packaged. It’s possible (and not unheard of) for our gemspecs to contain an equals sign. Consider the defining dependencies in your gemspec:

Gem::Specification.new do |s|
  ...
  s.add_dependency('activesupport', '= 3.1.0')
  ..
end

Those dependencies are serialized to the generated YAML file. If we package this using Psych and examine the generated yaml, we can find the section where the dependency is declared:

$ gzcat metadata.gz
...
dependencies:
- !ruby/object:Gem::Dependency
  name: activesupport
  requirement: &70133834330380 !ruby/object:Gem::Requirement
    none: false
    requirements:
    - - =
      - !ruby/object:Gem::Version
        version: 3.1.0
...

Notice the unquoted equals sign in the metadata.

rubygems.org

The trouble with the spec we saw above is that rubygems.org still uses syck as it’s YAML parser. When the server parses the gem YAML file, it turns the equals sign in to a Syck DefaultKey.

You can see this problem manifest itself on the rubygems.org website if you look at the Runtime Dependencies for some gems:

A simple google search will show that this is not an uncommon problem.

Command line errors

When downloading gem information, rubygems.org will send dependency information in marshall format. Gems that have the DefaultKey object in their dependencies will have that object marshalled and sent down to the client. If the client does not use Syck (which is default for 1.9.2+ when libyaml is available), then the Syck constant cannot be found and the “uninitialized constant” error will appear.

How can we fix this?

We have two ways to deal with this issue. The first way to deal with this issue is to upgrade rubygems. Rubygems contains code to work around the issue when installing gems. But it does not fix the issue.

The only way we can fix this error for all users is to upgrade rubygems.org to use psych as the YAML parser. Upgrading rubygems.org will prevent the strange objects from entering marshal data sent to users.

We’re working on this upgrade, but we can use your help! Specifically, we need to get delayed job to be compatible with Psych. Once we overcome that hurdle, I think it will be easy to get rubygems.org upgraded.

Thanks for listening!

1.8.10 Released

2011-08-25T00:00:00-07:00

RubyGems 1.8.10 contains a security fix that prevents malicious gems from executing code when their specification is loaded. See https://github.com/rubygems/rubygems/pull/165 for details.

5 bug fixes:
- RubyGems escapes strings in ruby-format specs using #dump instead of #to_s and %q to prevent code injection. Issue #165 by Postmodern
- RubyGems attempt to activate the psych gem now to obtain bugfixes from psych.
- Gem.dir has been restored to the front of Gem.path. Fixes remaining problem with Issue #115
- Fixed Syck DefaultKey infecting ruby-format specifications.
- gem uninstall a b no longer stops if gem “a” is not installed.

1.8.9 Released

2011-08-23T00:00:00-07:00

Bug fixes:
- Fixed uninstalling multiple gems using gem uninstall
- Gem.use_paths splatted to take multiple paths! Issue #148

1.8.8 Released

2011-08-11T00:00:00-07:00

Bug fix:
- The encoding of a gem’s YAML spec is now UTF-8. Issue #149

1.8.7 Released

2011-08-02T00:00:00-07:00

5 bug fixes:
- Added missing require for gem uninstall --format-executable
- The correct name of the executable being uninstalled is now displayed with –format-executable
- Fixed gem unpack uninstalled_gem default version picker
- RubyGems no longer claims a nonexistent gem can be uninstalled
- gem which no longer claims directories are requirable files

1.8.6 Released

2011-07-25T00:00:00-07:00

1 minor enhancement:
- Add autorequires and delay startup of RubyGems until require is called. See Ruby bug #4962
9 bug fixes:
- Restore behavior of Gem::Specification#loaded? Ruby Bug #5032
- Clean up SourceIndex.add_specs to not be so damn noisy. (tadman)
- Added missing APPLE_GEM_HOME in paths.
- Extend YAML::Syck::DefaultKey fixing to marshal_dump as well.
- Fix #29216: check correct bin_dir in check_that_user_bin_dir_is_in_path.
- Revert Gem.latest_load_paths to working order (PathSupport revert).
- Restore normalization of GEM_HOME.
- Handle the Syck DefaultKey problem once and for all.
- Fix SystemStackError occurring with “gem list -r -a” on 1.9.

1.8.5 Released

2011-05-31T00:00:00-07:00

2 minor enhancement:
- The -u option to ‘update local source cache’ is official deprecated.
- Remove has_rdoc deprecations from Specification.
2 bug fixes:
- Handle bad specs more gracefully.
- Reset any Gem paths changed in the installer.

1.8.4 Released

2011-05-25T00:00:00-07:00

1 minor enhancement:
- Removed default_executable deprecations from Specification.

1.8.3 Released

2011-05-19T00:00:00-07:00

4 bug fixes:
- Fix independent testing of test_gem_package_tar_output. Ruby Bug #4686 by Shota Fukumori
- Fix test failures for systems with separate ruby versions. Ruby Bug #3808 by Jeremy Evans
- Fixed some bad calls left behind after rolling out some refactorings.
- Syck has a parse error on (good) times output from Psych. (dazuma, et al)

1.8.2 Released

2011-05-11T00:00:00-07:00

2 minor enhancements:
- Moved #outdated from OutdatedCommand to Specification (for Isolate).
- Print out a warning about missing executables.
3 bug fixes:
- Added missing requires to fix various upgrade issues.
- gem pristine respects multiple gem repositories.
- setup.rb now execs with –disable-gems when possible

1.8.1 Released

2011-05-05T00:00:00-07:00

1 minor enhancement:
- Added Gem::Requirement#specific? and Gem::Dependency#specific?
4 bug fixes:
- Typo on Indexer rendered it useless on Windows
- gem dep can fetch remote dependencies for non-latest gems again.
- gem uninstall with multiple versions no longer crashes with ArgumentError
- Always use binary mode for File.open to keep Windows happy

1.8.0 Released

2011-05-01T00:00:00-07:00

This release focused on properly encapsulating functionality. Most of this work focused on moving functionality out of Gem::SourceIndex and Gem::GemPathSearcher into Gem::Specification where it belongs.

After installing RubyGems 1.8.0 you will see deprecations when loading your exsting gems. Run gem pristine --all --no-extensions to regenerate your gem specifications safely.

Currently RubyGems does not save the build arguments used to build gems with extensions. You will need to run gem pristine gem_with_extension -- --build-arg to regenerate a gem with an extension where it requires special build arguments.

