fix: further isolate bundled jars/wars from wider environment - #650
Merged
Conversation
Currently there are many gotchas with warbler's bundling that require user awareness. We can do much better to "do the right thing" by defualt, by setting opinionated bundler config that is baked into the warbled application. This change - bakes in a `.bundle/config` to the application, rather than relying on env vars, to ensure the strongest level of enforcement - ensures the following settings - `BUNDLE_VERSION = system` - ensure that bundler never tries to switch versions; and clarify that bundler will always run from the given jruby version's bundler. - `BUNDLE_FROZEN = true` - invert the previous default. Frozen should be the default, for both security and correctness. Users can still opt-out, if we have missed some case. - `BUNDLE_PATH__SYSTEM = true` - not strictly necessary, but clarifies that the jars/wars Warbler creates put all the gems onto what is effectively the system path at runtime. - `BUNDLE_AUTO_INSTALL = false` - enforce that installation of gems at runtime is impossible. Doubt anyone opts-in for this, but clarify that it won't work, and goes against the design goals of warbler. Also cleans things up related bugs for modern bundler - properly excludes default gem stubs from being included, which for bundler can cause `CorruptBundlerInstallError` if there is any version mismatch. - avoid duplicate gems when bundling relative path dependencies (jruby#465) - remove unnecessary legacy `:warbler_excluded` workaround for bundler issue handling excluded git specs (from jruby#42) - correct support for `gem_excludes` within bundler git specs. (jruby#331)
chadlwilson
marked this pull request as ready for review
August 29, 2026 09:46
This was
linked to
issues
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently there are many gotchas with warbler's bundling that require user awareness. We can do much better to "do the right thing" by default, by setting opinionated bundler config that is baked into the warbled application. This change
.bundle/configto the application, rather than relying on env vars, to ensure the strongest level of enforcement of isolation that will otherwise break the warbled jar/warBUNDLE_VERSION = system- ensure that bundler never tries to switch versions; and clarify that bundler will always run from the given jruby version's bundler.BUNDLE_FROZEN = true- invert the previous default. Frozen should be the default, for both security and correctness. Users can still opt-out, if we have missed some case.BUNDLE_PATH__SYSTEM = true- not strictly necessary, but clarifies that the jars/wars Warbler creates put all the gems onto what is effectively the system path at runtime.BUNDLE_AUTO_INSTALL = false- enforce that installation of gems at runtime is impossible. Doubt anyone opts-in for this, but clarify that it won't work, and goes against the design goals of warbler.Also cleans up related bugs for modern bundler
CorruptBundlerInstallErrorif there is any version mismatch.:path#465):warbler_excludedworkaround for bundler issue handling excluded git specs (from warbler 1.3.1 - git gems not loaded #42) Git specs may still have some other problems however.gem_excludeswithin bundler git specs. (config.gem_excludes not working for bundle/git gems #331) Git specs may still have some other problems however.