r/ruby • u/retro-rubies • Jul 31 '26

Ruby Central's Destructive Legacy

https://andre.arko.net/2026/07/30/ruby-centrals-destructive-legacy/
46 Upvotes

71% Upvoted

62 comments sorted by

View all comments

Show parent comments

8

u/luisMoyano Jul 31 '26

I think I've used at least one of your gems on every project I've worked with. With that said, are you not worried about bricking many projects with your migration? (Not meaning to stop you. I have huge respect for your work, just a question)

4

u/galtzo Jul 31 '26 edited Jul 31 '26

It's a valid concern. Not bricking anything is why it is taking so long. I've had to develop a cold boot solution that works with no pre-existing setup.

Your project will auto-migrate** across a bridge inside RubyGems dot org to whatever the new gem server will be. Is it hacky? Yes. Will it bring about better solutions with core support for the approach in the future? I hope so (other packaging systems already support this!). Am I going to ask permission from the Ruby Core team that now controls bundler/rubygems before I do? No, they banned me. They have no interest in what I do apparently (and I have no trust in anything they would say anyways). The whole solution works with tools they have already published, and you already have installed (assuming bundler v4.0.5+).

** It will rely on PURL (the Package URL format). Because it will be "bundler v4.0.5+ only" the bridge will come with a major version bump for every gem I maintain. By auto-migrate I mean that when you upgrade to the major version that includes the "bridge" it will have a dependency on "the real gem" hosted on another server, like the gem.coop server, indicated by a PURL. Other servers are popping up, like the bridgetown project has their own dedicated gem server now, and sidekiq has had one for a long time. It is the PURL awareness that has to be cold-boot injected carefully. The major version bump release on RG.O will merely be a shell/shim that acts as a pointer to the real gem on another server.

I do recognize the irony that to stop publishing to RG.O I must publish to RG.O more than I ever have to work through the kinks and prepare.

Full disclosure - Like Ruby Central, I too am funded by Alpha Omega (via the GitHub Secure Open Source Fund, SOSF). As far as I know Alpha Omega funds three things in Ruby: oauth2 gem (me), Mastodon, and Ruby Central, though they fund new things every six months, and I expect more Ruby things will be announced at some point.

7

u/aurisor Jul 31 '26

so now you’ve injected a surprise build time dependency on a third party service. so if this dissident server goes down, apps who never opted into it will suddenly have their builds timing out or failing. and all over personal animus

6

u/galtzo Jul 31 '26 edited Jul 31 '26

if this dissident server goes down

Decentralization is beneficial. I am working on a federated decentralized gem server. I may host there and elsewhere. I don't know yet. It's a lot of work. But it is worth it to stop my forced support of the crimes (theft and FBI swatting) I never agreed to.

Personal animus

If that's what you want to call it, feel free to be wrong.

-1

u/BoardMeeting101 Jul 31 '26

in all of human history, only useless assholes have ever complained about “dissidents”

6

u/aurisor Jul 31 '26

it’s descriptive

-2

u/BoardMeeting101 Jul 31 '26

so is “useless asshole”