24(+) Deprecations (WOOT!):
- DependencyList.from_source_index deprecated the source_index argument.
- Deprecated Dependency.new(/regex/).
- Deprecated Gem.searcher.
- Deprecated Gem.source_index and Gem.available?
- Deprecated Gem: activate_dep, activate_spec, activate, report_activate_error, and required_location.
- Deprecated Gem::all_partials
- Deprecated Gem::cache_dir
- Deprecated Gem::cache_gem
- Deprecated Gem::default_system_source_cache_dir
- Deprecated Gem::default_user_source_cache_dir
- Deprecated Platform#empty?
- Deprecated Specification.cache_gem
- Deprecated Specification.installation_path
- Deprecated Specification.loaded, loaded?, and loaded=
- Deprecated all of Gem::SourceIndex.
- Deprecated all of Gem::GemPathSearcher.
- Deprecated Gem::Specification#default_executable.
2 major enhancements:
- Gem::SourceIndex functionality has been moved to Gem::Specification. Gem::SourceIndex is completely disconnected from Gem::Specification
- Refactored GemPathSearcher entirely out. RIPMF
41 minor enhancements:
- Added CommandManager#unregister_command
- Added Dependency#matching_specs + to_specs.
- Added Dependency#to_spec
- Added Gem.pre_reset_hook/s and post_reset_hook/s.
- Added GemCommand.reset to reinitialize the singleton
- Added Specification#activate.
- Added Specification#activated, activated=, and activated?
- Added Specification#base_dir.
- Added Specification#bin_dir and bin_file.
- Added Specification#cache_dir and cache_file. Aliased cache_gem.
- Added Specification#doc_dir and ri_dir.
- Added Specification#find(name_or_dep, *requirements).
- Added Specification#gem_dir and gems_dir.
- Added Specification#spec_dir and spec_file.
- Added Specification.add_spec, add_specs, and remove_spec.
- Added Specification.all=. If you use this, we will light you on fire.
- Added Specification.all_names.
- Added Specification.dirs and dirs=. dirs= resets.
- Added Specification.find_all_by_name(name, *reqs)
- Added Specification.latest_specs. SO TINY!
- Added TestCase#all_spec_names to help clean up tests
- Added TestCase#assert_path_exists and refute_path_exists. Will move to minitest.
- Gem.sources no longer tries to load sources gem. Only uses default_sources.
- Installer no longer accepts a source_index option.
- More low-level integration.
- Removed Gem::FileOperations since it is a dummy class
- Removed a comment because I am dumb
- Removed pkgs/sources/lib/sources.rb
- Revamped indexer to mostly not use SourceIndex (legacy index requires it).
- Rewrote our last functional test suite to be happy and fast
- RubyGems is now under the Ruby License or the MIT license
- Specification#== now only checks name, version, and platform.
- Specification#authors= now forcefully flattens contents (bad rspec! no cookie!)
- Specification#eql? checks all fields.
- Specification#installation_path no longer raises if it hasn’t been activated.
- Specification#validate now ensures that authors is not empty.
- TestCase.util_setup_spec_fetcher no longer returns a SourceIndex.
- Uninstaller no longer passes around SourceIndex instances
- Warn on loading bad spec array values (ntlm-http gem has nil in its cert chain)
- gem pristine now accepts –no-executables to skip restoring gems with extensions.
- gem pristine can now restore multiple gems.
6 bug fixes:
- DependencyInstaller passed around a source_index instance but used Gem.source_index.
- Fixed Platform#== and #hash so instances may be used as hash keys.
- Fixed broken Specification#original_platform. It should never be nil.
- Gem::Text#format_text now strips trailing whitespace
- Normalize LOAD_PATH with File.expand_path
- gem build errors should exit 1.
- gem pristine can now restore non-latest gems where the cached gem was removed.

1.7.1 Released

2011-03-28T00:00:00-07:00

1 bug fix: * Fixed missing file in Manifest.txt. (Also a bug in hoe was fixed where rake check_manifest showing a diff would not exit with an error.)

1.7.0 Released

2011-03-28T00:00:00-07:00

16 Deprecations (woot!) * Deprecated Gem.all_load_paths, latest_load_paths, promote_load_path, and cache.
- Deprecated RemoteFetcher#open_uri_or_path.
- Deprecated SourceIndex#all_gems.
- Deprecated SourceIndex#initialize(hash_of_specs).
- Deprecated SourceIndex.from_installed_gems, from_gems_in, and load_specification.
- Deprecated Specification#has_rdoc, default_executable, and test_suite_file(=).
- Deprecated Specification#has_rdoc= and default_executable=
26 minor enhancements:
- Added stupid simple deprecation module.
- Added –spec option to gem unpack to output a gem’s original metadata
- Added packaging option to Specification#validate
- Gem.bin_path requires the exec_name argument.
- Read from cached specs if fetch fails for some reason
- Refactored Specification#assign_defaults into #initialize.
- RemoteFetcher#fetch_path now dispatches dynamically to ‘fetch_[uri.schema]’
- Removed Specification @@gather.
- Removed Specification.attribute.
- Removed Specification.attribute_alias_singular.
- Removed Specification.attribute_defaults.
- Removed Specification.attributes
- Removed Specification.overwrite_accessor.
- Removed Specification.read_only.
- Removed Specification.required_attribute.
- Removed Specification::SPECIFICATION_VERSION_HISTORY and turned into rdoc
- Removed blanket rescue in default_executable. Hope it doesn’t blow up! :P
- Removed nearly all metaprogramming from Specification. Yay for attr_accessor!
- SourceIndex#initialize changed to prefer an array of spec dirs, defaulting to none.
- SourceIndex.new is now the preferred way to create SourceIndex instances. gasp
- Specification#validate now checks that array attribs are indeed arrays.
- Specification.default_value is now an instance method.
- Switched Specification::TODAY to be proper midnight @ UTC
- Update Gem::RemoteFetcher's User-Agent to handle RUBY_ENGINE and RUBY_REVISION when patchlevel is -1
- UpdateCommand#gems_to_update now returns (name, version) pairs.
- UpdateCommand#which_to_update now takes an optional system argument.
11 bug fixes:
- Added missing remote fetcher require to pristine command (aarnell)
- Building gems now checks to ensure all required fields are non-nil
- Fix option parser when summary is nil.
- Fixed gem contents to work with the lightweight specifications
- Fixed gem update --system x.y.z where x.y.z == latest version. (MGPalmer)
- Fixed gem contents sorting and tests. (MGPalmer)
- Fixed intermittant problem in gem fetch with –platform specified (quix)
- Fixed lightweight specifications so gem rdoc will generate proper documentation
- MockGemUI#terminate_interaction should not raise Gem::SystemExitException. (MGPalmer)
- RubyGems now raises a better error for broken .gem files. Bug #29067 by Elias Baixas
- gem update now uniq’s command line arguments.

1.6.2 Released

2011-03-08T00:00:00-08:00

Bug Fixes:

require of an activated gem could cause activation conflicts. Fixes Bug #29056 by Dave Verwer.
gem outdated now works with up-to-date prerelease gems.

1.6.1 Released

2011-03-03T00:00:00-08:00

Bug Fixes:

Installation no longer fails when a dependency from a version that won’t be installed is unsatisfied.
README.rdoc now shows how to file tickets and get help. Pull Request #40 by Aaron Patterson.
Gem files are cached correctly again. Patch #29051 by Mamoru Tasaka.
Tests now pass with non-022 umask. Patch #29050 by Mamoru Tasaka.

