Skip to content

Comments

fix: Ensure trailing slash is added to source URIs added via gem sources#9055

Open
zirni wants to merge 3 commits intoruby:masterfrom
zirni:fix-gem-sources-trailing-slash
Open

fix: Ensure trailing slash is added to source URIs added via gem sources#9055
zirni wants to merge 3 commits intoruby:masterfrom
zirni:fix-gem-sources-trailing-slash

Conversation

@zirni
Copy link

@zirni zirni commented Nov 5, 2025

GitHub's private gem registry expects the first path segment after the host
to represent the namespace, typically the organization or user name. [1]

When adding a source with

  gem sources --add https://user:password@rubygems.pkg.github.com/my-org

without a trailing slash, the last path segment ("my-org") is interpreted as a
file and removed during relative path resolution. This causes the resulting
URI to become

  https://user:password@rubygems.pkg.github.com/gems/foo.gem

instead of the correct

  https://user:password@rubygems.pkg.github.com/my-org/gems/foo.gem. [2]

Example error:

  gem source -a https://user:password@rubygems.pkg.github.com/my-org
  gem install -rf foo.gem
  rubygems/remote_fetcher.rb:238:in `fetch_http': bad response Not Found 404 (https://user:REDACTED@rubygems.pkg.github.com/gems/foo-0.7.1.gem) (Gem::RemoteFetcher::FetchError)

Although this behavior complies with RFC 2396, it's incompatible with GitHub's
gem registry requirements.

The remote fetcher is just append a relative path without using ./ [3]

To address this, we automatically append a trailing slash when adding new gem
sources.

As illustrated in [4] and [5], given the base URI

  http://a/b/c/d;p?q

and a relative path

  g/f

the resolution process replaces "d;p?q" and yields

  http://a/b/c/g/f

[1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry#authenticating-with-a-personal-access-token
[2] https://github.com/ruby/rubygems/blob/master/lib/rubygems/vendor/uri/lib/uri/generic.rb#L1053
[3] https://github.com/ruby/rubygems/blob/master/lib/rubygems/remote_fetcher.rb#L148
[4] https://www.rfc-editor.org/rfc/rfc2396#section-5.2
[5] https://www.rfc-editor.org/rfc/rfc2396#appendix-C

zirni and others added 3 commits February 13, 2026 12:12
GitHub's private gem registry expects the first path segment after the host
to represent the namespace, typically the organization or user name. [1]

When adding a source with
```
  gem sources --add https://user:password@rubygems.pkg.github.com/my-org
```

without a trailing slash, the last path segment ("my-org") is interpreted as a
file and removed during relative path resolution. This causes the resulting
URI to become
```
  https://user:password@rubygems.pkg.github.com/gems/foo.gem
```

instead of the correct
```
  https://user:password@rubygems.pkg.github.com/my-org/gems/foo.gem. [2]
```

Example error:
```
  gem source -a https://user:password@rubygems.pkg.github.com/my-org
  gem install -rf foo.gem
  rubygems/remote_fetcher.rb:238:in `fetch_http': bad response Not Found 404 (https://user:REDACTED@rubygems.pkg.github.com/gems/foo-0.7.1.gem) (Gem::RemoteFetcher::FetchError)
```

Although this behavior complies with RFC 2396, it's incompatible with GitHub's
gem registry requirements.

The remote fetcher is just append a relative path without using ./ [3]

To address this, we automatically append a trailing slash when adding new gem
sources.

As illustrated in [4] and [5], given the base URI
```
  http://a/b/c/d;p?q
```
and a relative path
```
  g/f
```
the resolution process replaces "d;p?q" and yields
```
  http://a/b/c/g/f
```

[1] https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry#authenticating-with-a-personal-access-token
[2] https://github.com/ruby/rubygems/blob/master/lib/rubygems/vendor/uri/lib/uri/generic.rb#L1053
[3] https://github.com/ruby/rubygems/blob/master/lib/rubygems/remote_fetcher.rb#L148
[4] https://www.rfc-editor.org/rfc/rfc2396#section-5.2
[5] https://www.rfc-editor.org/rfc/rfc2396#appendix-C
Co-authored-by: Sutou Kouhei <kou@cozmixng.org>
@hsbt hsbt force-pushed the fix-gem-sources-trailing-slash branch from a9fbf4c to 7a78385 Compare February 13, 2026 03:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants