Cannot use third-party rubygems repositories whose URLs include HTTP basic auth

jruby-gradle / jruby-gradle-plugin

A Gradle plugin for working with JRuby projects for fun and profit. Mostly profit.

http://jruby-gradle.org

Other

93 stars 38 forks source link

Cannot use third-party rubygems repositories whose URLs include HTTP basic auth #302

Open ayqazi opened 7 years ago

ayqazi commented 7 years ago

If a Rubygems repository has basic auth information in it (i.e. https://yourusername:password@example.com ) then the built-in gem proxy fails to be able to download anything from it.

Example stacktrace at this gist

Easy way to reproduce:

Create account at https://gemfury.com/
Upload a custom gem
Follow instructions to find your private repository URL (will include your API token which you must generate)
Try to use gem using plugin

rtyler commented 7 years ago

@raelik did some digging and found what looks like a missing else statement.

There is probably a bug lying somewhere around in rubygems-servlets, we might need @mkristian's help

mkristian commented 7 years ago

I am currently more offline then online being in Ladakh/India - will attend to this bug on rubygems-servlets.

mkristian commented 7 years ago

FYI I applied the suggested patch with: https://github.com/torquebox/mavengem/commit/60a5fd39e09c50c9bc2364a8d9524f52f0c30bda

note that the rubygems-tools did move to torquebox/mavengem and once this is green on travis I am going to release it which allows a new release of rubygem-servlets. might need help to verify the patch on gradle.

apalopta commented 6 years ago

Me too, I'd like to have a solution for this bug. I have to download from Nexus with credentials, which is not possible :-(

I need it for AscidoctorJ for revealjs backend in a Gradle environment.

ysb33r commented 6 years ago

I need it for AscidoctorJ for revealjs backend in a Gradle environment.

@apalopta FYI The 2.0-alpha.4 release of the Asciidoctor Gradle plugin will have support directly for Reveal.js.

apalopta commented 6 years ago

I'm looking forward to it :-)

rtyler commented 5 years ago

@apalopta @ayqazi would either of you be able to clarify whether this issue still exists?

ayqazi commented 5 years ago

I haven't used JRuby for years, sorry.

ysb33r commented 5 years ago

Once #365 is accepted, we are going to have to deal with this.. It will require:

[ ] adding something to ruby.gems so that credentials are exposed.
[ ] Passing credentials thtough to the proxy registry service
[ ] Allow the current GEMs proxy side to use those credentials.

All of the above rely on the trust that the remote site also implements the same REST API as rubygems.org.

mkristian commented 5 years ago

@ysb33r in https://github.com/jruby-gradle/jruby-gradle-plugin/issues/302#issuecomment-418465174 says @apalopta is using Nexus and Nexus just offers quick/Marshal.4.8 and api/v1/dependencies endpoints !

ysb33r commented 5 years ago

@mkristian :scream_cat: We'll have to do a 2nd set of functionality by the looks of it.