1.6.0 Released

2011-03-01T00:00:00-08:00

4 Deprecations:

RubyGems no longer requires ‘thread’. Rails < 3 will need to add require ‘thread’ to their applications.
Gem.cache is deprecated. Use Gem.source_index.
RbConfig.datadir is deprecated. Use Gem.datadir.
Gem::LoadError#version_requirements has been removed. Use Gem::LoadError#requirement.

2 Major Enhancements:

Rewrote how Gem::activate (gem and require) resolves dependencies.
Gem::LoadError#version_requirement has been removed. Use Gem::LoadError#requirement.

17 Minor Enhancments:

Added –key to gem push for setting alternate API keys.
Added –format-executable support to gem uninstall.
Added Gem::DependencyList#clear.
Added Gem::DependencyList#remove_specs_unsatisfied_by
Added Gem.latest_spec_for, latest_version_for, and latest_rubygems_version.
Added Gem::Dependency#merge which merges requirements for two dependencies.
Added Gem::TestCase#util_spec for faster tests.
Added Gem::Specification#dependent_specs.
Added Gem::TestCase#new_spec and Gem::TestCase#install_specs.
Added flag to include prerelease gems in Gem::SourceIndex#latest_specs.
Gem.cache_dir always references the proper cache dir. Pass true to support a user path.
Gem.cache_gem, given a filename always references the cache gem. Pass true to support a user path.
Added Gem::Specification#conflicts
Removed rdoc gem/require from test_case.rb.
Rubygems will no longer let you push if you’re using beta or unreleased rubygems.
Save RAM / GC churn by removing spec.files and rdoc options from locally cached gem specifications.
SpecFetcher.fetch_spec can now take a string source_uri.

10 Bug Fixes:

Added missing require of Gem::RemoteFetcher to the unpack command.
RubyGems now completely removes a previous install when reinstalling.
Fixed Gem::Installer#generate_bin to only chmod files that exist.
Fixed handling of Windows style file:/// uris.
Fixed requires in tests. (shota)
Fixed script generation on Windows.
Fixed test issues if you have older rubygems installed.
Gem::DependencyInstaller tests use Gem::Security, add the missing require.
Gem::Security used FileUtils but didn’t require it. Reported by Elia Schito.
Gem::Uninstaller now respects –format-executable.

1.5.3 Released

2011-02-26T00:00:00-08:00

Bug Fixes:

Fix for a bug in Syck which causes install failures for gems packaged with Psych. Bug #28965 by Aaron Patterson.

1.5.2 Released

2011-02-10T00:00:00-08:00

Bug Fixes:

Fixed gem update --system. RubyGems can now update itself again.

1.5.1 Released

2011-02-09T00:00:00-08:00

NOTE: `gem update --system` is broken. See UPGRADING.rdoc.

Minor Enhancement:

Added ability to do gem update –system X.Y.Z.

Bug Fixes:

Scrub !!null YAML from 1.9.2 (install and build).
Added missing requires for user_interaction.
Wrote option processing tests for gem update.
Updated upgrading doco for new gem update –system option.
Fixed SilentUI for cygwin; try /dev/null first then fall back to NUL.
RubyGems now enforces ruby 1.8.7 or newer.

1.5.0 Released

2011-01-31T00:00:00-08:00

NOTE: `gem update --system` is broken. See UPGRADING.rdoc.

Major Enhancements:

Finally fixed all known 1.9.x issues. Upgrading is now possible!
Merged huge 1.3.7/ruby-core changes to master.

Minor Enhancements:

Added UPGRADING.rdoc to help deal with 1.9 issues.
Gem::Format now gives better errors for corrupt gem files and includes paths
Pre-install hooks can now abort gem installation by returning false
Move shareable TestCase classes to lib/ to help plugin authors with tests.
Add post-build hooks that can cancel the gem install
Always require custom_require now that require_gem is gone
Added GemInstaller accessors for @options so plugins can reference them.
Optimized Gem.find_files. ~10% faster than 1.4.2. ~40% faster than ruby 1.9.
Gem::SilentUI now behaves like Gem::StreamUI for asking questions. Patch by Erik Hollensbe.

Bug Fixes:

gem update was implicitly doing –system.
3: Fixed encoding errors causing gem installs to die during rdoc phase.
Add RubyForge URL to README. Closes #28825
3: Use chdir {} when building extensions to prevent warnings. Fixes #4337
2: Fix circular require warning.
Make requiring openssl even lazier at request of NaHi
gem unpack will now download the gem if it is not in the cache. Patch by Erik Hollensbe.
rubygems-update lists its development dependencies again

1.4.2 Released

2011-01-06T00:00:00-08:00

Bug fixes:

Gem::Versions: “1.b1” != “1.b.1”, but “1.b1” eql? “1.b.1”. Fixes gem indexing.
Fixed Gem.find_files.
Removed otherwise unused #find_all_dot_rb. Only 6 days old and hella buggy.

1.4.1 Released

2010-12-31T00:00:00-08:00

Since apparently nobody reads my emails, blog posts or the README:

DO NOT UPDATE RUBYGEMS ON RUBY 1.9! See UPGRADING.rdoc for details.

Bug fix:

Specification#load was untainting a frozen string (via gem build *.spec)

1.4.0 Released

2010-12-30T00:00:00-08:00

NOTE: In order to better maintain rubygems and to get it in sync with the world (eg, 1.9’s 1.3.7 is different from our 1.3.7), rubygems is switching to a 4-6 week release schedule. This release is the precursor to that process and as such may be a bit on the wild side! You have been warned!

NOTE: We’ve switched to git/github. See README.rdoc for details.

New features:

Added –launch option to gem server. (gthiesfeld)
Added fuzzy name matching on install failures. (gstark/presidentbeef)
Allow searching w/ file extensions: gem which fileutils.rb
Progress indicator during download (Ryan Melton)
Speed up Gem::Version#<=> by 2-3x in common cases. (raggi)
–source is now additive with your current sources. Use –clear-sources first to maintain previous behavior.

Bug fixes:

Dependency “~>”s now respect lower-bound prerelease versions.
Ensure the gem directories exist on download.
Expand Windows user home candidates for Ruby 1.8. Bug #28371 & #28494
Fix find_files to order by version.
Fix ivar typo. [Josh Peek]
Normalized requires and made many of them lazy. Do not depend on rubygems to require stdlib stuff for you. (raggi/tmm1)
Treat 1.0.a10 like 1.0.a.10 for sorting, etc. Fixes #27903. (dchelimsky)

1.3.7 Released

2010-05-13T00:00:00-07:00

NOTE:

http://rubygems.org is now the default source for downloading gems.

You may have sources set via ~/.gemrc, so you should replace http://gems.rubyforge.org with http://rubygems.org

http://gems.rubyforge.org will continue to work for the forseeable future.

