openc3 7.3.0 → 7.4.0

data/lib/openc3/microservices/interface_microservice.rb

@@ -221,7 +221,12 @@ module OpenC3
               next 'SUCCESS'
             end
             if msg_hash.key?('interface_details')
-              next @interface.details.as_json.to_json(allow_nan: true)
+              begin
+                next @interface.details.as_json.to_json(allow_nan: true)
+              rescue => e
+                @logger.error "#{@interface.name}: interface_details: #{e.formatted}"
+                next e.message
+              end
             end
           end
 
@@ -508,7 +513,12 @@ module OpenC3
             next 'SUCCESS'
           end
           if msg_hash.key?('router_details')
-            next @router.details.as_json.to_json(allow_nan: true)
+            begin
+              next @router.details.as_json.to_json(allow_nan: true)
+            rescue => e
+              @logger.error "#{@router.name}: router_details: #{e.formatted}"
+              next e.message
+            end
           end
           next 'SUCCESS'
         end
@@ -610,7 +620,26 @@ module OpenC3
     # Called to connect the interface/router. It takes optional parameters to
     # rebuilt the interface/router. Once we set the state to 'ATTEMPTING' the
     # run method handles the actual connection.
+    # Connecting an interface/router which is already CONNECTED is a no-op.
+    # Without this the existing (working) connection would be torn down and
+    # rebuilt which can take up to the read_timeout to detect. Callers who want
+    # to force a reconnect should disconnect first or pass new parameters.
     def attempting(*params)
+      if params.empty? and @interface.state == 'CONNECTED' and @interface.connected?
+        @logger.info "#{@interface.name}: Connect ignored, already connected"
+        return @interface
+      end
+
+      attempt_connection(*params)
+    end
+
+    # Sets the state to 'ATTEMPTING', first rebuilding the interface/router if
+    # parameters are given, so the run method performs the actual connection.
+    # Unlike attempting() this always transitions. The reconnect path in
+    # disconnect() requires that, since @interface.disconnect may have raised or
+    # left connected? true, which would make attempting() ignore the request and
+    # leave the interface stuck in 'CONNECTED' with no way back to a connection.
+    def attempt_connection(*params)
       unless params.empty?
         @interface.disconnect()
         # Build New Interface, this can fail if passed bad parameters
@@ -828,6 +857,13 @@ module OpenC3
 
     def connect
       @logger.info "#{@interface.name}: Connect #{@interface.connection_string}"
+      # Interface connect implementations typically overwrite their stream / socket
+      # so cleanly close any existing connection rather than leaking it
+      begin
+        @interface.disconnect if @interface.connected?
+      rescue => e
+        @logger.error "Disconnect: #{@interface.name}: #{e.formatted}"
+      end
       begin
         @interface.connect
         @interface.post_connect
@@ -849,38 +885,49 @@ module OpenC3
     end
 
     def disconnect(allow_reconnect = true)
-      return if @interface.state == 'DISCONNECTED' && !@interface.connected?
-
-      # Synchronize the calls to @interface.disconnect since it takes an unknown
-      # amount of time. If two calls to disconnect stack up, the if statement
-      # should avoid multiple calls to disconnect.
+      reconnect = false
+
+      # Two threads reach here for a single connection loss: the cmd handler
+      # thread servicing a disconnect directive, and the run thread coming back
+      # out of read (or out of the connection maintenance sleep). The redundant
+      # check below and the state change that records the disconnect must be in
+      # the same critical section, otherwise the second thread reads the state
+      # before the first has updated it and disconnects the interface twice.
       @mutex.synchronize do
+        # A disconnect has already been performed so there is nothing left to do
+        return if @interface.state == 'DISCONNECTED' && !@interface.connected?
+
+        # Call disconnect without consulting connected? so any resources the
+        # interface is still holding are cleaned up. It takes an unknown amount
+        # of time which is the other reason for the mutex.
         begin
-          @interface.disconnect if @interface.connected?
+          @interface.disconnect
         rescue => e
           @logger.error "Disconnect: #{@interface.name}: #{e.formatted}"
         end
-      end
 
