Disable default source when using user-supplied gem source #265
Conversation
The `clear_sources` property does not remove the default gem source when the RubyGems package provider does its work. We need to also set the `include_default_source` property to false to ensure users' requesting gem source is the only gem source used (instead of rubygems.org, for example). Signed-off-by: Adam Leff <adam@leff.co>
|
🤔 the Likely would have to be handled differently to continue backwards client compatibility. |
|
@jeremymv2 true, so this would be a question for @chris-rock how far back our backward-compat policy is for the audit cookbook and Chef version. I'll add some guards around it in the meantime. |
|
For posterity, this property has been in Chef stable since 13.0 |
|
In the past we've decided on minimum version 12.5.1 https://github.com/chef-cookbooks/audit/blob/master/metadata.rb#L13 I think the guards are the way to go. |
This will protect against backward compat issues, allowing the old `clear_sources` behavior dating back to Chef 12.x to continue to work. Signed-off-by: Adam Leff <adam@leff.co>
|
And it is now appropriate guarded, @jeremymv2 :) |
|
The Travis tests are due to a breakage between berkshelf/solve and molinillo which cases cookbooks in the dependency chain to go missing. I've tested everything locally using an older ChefDK and it tests well, so I'm going to merge this. |
The
clear_sourcesproperty does not remove the default gem source when the RubyGems package provider does its work. We need to also set theinclude_default_sourceproperty to false to ensure users' requesting gem source is the only gem source used (instead of rubygems.org, for example).