New features:

gem commands * gem install and gem fetch now report alternate platforms when a matching one couldn’t be found. * gem contents –prefix is now the default as specified in –help. Bug #27211 by Mamoru Tasaka.
- gem fetch can fetch of old versions again. Bug #27960 by Eric Hankins.
- gem query and friends output now lists platforms. Bug #27856 by Greg Hazel.
- gem server now allows specification of multiple gem dirs for documentation. Bug #27573 by Yuki Sonoda.
- gem unpack can unpack gems again. Bug #27872 by Timothy Jones.
- gem unpack now unpacks remote gems.
- –user-install is no longer the default. If you really liked it, see Gem::ConfigFile to learn how to set it by default. (This change was made in 1.3.6)
RubyGems now has platform support for IronRuby. Patch #27951 by Will Green.

Bug fixes:

Require rubygems/custom_require if –disable-gem was set. Bug #27700 by Roger Pack.
RubyGems now protects against exceptions being raised by plugins.
rubygems/builder now requires user_interaction. Ruby Bug #1040 by Phillip Toland.
Gem::Dependency support #version_requirements= with a warning. Fix for old Rails versions. Bug #27868 by Wei Jen Lu.
Gem::PackageTask depends on the package dir like the other rake package tasks so dependencies can be hooked up correctly.

1.3.6 Released

2010-02-17T00:00:00-08:00

New features:

gem commands * Added gem push and gem owner for interacting with modern/Gemcutter sources
- gem dep now supports –prerelease.
- gem fetch now supports –prerelease.
- gem server now supports –bind. Patch #27357 by Bruno Michel.
- gem rdoc no longer overwrites built documentation. Use –overwrite force rebuilding. Patch #25982 by Akinori MUSHA.
Captial letters are now allowed in prerelease versions.

Bug fixes:

Development deps are no longer added to rubygems-update gem so older versions can update sucessfully.
Installer bugs:
- Prerelease gems can now depend on non-prerelease gems.
- Development dependencies are ignored unless explicitly needed. Bug #27608 by Roger Pack.
gem commands * gem which now fails if no paths were found. Adapted patch #27681 by Caio Chassot.
- gem server no longer has invalid markup. Bug #27045 by Eric Young.
- gem list and friends show both prerelease and regular gems when –prerelease –all is given
Gem::Format no longer crashes on empty files. Bug #27292 by Ian Ragsdale.
Gem::GemPathSearcher handles nil require_paths. Patch #27334 by Roger Pack.
Gem::RemoteFetcher no longer copies the file if it is where we want it. Patch #27409 by Jakub Šťastný.

Deprecation Notices:

lib/rubygems/timer.rb has been removed.
Gem::Dependency#version_requirements is deprecated and will be removed on or after August 2010.
Bulk index update is no longer supported.
Gem::manage_gems was removed in 1.3.3.
Time::today was removed in 1.3.3.

1.3.5 Released

2009-07-21T00:00:00-07:00

Bug fixes:

Fix use of prerelease gems.
Gem.bin_path no longer escapes path with spaces. Bug #25935 and #26458.

Deprecation Notices:

Bulk index update is no longer supported (the code currently remains, but not the tests)
Gem::manage_gems was removed in 1.3.3.
Time::today was removed in 1.3.3.

1.3.3 Released

2009-05-04T00:00:00-07:00

New Features:

gem server allows port names (from /etc/services) with –port.
gem server now has search that jumps to RDoc. Patch #22959 by Vladimir Dobriakov.
gem spec can retrieve single fields from a spec (like gem spec rake authors).
Gem::Specification#has_rdoc= is deprecated and ignored (defaults to true)
RDoc is now generated regardless of Gem::Specification#has_rdoc?

Bug Fixes:

gem clean now cleans up –user-install gems. Bug #25516 by Brett Eisenberg.
Gem.bin_path now escapes paths with spaces.
Rake extension builder uses explicit correctly loads rubygems when invoking rake.
Prerelease versions now match “~>” correctly. Patch #25759 by Yossef Mendelssohn.
Check bindir for executables, not root when validating. Bug reported by David Chelimsky.
Remove Time.today, no way to override it before RubyGems loads. Bug #25564 by Emanuele Vicentini
Raise Gem::Exception for #installation_path when not installed. Bug #25741 by Daniel Berger.
Don’t raise in Gem::Specification#validate when homepage is nil. Bug #25677 by Mike Burrows.
Uninstall executables from the correct directory. Bug #25555 by Brett Eisenberg.
Raise Gem::LoadError if Kernel#gem fails due to previously-loaded gem. Bug reported by Alf Mikula.

Deprecation Notices:

Gem::manage_gems has been removed.
Time::today has been removed early. There was no way to make it warn and be easy to override with user code.

1.3.4 Released

2009-05-03T00:00:00-07:00

Bug Fixes:

Fixed various warnings
Gem::ruby_version works correctly for 1.8 branch and trunk
Prerelease gems now show up in gem list and can be used
Fixed option name for gem setup --format-executable
RubyGems now matches Ruby > 1.9.1 gem paths
Gem::RemoteFetcher#download now works for explicit Windows paths across drives. Bug #25882 by Lars Christensen
Fix typo in Gem::Requirement#parse. Bug #26000 by Mike Gunderloy.

Deprecation Notices:

Bulk index update is no longer supported (the code currently remains, but not the tests)
Gem::manage_gems was removed in 1.3.3.
Time::today was removed in 1.3.3.

1.3.2 Released

2009-04-15T00:00:00-07:00

Select New Features:

RubyGems now loads plugins from rubygems_plugin.rb in installed gems. This can be used to add commands (See Gem::CommandManager) or add install/uninstall hooks (See Gem::Installer and Gem::Uninstaller).
Gem::Version now understands prerelease versions using letters. (eg. ‘1.2.1.b’) Thanks to Josh Susser, Alex Vollmer and Phil Hagelberg.
RubyGems now includes a Rake task for creating gems which replaces rake’s Rake::GemPackageTask. See Gem::PackageTask.
Gem::find_files now returns paths in $LOAD_PATH.
Added Gem::promote_load_path for use with Gem::find_files
Added Gem::bin_path to make finding executables easier. Patch #24114 by James Tucker.
Various improvements to build arguments for installing gems.
gem contents added –all and –no-prefix.
Gem::Specification
- validate strips directories and errors on not-files.
- description no longer removes newlines.
- name must be a String.
- FIXME and TODO are no longer allowed in various fields.
- Added support for a license attribute. Feature #11041 (partial).
- Removed Gem::Specification::list, too much process growth. Bug #23668 by Steve Purcell.
gem generate_index
- Can now generate an RSS feed.
- Modern indicies can now be updated incrementally.
- Legacy indicies can be updated separately from modern.

