gemspec should accept array as allowed_push_host

[hadmut]

Hi,
a gemspec file can contain a line like
spec.metadata["allowed_push_host"] = "http://localhost:9292"
(and should) to restrict where a gem can be pushed to.

However, it accepts a single string only. But especially when using privat gem stores there's often reason to use more than one for the same gem, e.g. one at the regular office and one at home for home-office. So it would be practical, if the gemspec would allow an array of strings (or even regular expressions) as allowed_push_hosts.

[hadmut]

Any news?

Maybe the easiest way to open this to multiple hosts is to accept a lambda expression, where the push host is given as a parameter and the lambda returns boolean to allow or not, thus giving the gem author full control.

regards
Hadmut

[simi]

Hello @hadmut, I'm going to implement this. Would ability to provide list of allowed_push_host entries ok for your use-case for now?

[hadmut]

Hi, thanks! :-)

Yes, for me, personally, the possibility to just assign an array of strings instead of a single string would solve my problem and make me totally happy.

However, I was thinking about how to implement it in a way that makes others happy too and avoids further feature requests. My first idea was to allow regular expressions as well, but the most ruby-ish way would be to accept lambda expressions/Procs as well.

I would – just a proposal – replace the part
if allowed_push_host
allowed_host_uri = URI.parse(allowed_push_host)
host_uri = URI.parse(self.host)
...

in gemcutter_utilities with something like

host_uri = URI.parse(self.host)

unless case allowed_push_host
when nil ; true
when String ; (host_uri.scheme == allowed_host_uri.scheme) && (host_uri.host == allowed_host_uri.host)
when Array ; allowed_push_host.find {|x| ...like with string ...}
when Regexp ; self.host =~ allowed_push_host
when Proc ; allowed_push_host.call(self.host)
else # some error message
end
alert_error ...
terminate_...
end

best regards
Hadmut

[simi]

The potential problem in here is serializing/deserializing of gemspec @hadmut. Keeping simple values makes it easier.

[simi]

I was looking at this again. allowed_push_host is part of metadata and metadata has limitation of being string values only. IMHO that's good to keep. Would it make sense to add additional respected metadata allowed_push_hosts with comma separated hosts? Notice there is limit of 1024 string size for the metadata value.

Alternatively we can provide whole new gemspec API to address more issues like #3093.

@martinemde WDYT?

[martinemde]

Any older rubygems would not respect this change, so we should make sure to still write the first host to the original allowed_push_host.

We have other array fields in gemspec, but that would require moving this out of metadata. Adding a text field that's actually an array isn't great, because either way we have to change future rubygems to be able to interpret it. How hard would that be to add as a non-metadata field?

[simi]

@martinemde I believe that's the same problem as when allowed_push_host was introduced. Clearly older RubyGems ignores that. It seems metadata are mis-used for this purpose currently. Onboarding new gemspec entry will be amazing. We can also try to make some infrastructure to not fail like invalid method allowed_push_host=, but somehow warn about invalid entry and ask for upgrade to potentially fix this.