Non-Compliance with Dependency API Deprecation

[LukeIGS]

https://blog.rubygems.org/2023/02/22/dependency-api-deprecation.html

From this document:
March 22 at 00:00 UTC (4pm PT / 7pm ET) for 5 minutes
March 29 at the top of every hour UTC for 10 minutes
April 03 for the entire day UTC
April 10 from 00:00 UTC onward

As of April 10th the dependency API on rubygems.org will be deprecated. They're running a test brownout today on the third. Attempting to pull gems via the rubygems proxy will return a 404 error, like this one.
https://gist.github.com/LukeIGS/d28433f789bcba619e1b50885adb38f9

[Eusebius1920]

Is there any way fixing this? A workaround?

May 10th is approaching...

[natebird]

This PR uses the modern ruby gems API - #435

[github-actions]

Could you update this issue?

[Eusebius1920]

Any news on this or #435 ?

[marvinthepa]

It seems that the workaround that the jfrog guys describe also works for geminabox:
https://jfrog.com/help/r/artifactory-rubygems-org-dependency-api-deprecation/possible-workaround

If you are not using a reverse-proxy and want a quick-and-dirty fix, just find server.rb and edit the two routes:

    get '/api/v1/dependencies' do
      halt 404, "https://github.com/geminabox/geminabox/issues/536" 
      #query_gems.any? ? Marshal.dump(gem_list) : 200
    end

    get '/api/v1/dependencies.json' do
      halt 404, "https://github.com/geminabox/geminabox/issues/536" 
      #query_gems.any? ? gem_list.to_json : {}
    end

[LukeIGS]

The issue with that solution is that it's wildly slow, the real solution here is to get that PR listed above merged. We've been testing a solution based off of it for a couple of weeks now and haven't found any issues, i plan to merge it upstream.

[marvinthepa]

That is why I wrote "workaround", "quick-and-dirty fix", and not "solution".

Of course merging the pull request would be better, but that is outside of my power. So I thought others might be interested in a workaround as well.

[LukeIGS]

Another work around is to simply pull either mine or @skaes changes and execute from source or package and distribute it as a gem.

[jlahtinen]

4b6d853

This works with Geminabox.allow_remote_failure = true also.

[vshunkov]

Not sure if #435 resolves the issue of API dependency deprecation. I have built an image based on it, but I am still encountering the same problem as with the master branch. Has anyone else attempted to test it as well?

[LukeIGS]

435 wasn't 100% complete, #547 works somewhat, with the minor caveat of there being high potential for out of memory situations due to the sheer size of the versions file that's returned by rubygems.org. One solution of course would lie in being able to stream the response and write the file chunk by chunk. Currently the rubygems.org apis don't support streaming requests as far as i can tell though. It does however build and run fine as far as i can tell provided you give it like 4 gigs of memory to work with...

[github-actions]

Could you update this issue?

[github-actions]

Could you update this issue?

[LukeIGS]

Still in dev

[github-actions]

Could you update this issue?

[marvinthepa]

@github-actions You are starting to sound like a broken record.

Btw. if somebody is searching for another workaround (using different software): Nexus OSS seems to have fixed the issue, and supports many more package formats besides rubygems.

[github-actions]

Could you update this issue?

[LukeIGS]

ping.

[github-actions]

Could you update this issue?

[LukeIGS]

Sneaky github actions bot closing this while i was out for holiday.
Could a contributor reopen this?