Select Bugs Fixed:

Better gem activation error message. Patch #23082.
Kernel methods are now private. Patch #20801 by James M. Lawrence.
Fixed various usability issues with gem check.
gem update now rescues InstallError and continues. Bug #19268 by Gabriel Wilkins.
Allow ‘https’, ‘file’ as a valid schemes for –source. Patch #22485.
gem install
- Now removes existing path before installing. Bug #22837.
- Uses Gem::bin_path in executable stubs to work around Kernel#load bug in 1.9.
- Correctly handle build args (after –) via the API. Bug #23210.
–user-install
- gem install --no-user-install now works. Patch #23573 by Alf Mikula.
- gem uninstall can now uninstall from ~/.gem. Bug #23760 by Roger Pack.
setup.rb * Clarify RubyGems RDoc installation location. Bug #22656 by Gian Marco Gherardi.
- Allow setup to run from read-only location. Patch #21862 by Luis Herrera.
- Fixed overwriting ruby executable when BASERUBY was not set. Bug #24958 by Michael Soulier.
- Ensure we’re in a RubyGems dir when installing.
- Deal with extraneous quotation mark when autogenerating .bat file on MS Windows. Bug #22712.

Deprecation Notices:

Gem::manage_gems has been removed.
Time::today will be removed in RubyGems 1.4.

Special thanks to Chad Wooley for backwards compatibility testing and Luis Lavena and Daniel Berger for continuing windows support.

1.3.1 Released

2008-10-28T00:00:00-07:00

Bugs fixed:

Disregard ownership of ~ under Windows while creating ~/.gem. Fixes issues related to no uid support under Windows.
Fix requires for Gem::inflate, Gem::deflate, etc.
Make Gem.dir respect :gemhome value from config. (Note: this feature may be removed since it is hard to implement on 1.9.)
Kernel methods are now private. Patch #20801 by James M. Lawrence.
Gem::location_of_caller now behaves on Windows. Patch by Daniel Berger.
Silence PATH warning.

Deprecation Notices:

Gem::manage_gems will be removed on or after March 2009.

1.3.0 Released

2008-09-25T00:00:00-07:00

New features:

RubyGems doesn’t print LOCAL/REMOTE titles for gem query and friends if stdout is not a TTY, except with –both.
Added Gem.find_files, allows a gem to discover features provided by other gems.
Added pre/post (un)install hooks for packagers of RubyGems. (Not for gems themselves).
RubyGems now installs gems into ~/.gem if GEM_HOME is not writable. Use –no-user-install command-line switch to disable this behavior.
Fetching specs for update now uses If-Modified-Since requests.
RubyGems now updates the ri cache when the rdoc gem is installed and documentation is generated.

Deprecation Notices:

Gem::manage_gems now warns when called. It will be removed on or after March 2009.

Bugs Fixed:

RubyGems 1.3.0+ now updates when no previous rubygems-update is installed. Bug #20775 by Hemant Kumar.
RubyGems now uses the regexp we already have for gem list --installed. Bug

20876 by Nick Hoffman.
Platform is now forced to Gem::Platform::RUBY when nil or blank in the indexer. Fixes various uninstallable gems.
Handle EINVAL on seek. Based on patch in bug #20791 by Neil Wilson.
Fix HTTPS support. Patch #21072 by Alex Arnell.
RubyGems now loads all cache files even if latest has been loaded. Bug

20776 by Uwe Kubosch.
RubyGems checks for support of development dependencies for #to_ruby. Bug

20778 by Evan Weaver.
Now specifications from the future can be loaded.
Binary script uninstallation fixed. Bug #21234 by Neil Wilson.
Uninstallation with -i fixed. Bug #20812 by John Clayton.
Gem::Uninstaller#remove_all now calls Gem::Uninstaller#uninstall_gem so hooks get called. Bug #21242 by Neil Wilson.
Gem.ruby now properly escaped on windows. Fixes problem with extension compilation.
gem lock --strict works again. Patch #21814 by Sven Engelhardt.
Platform detection for Solaris was improved. Patch #21911 by Bob Remeika.

Other Changes Include:

gem help install now describes version argument to executable stubs
gem help environment describes environment variables and ~/.gemrc and /etc/gemrc
On-disk gemspecs are now read in UTF-8 and written with a UTF-8 magic comment
Rakefile * If the SETUP_OPTIONS environment variable is set, pass its contents as arguments to setup.rb
lib/rubygems/platform.rb * Remove deprecated constant warnings and really deprecate them. (WIN32, etc).
lib/rubygems/remote_fetcher.rb * Now uses ~/.gem/cache if the cache dir in GEM_HOME is not writable.
lib/rubygems/source_index.rb * Deprecate options to ‘search’ other than Gem::Dependency instances and issue warning until November 2008.
setup.rb * –destdir folder structure now built using Pathname, so it works for Windows platforms.
test/* * Fixes to run tests when under test/rubygems/. Patch by Yusuke ENDOH [ruby-core:17353].
test/test_ext_configure_builder.rb * Locale-free patch by Yusuke Endoh [ruby-core:17444].

1.2.0 Released

2008-06-21T00:00:00-07:00

New features:

RubyGems no longer performs bulk updates and instead only fetches the gemspec files it needs. Alternate sources will need to upgrade to RubyGems 1.2 to allow RubyGems to take advantage of the new metadata updater. If a pre 1.2 remote source is in the sources list, RubyGems will revert to the bulk update code for compatibility.
RubyGems now has runtime and development dependency types. Use #add_development_dependency and #add_runtime_dependency. All typeless dependencies are considered to be runtime dependencies.
RubyGems will now require rubygems/defaults/operating_system.rb and rubygems/defaults/#{RBX_ENGINE}.rb if they exist. This allows packagers and ruby implementers to add custom behavior to RubyGems via these files. (If the RubyGems API is insufficient, please suggest improvements via the RubyGems list.)
/etc/gemrc (and windows equivalent) for global settings
setup.rb now handles –vendor and –destdir for packagers
gem stale command that lists gems by last access time

Bugs Fixed:

File modes from gems are now honored, patch #19737
Marshal Gem::Specification objects from the future can now be loaded.
A trailing / is now added to remote sources when missing, bug #20134
Gems with legacy platforms will now be correctly uninstalled, patch #19877
gem install --no-wrappers followed by gem install --wrappers no longer overwrites executables
gem pristine now forces reinstallation of gems, bug #20387
RubyGems gracefully handles ^C while loading .gemspec files from disk, bug

20523
Paths are expanded in more places, bug #19317, bug #19896
Gem::DependencyInstaller resets installed gems every install, bug #19444
Gem.default_path is now honored if GEM_PATH is not set, patch #19502

Other Changes Include:

setup.rb * stub files created by RubyGems 0.7.x and older are no longer removed. When upgrading from these ancient versions, upgrade to 1.1.x first to clean up stubs. * RDoc is no longer required until necessary, patch #20414
gem server * Now completely matches the output of gem generate_index and has correct content types * Refreshes from source directories for every hit. The server will no longer need to be restarted after installing gems.
gem query --details and friends now display author, homepage, rubyforge url and installed location
gem install without -i no longer reinstalls dependencies if they are in GEM_PATH but not in GEM_HOME
Gem::RemoteFetcher now performs persistent connections for HEAD requests, bug #7973

1.1.1 Released

2008-04-11T00:00:00-07:00

Bugs Fixed:

Gem.prefix now returns non-nil only when RubyGems was installed outside sitelibdir or libdir.
The gem server gem list now correctly links to gem details.
gem update --system now passes –no-format-executable to setup.rb.
Gem::SourceIndex#refresh! now works with multiple gem repositories.
Downloaded gems now go into –install-dir’s cache directory.
Various fixes to downloading gem metadata.
gem install --force now ignores network errors too.
gem pristine now rebuilds extensions.
gem update --system now works on virgin Apple ruby.
Gem::RemoteFetcher handles Errno::ECONNABORTED.
Printing of release notes fixed.

