Circular Reference Issue with Bundler 4.0.* checksum verification during DEPLOYMENTS

[RailsCod3rFuture]

Main Problem: Bundler attempts to update checksums when local is set to true if no checksum is present for a gem entry and the bundle config is set to lock during this phase and it breaks the deployment.

Re-create:

1. Gemfile

  gem 'autoprefixer-rails'
  gem 'json'
  gem 'jquery-rails'

2. Install ruby 3.2.6
3. gem install bundler -v 4.0.6
4. bundle 4.0.6 install
5. remove checksum value from gemfile.lock entry
6. run bundle config set frozen true

Ansible script runs below:

cmd: |
  source rvm
  rvm use 3.2.6@app_gemset --create --default 
  bundle lock --add-checksum
  bundle config set --local deployment true
  bundle config set --local without "development:test"
  bundle install

ERROR RESPONSE:
Your lockfile has an empty CHECKSUMS entry for "gem". but can't be updated because frozen mode is set. I think this needs to be more compatible with deployment builds of ruby gems.

[simi]

Hello, I was able to reproduce your case.

Just to ensure, for step - remove checksum value from gemfile.lock entry is that something you do on purpose? Or any idea how entry without checksum infected your Gemfile.lock? Is that caused by bug? Missing checksum means invalid lockfile for frozen bundle. I suggest to find out the reason for missing checksum over fighting the frozen bundle.

[RailsCod3rFuture]

We sometimes run rvm on first install while deploying to update the available ruby builds in case the server is missing them. I'm not sure if its a first time only event when the gemset is fresh. But, shouldn't it force re-bundle if the checkum doesn't look correct? When we run something like bundle 4.0.3 install and then someone installs the latest bundler and runs bundle 4.0.6 install - I see that some checksum values aren't present

[simi]

It is still not quite clear why Gemfile.lock is generated without checksum 🤔.

But, shouldn't it force re-bundle if the checkum doesn't look correct?

Frozen bundle is by design read-only, not intended to be updated (re-bundled).

[RailsCod3rFuture]

I found a way around it with our deployment tool and thats to turn off frozen mode before it reaches the point of bundle install....I think that might be the best solution for now at least. The checksum issue caught us by surprise - given that it didnt happen with 4.0.3. Maybe we can come up with a long term technique to handle deployment mode more efficiently later.

[simi]

Glad you have resolved the issue. If you ever find out more info why the checksum is missing, happy to help more.

[RailsCod3rFuture]

I will look into whether or not jfrog/rubygems is the main culprit for failing to set the checksums - as we use both rubygems and artifactory for jfrog to store our gems.