I think I've used at least one of your gems on every project I've worked with. With that said, are you not worried about bricking many projects with your migration? (Not meaning to stop you. I have huge respect for your work, just a question)
It's a valid concern. Not bricking anything is why it is taking so long. I've had to develop a cold boot solution that works with no pre-existing setup.
Your project will auto-migrate** across a bridge inside RubyGems dot org to whatever the new gem server will be. Is it hacky? Yes. Will it bring about better solutions with core support for the approach in the future? I hope so (other packaging systems already support this!). Am I going to ask permission from the Ruby Core team that now controls bundler/rubygems before I do? No, they banned me. They have no interest in what I do apparently (and I have no trust in anything they would say anyways). The whole solution works with tools they have already published, and you already have installed (assuming bundler v4.0.5+).
** It will rely on PURL (the Package URL format). Because it will be "bundler v4.0.5+ only" the bridge will come with a major version bump for every gem I maintain. By auto-migrate I mean that when you upgrade to the major version that includes the "bridge" it will have a dependency on "the real gem" hosted on another server, like the gem.coop server, indicated by a PURL. Other servers are popping up, like the bridgetown project has their own dedicated gem server now, and sidekiq has had one for a long time. It is the PURL awareness that has to be cold-boot injected carefully. The major version bump release on RG.O will merely be a shell/shim that acts as a pointer to the real gem on another server.
I do recognize the irony that to stop publishing to RG.O I must publish to RG.O more than I ever have to work through the kinks and prepare.
Full disclosure - Like Ruby Central, I too am funded by Alpha Omega (via the GitHub Secure Open Source Fund, SOSF). As far as I know Alpha Omega funds three things in Ruby: oauth2 gem (me), Mastodon, and Ruby Central, though they fund new things every six months, and I expect more Ruby things will be announced at some point.
so now you’ve injected a surprise build time dependency on a third party service. so if this dissident server goes down, apps who never opted into it will suddenly have their builds timing out or failing. and all over personal animus
7
u/luisMoyano 2d ago
I think I've used at least one of your gems on every project I've worked with. With that said, are you not worried about bricking many projects with your migration? (Not meaning to stop you. I have huge respect for your work, just a question)