1.1.0 Released

2008-03-29T00:00:00-07:00

New features:

RubyGems now uses persistent connections on index updates. Index updates are much faster now.
RubyGems only updates from a latest index by default, cutting candidate gems for updates to roughly 1/4 (at present). Index updates are even faster still. * gem list -r may only show the latest version of a gem, add –all to see all gems.
gem spec now extracts specifications from .gem files.
gem query --installed to aid automation of checking for gems.

Bugs Fixed:

RubyGems works with both Config and RbConfig now.
Executables are now cleaned upon uninstall.
You can now uninstall from a particular directory.
Updating from non-default sources fixed.
Executable stubs now use ruby install name in shebang.
gem unpack checks every directory in Gem.path now.
gem install now exits with non-zero exit code when appropriate.
gem update only updates gems that need updates.
gem update doesn’t force remote-only updates.
gem update handles dependencies properly when updating.
Gems are now loaded in Gem.path order.
Gem stub scripts on windows now work outside Gem.bindir.
gem sources -r now works without network access.

Other Changes Include:

RubyGems now requires Ruby > 1.8.3.
Release notes are now printed upon installation.
gem env path now prints a usable path.
gem install reverts to local-only installation upon network error.
Tar handling code refactoring and cleanup.
Gem::DependencyInstaller’s API has changed.

For a full list of changes to RubyGems, see the ChangeLog file.

1.0.1 Released

2007-12-20T00:00:00-08:00

Bugs Fixed:

Installation on Ruby 1.8.3 through 1.8.5 fixed
gem build on 1.8.3 fixed

Other Changes Include:

Since RubyGems 0.9.5, RubyGems is no longer supported on Ruby 1.8.2 or older, this is official in RubyGems 1.0.1.

1.0.0 Released

2007-12-20T00:00:00-08:00

Major New Features Include:

RubyGems warns about various problems with gemspecs during gem building
More-consistent versioning for the RubyGems software

Other Changes Include:

Fixed various bugs and problems with installing gems on Windows
Fixed using gem server for installing gems
Various operations are even more verbose with –verbose
Built gems are now backwards compatible with 0.9.4
Improved detection of RUBYOPT loading rubygems
ruby setup.rb now has a –help option
Gem::Specification#bindir is now respected on installation
Executable stubs can now be installed to match ruby’s name, so if ruby is installed as ‘ruby18’, foo_exec will be installed as ‘foo_exec18’
gem unpack can now unpack into a specific directory with –target
OpenSSL is no longer required by default

Deprecations and Deletions:

Kernel#require_gem has been removed
Executables without a shebang will not be wrapped in a future version, this may cause such executables to fail to operate on installation
Gem::Platform constants other than RUBY and CURRENT have been removed
Gem::RemoteInstaller was removed
Gem::Specification#test_suite_file and #test_suite_file= are deprecated in favor of #test_file and #test_file=
Gem::Specification#autorequire= has been deprecated
Time::today will be removed in a future version

0.9.5 Released

2007-11-19T00:00:00-08:00

Major New Features Include:

Platform support
Automatic installation of platform gems
New bandwidth and memory friendlier index file format
“Offline” mode (–no-update-sources)
Bulk update threshold can be specified (-B, –bulk-threshold)
New gem fetch command
gem now has “really verbose” output when you specify -v
Improved stubs and gem.bat on mswin, including better compatiblity with the One-Click Installer.

Other Changes Include:

Time::today is deprecated and will be removed at a future date
Gem::manage_gems is deprecated and will be removed at a future date
gem install --include-dependencies (-y) is now deprecated since it is the default, use –ignore-dependencies to turn off automatic dependency installation
Multi-version diamond dependencies only are installed once
Processing a YAML bulk index update takes less memory
gem install -i makes sure all depenencies are installed
gem update --system reinstalls into the prefix it was originally installed in
gem update --system respects –no-rdoc and –no-ri flags
HTTP basic authentication support for proxies
Gem::Specification#platforms should no longer be a String, use Gem::Platform::CURRENT when building binary gems instead
gem env has more diagnostic information
require ‘rubygems’ loads less code
sources.gem is gone, RubyGems now uses built-in defaults
gem install --source will no longer add –source by default, use gem sources --add to make it a permanent extra source
gem query (list) no longer prints details by default
Exact gem names are matched in various places
mkrf extensions are now supported
A gem can depend on a specific RubyGems version
gem_server is now gem server
gemlock is now gem lock
gem_mirror is now gem mirror
gemwhich is now gem which
gemri is no longer included with RubyGems
index_gem_repository.rb is now gem generate_index
gem performs more validation of parameters
Custom rdoc styles are now supported
Gem indexer no longer removes quick index during index creation
Kernel#require only rescues a LoadError for the file being required now
gem dependencies can now display some information for remote gems
Updating RubyGems now works with RUBYOPT=-rubygems

Special thanks to:

Daniel Berger
Luis Lavena
Tom Copeland
Wilson Bilkovich

0.9.4 Released

2007-05-23T00:00:00-07:00

If you are experiencing problems with the source index (e.g. strange “No Method” errors), or problems with zlib (e.g. “Buffer Error” messsage), we recommend upgrading to RubyGems 0.9.4.

Bug Fixes Include:

Several people have been experiencing problems with no method errors on the source index cache. The source index cache is now a bit more self healing. Furthermore, if the source index cache is irreparable, then it is automatically dropped and reloaded.
The source cache files may now be dropped with the “gem sources –clear-all” command. (This command may require root is the system source cache is in a root protected area).
Several sub-commands were accidently dropped from the “gem” command. These commands have been restored.

0.9.3 Released

2007-05-10T00:00:00-07:00

Bug Fixes Include:

The ZLib library on Windows will occasionally complains about a buffer error when unpacking gems. The Gems software has a workaround for that problem, but the workaround was only enabled for versions of ZLib 1.2.1 or earlier. We have received several reports of the error occuring with ZLib 1.2.3, so we have permanently enabled the work around on all versions.

0.9.2 Released

2007-02-05T00:00:00-08:00

Bug Fixes Include:

The “unpack” command now works properly.
User name and password are now passed properly to the authenticating proxy when downloading gems.

0.9.1 Released

2007-01-16T00:00:00-08:00

See ChangeLog

0.9.0 Released

2006-06-28T00:00:00-07:00

Finally, the much anticipated RubyGems version 0.9.0 is now available. This release includes a number of new features and bug fixes. The number one change is that we can now download the gem index incrementally. This will greatly speed up the gem command when only a few gems are out of date.

Major Enhancments include:

The gem index is now downloaded incrementally, only updating entries that are out of date. If more than 50 entries are out of date, we revert back to a bulk download.
Several patches related to allowing RubyGems to work with authenticating proxies (from Danie Roux and Anatol Pomozov). Just put the user and password in the proxy URL (e.g. -p http://user:password@proxy.address.com:8080) or use the HTTP_PROXY_USER and HTTP_PROXY_PASS environment variables.
The gem unpack command can now accept a file path rather than just a install gem name.
Both RI and RDOC documents are now generated by default.
A gemri command is included to read gem RI docs (only needed for Ruby 1.8.4 or earlier).

Minor enhancements include:

Verison 0.0.0 is now a valid gem version.
Better detection of missing SSL functionality.
SSL is not required if the security policy does not require signature checking.
Rake built extensions are now supported (Tilman Sauerbeck).
Several autorequire bug fixes.
–traceback is now an alias for –backtrace (I can never remember which one it is).
SAFE=1 compatibility fixes.
.rbw is now a supported suffix for RubyGem’s custom require.
Several Ruby 1.9 compatibility fixes (Eric Hodel).

Bug Fixes:

Added dashes to gemspecs generated in Ruby 1.8.3. This solves some cross-Ruby version compatibility issues.
Fixed bug where the wrong executables could be uninstalled (Eric Hodel).
Fixed bug where gem unpack occasionally unpacked the wrong gem.
Fixed bug where a fatal error occured when permissions on .gemrc were too restrictive (reported by Luca Pireddu).
Fixed prefix handling for native expressions (patch by Aaron Patterson).
Fixed several Upgrade => Update typos.

0.8.11 Released

2005-07-13T00:00:00-07:00

-y is a synonym for –include-dependencies.
Better handling of errors in the top level rescue clause.
Package list command (e.g. gem inspect GEM).
.gemrc now allows cvsrc-like options to set defaults per subcommand.
The autorequire gem spec field will now accept a list.
Substituted Time for Date in specs, increasing performance dramatically.
Fixed reported bug of gem directories ending in “-” (reported by Erik Hatcher).
Fixed but in installer that caused dependency installation to not work.
Added Paul Duncan’s gem signing patch.
Added Mark Hubbart’s Framework patch (for better integration with OS X).
Added David Glasser’s install-from-mirror patch.
Additional internal structural cleanup and test reorganization.

0.8.10 Released

2005-03-27T00:00:00-08:00

In multi-user environments, it is common to supply mulitple versions of gems (for example Rails), allowing individual users to select the version of the gem they desire. This allows a user to be insulated from updates to that gem. RubyGems 0.8.10 fixes a problem where gems could occasionally become confused about the current versions of libraries selected by the user.
The other annoying bug is that if there are any existing rubygems-update gems installed, then the “gem update –system” command will download a new update, but install the latest update prior to the download.

0.8.8 Released

2005-03-14T00:00:00-08:00

Moved the master definition of class Requirement back under version. Kept the body of Requirement under Gem.

0.8.7 Released

2005-03-14T00:00:00-08:00

Even though it has only been a few weeks since that last release, there are quite a number of new features in 0.8.7. A complete list of new features will be given below, but here is a summary of the hot items.

The bug that prevented some users from installing rails has been squashed. A big thanks to Bill Guindon (aGorilla) for helping track that one down.

There are several new commands available on the gem command:

gem cleanup GEMNAME – Cleanup (uninstall) all the old versions of gem. If the gem name is omitted, the entire repository is cleaned.
gem dependency GEMNAME – Show the dependencies for the named gems. This is really helpful when trying to figure out what gem needs what other gem.

There changes to the existing commands as well.

gem uninstall is much smarter about removing gems from the repository. Lists of gems are now uninstalled in proper dependency order (ie. if A depends on B, A is uninstalled first). Also, warnings about broken dependencies occur only when removing the last gem that supports a dependency is removed.

Both gem install and gem uninstall support some new command line options that can reduce the amount of yes/no queries given the user. For install we have:

–ignore-dependencies – Only install requests gems, no dependendecies are automatically installed.
–include-dependencies – Automatically install dependencies, without confirmation.

For gem uninstall, the new options are:

–all – Uninstall all matching gems without confirmation.
–ignore-dependencies – Uninstall, even if dependencies are broken.
–executables – Remove executables without confirmation

Under general cleanup, gems will not, by default, run RDoc on packages that do not have the RDoc flag set.

And finally there is a new library file ‘gemconfigure’ to aid in writing version sensitive applications (without undue dependencies on RubyGems); and ‘gemwhich’, a short script to locate libraries in the file system. You can read more about them here:

gemconfigure: http://docs.rubygems.org/read/chapter/4#page73
gemwhich: http://docs.rubygems.org/read/chapter/17

0.8.6 Released

2005-02-27T00:00:00-08:00

Fixed a small bug with shebang construction

0.8.5 Released

2005-02-26T00:00:00-08:00

Do you know how you used to dread getting the following message while installing gems?

Updating Gem source index for: http://gems.rubyforge.org

It could take up to 30 seconds (on my machine, even worse on others) for that crazy source index to update.

This latest release of RubyGems speeds that wait time up considerably. The following table gives the following times for installing RedCloth with a required source index update on three system we had available to us. No RDoc generation was included in the following times.

RubyGems Linux Mac OSX Windows 0.8.4 33 secs 73 secs 58 secs 0.8.5 8 secs 14 secs 21 secs

The new caching code is at least 3x faster than previous versions. Woo Hoo!

0.8.4 Released

2005-01-01T00:00:00-08:00

Rubygems 0.8.3’s installer was broken unless you already had an older version of RubyGems installed. That’s fixed.
Change in the way Gem::Specification internally deals with lazy attributes and defaults, bringing (with some loadpath_manager changes) a fairly significant increase in speed.
Support for lower-cased Gem file names (for you, Paul Duncan :)
Erik Veenstra’s patch for making Gem versions sortable.

0.8.3 Released

2004-12-07T00:00:00-08:00

No real earth shattering news here, but there were a number of really annoying issues involving other libraries that RubyGems depends upon. 0.8.3 contains some workarounds for these issues. In particular:

Added workaround for the null byte in Dir string issue. (see http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/121702). (Thanks to Mauricio Fernández for the quick response on this one).
Added workaround for old version of Zlib on windows that caused Ruwiki to fail to install. (see http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/121770)
Added workaround for large YAML file issues. (We dynamically cut down the size of the source index YAML file and seem to have worked around immediate issues.

There has been some minor usability enhancements and changes …

A user specific source index cache can be used when the site-wide cache is unwritable (i.e. because you are running as a non-admin). This greatly speeds up gem commands run in non-admin mode when the site-wide cache is out of date.
The gem command now used an HTTP HEAD command to detect if the server’s source index needs to be downloaed.
gem check gemname –test will run unit tests on installed gems that have unit tests.
Multiple gem names are allowed on the gem install command line. This means you can do:

gem install rake rails needle postgres-pr pimki

(Ok, you get the idea)
Multiple authors my be specified in a Gem spec.
Switched to using setup.rb (rather than a custom install script) for the installation of RubyGems itself. If you have installed RubyGems before, double check the installation instructions and make sure you use setup.rb instead of install.rb.
Ryan Davis has provided a patch so you can use an env variable (GEM_SKIP), to tell loadpath_manager not to load gems of those names. This was useful for him while testing libs that he had in development.

0.8.1 Released

2004-09-17T00:00:00-07:00

Quick release to capture some bug fixes.

0.8.0 Released

2004-09-15T00:00:00-07:00

Remove need for library stubs. Set the RUBYOPT environment variable to include “rrubygems”, and a normal require will find gem files. Continue to use ‘require_gem gem_name, version’ to specify gem versions.
Deprecated “test_suite_file” gemspec attribute in favor of “test_files” array.
Generates rdoc by default on installs.
Adopted tar/gzip file format, thanks to Mauricio Fernandez.
“gem rdoc” allows generation of rdoc after gem installation (will add a “gem test”
Application stubs can now accept an optional parameter of VERSION that will run an arbitrary version of the application requested.
Various bug fixes
Various platform-independency improvements
“gem spec –all” displays spec info for all installed version of a given gem.
Dynamic caching of sources
Support for user-definable sources on the command line (thanks Assaph Mehr)
More intelligent support for platform-dependent gems. Use Platform::CURRENT when building a gem to set its platform to the one you’re building on. Installation displays a choice of platform-dependent gems, allowing the user to pick.
Added “gem unpack” for “unpacking” a gem to the current directory

0.7.0 Released

2004-07-09T00:00:00-07:00

See ChangeLog

0.6.1 Released

2004-06-08T00:00:00-07:00

See ChangeLog

0.6.0 Released

2004-06-08T00:00:00-07:00

Collapse output of –search and –list (and gem_server) operations so that each gem is listed only once, with each of its versions listed on the same line.
bin/gem: new –upgrade-all option allows one to upgrade every installed gem
new #required_ruby_version attribute added to gem specification for specifying a dependency on which version of ruby the gem needs. Format it accepts is the same as the Gem::Version::Requirement format:

spec.required_ruby_version = “> 1.8.0”
–install-stub defaults to true, so library stubs are created

0.5.0 Released

2004-06-06T00:00:00-07:00

Jim added the ability to specify version constraints to avoid API incompatibilities. This has been the subject of much debate for the past couple of months, with many ideas and code contributed by Eivind Eklund and Mauricio Fernandez. The following set of assertions shows how it works:

assert_inadequate(“1.3”, “~> 1.4”) assert_adequate( “1.4”, “~> 1.4”) assert_adequate( “1.5”, “~> 1.4”) assert_inadequate(“2.0”, “~> 1.4”) # This one is key–the new operator # disallows major version number # differences.
Group gem search output when multiple versions exist for a given gem:

activerecord (0.7.8, 0.7.7, 0.7.6, 0.7.5) Implements the ActiveRecord pattern for ORM.
Add arbitrary RDoc-able files via gemspec (not just Ruby source files) for people who have, for example, README.rdoc in their distributions. Add to gemspec via: spec.extra_rdoc_files = [“list”, “of”, “files”]. Ruby files are automatically included.
Some small bug fixes

0.4.0 Released

2004-05-30T00:00:00-07:00

Minor bug fixes including Windows compatability issues

0.3.0 Released

2004-04-30T00:00:00-07:00

Cleanup of command-line arguments and handling. Most commands accept a –local or –remote modifier.
Creation of Application Gems (packages that include executable programs). See http://rubygems.rubyforge.org/wiki/wiki.pl?DeveloperGuide for information on how to use it.
Basic functionality for installing binary gems from source (:extensions property of gem specification holds an array of paths to extconf.rb files to be used for compilation)
Install library “stub” allowing a normal ‘require’ to work (which then does the rubygems require and ‘require_gem’
–run-tests runs the test suite specified by the “test_suite_file” property of a gem specification
HTTP Proxy support works. Rewrite of HTTP code.
Unit and functional tests added (see Rakefile).
Prompt before remote-installing dependencies during gem installation.
Config file for storing preferences for ‘gem’ command usage.
Generally improved error messages (still more work to do)
Rearranged gem directory structure for cleanliness.

0.2.0 Released

2004-03-14T00:00:00-08:00

Initial public release

RubyGems Blog

Post-Mortem of Today's Partial Outage

New blog design

2.0.3 Released

2.0.2 Released

2.0.1 Released

2.0.0 Released

2.0.0.rc.2 Released

Data Verification

The Incident

Data Verification

Exploits and Checksums

Mirrors

Results

Data and Tools

Thanks

Rubygems 2.0.0.preview2

Breaking changes

Major enhancements

Minor enhancements

Bug fixes

Rubyconf / Rubygems Hackfest

1.8.19 Released

1.8.16 Released

Shaving a YAML Yak

TL;DR

Gemspecs and YAML

YAML and Ruby’s standard library

Dealing with =

Gemspec revisited

rubygems.org

Command line errors

How can we fix this?

1.8.10 Released

1.8.9 Released

1.8.8 Released

1.8.7 Released

1.8.6 Released

1.8.5 Released

1.8.4 Released

1.8.3 Released

1.8.2 Released

1.8.1 Released

1.8.0 Released

1.7.1 Released

1.7.0 Released

1.6.2 Released

1.6.1 Released

1.6.0 Released

1.5.3 Released

1.5.2 Released

1.5.1 Released

NOTE: gem update --system is broken. See UPGRADING.rdoc.

1.5.0 Released

NOTE: gem update --system is broken. See UPGRADING.rdoc.

1.4.2 Released

1.4.1 Released

1.4.0 Released

1.3.7 Released

1.3.6 Released

1.3.5 Released

1.3.3 Released

1.3.4 Released

1.3.2 Released

1.3.1 Released

1.3.0 Released

20876 by Nick Hoffman.

20776 by Uwe Kubosch.

20778 by Evan Weaver.

1.2.0 Released

20523

1.1.1 Released

1.1.0 Released

1.0.1 Released

1.0.0 Released

0.9.5 Released

0.9.4 Released

0.9.3 Released

0.9.2 Released

0.9.1 Released

Dealing with `=`

NOTE: `gem update --system` is broken. See UPGRADING.rdoc.

NOTE: `gem update --system` is broken. See UPGRADING.rdoc.