-      # If the interface is set to auto_reconnect then delay so the thread
-      # can come back around and allow the interface a chance to reconnect.
-      # Skip reconnect if stop() has been called to avoid re-creating the status model
-      if allow_reconnect and @interface.auto_reconnect and @interface.state != 'DISCONNECTED' and !@cancel_thread
-        attempting()
-        if !@cancel_thread
-          # @logger.debug "reconnect delay: #{@interface.reconnect_delay}"
-          @interface_thread_sleeper.sleep(@interface.reconnect_delay)
-        end
-      else
-        @interface.state = 'DISCONNECTED'
-        unless @cancel_thread
-          if @interface_or_router == 'INTERFACE'
-            InterfaceStatusModel.set(@interface.as_json(), queued: true, scope: @scope)
-          else
-            RouterStatusModel.set(@interface.as_json(), queued: true, scope: @scope)
+        # If the interface is set to auto_reconnect then delay so the thread
+        # can come back around and allow the interface a chance to reconnect.
+        # Skip reconnect if stop() has been called to avoid re-creating the status model
+        reconnect = allow_reconnect && @interface.auto_reconnect && @interface.state != 'DISCONNECTED' && !@cancel_thread
+        if reconnect
+          attempt_connection()
+        else
+          @interface.state = 'DISCONNECTED'
+          unless @cancel_thread
+            if @interface_or_router == 'INTERFACE'
+              InterfaceStatusModel.set(@interface.as_json(), queued: true, scope: @scope)
+            else
+              RouterStatusModel.set(@interface.as_json(), queued: true, scope: @scope)
+            end
           end
         end
       end
+
+      # Sleep outside the mutex so stop() and connect() are not blocked for the
+      # whole reconnect delay
+      # @logger.debug "reconnect delay: #{@interface.reconnect_delay}"
+      @interface_thread_sleeper.sleep(@interface.reconnect_delay) if reconnect && !@cancel_thread
     end
 
     # Disconnect from the interface and stop the thread

data/lib/openc3/microservices/microservice.rb

@@ -43,7 +43,7 @@ module OpenC3
     attr_accessor :secrets
 
     def self.run(name = nil)
-      name = ENV['OPENC3_MICROSERVICE_NAME'] unless name
+      name = ENV.fetch('OPENC3_MICROSERVICE_NAME', nil) unless name
       microservice = self.new(name)
       thread = Thread.new do
         begin
@@ -150,7 +150,7 @@ module OpenC3
         cmd_array = @config["cmd"]
 
         # Get Microservice files from bucket storage
-        bucket = ENV['OPENC3_CONFIG_BUCKET']
+        bucket = ENV.fetch('OPENC3_CONFIG_BUCKET') { raise 'OPENC3_CONFIG_BUCKET environment variable is required' }
         client = Bucket.getClient()
 
         prefix = "#{@scope}/microservices/#{@name}/"
@@ -160,7 +160,7 @@ module OpenC3
         # unreachable while many microservices start at once. Rather than crash
         # and CrashLoopBackOff (which can outlast deploy timeouts), retry for a
         # bounded time before giving up.
-        startup_timeout = (ENV['OPENC3_MICROSERVICE_STARTUP_BUCKET_TIMEOUT'] || 60).to_f
+        startup_timeout = (ENV.fetch('OPENC3_MICROSERVICE_STARTUP_BUCKET_TIMEOUT', 60)).to_f
         startup_deadline = Time.now + startup_timeout
         begin
           file_count = 0

data/lib/openc3/microservices/multi_microservice.rb

@@ -1,6 +1,6 @@
 # encoding: ascii-8bit
 
-# Copyright 2024 OpenC3 Inc.
+# Copyright 2026 OpenC3, Inc.
 # All Rights Reserved.
 #
 # This program is distributed in the hope that it will be useful,

data/lib/openc3/microservices/periodic_microservice.rb

@@ -46,8 +46,8 @@ module OpenC3
           NewsModel.news_error("Error contacting OpenC3 news feed (status: #{response.status})")
         end
       end
-    rescue Exception => e
-      NewsModel.news_error("Error contacting OpenC3 news feed. #{e.message})")
+    rescue StandardError => e
+      NewsModel.news_error("Error contacting OpenC3 news feed. #{e.message}")
     end
 
     def run

data/lib/openc3/migrations/20260704000000_default_bridge.rb

@@ -0,0 +1,38 @@
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/utilities/migration'
+require 'openc3/models/scope_model'
+require 'openc3/models/microservice_model'
+require 'openc3/models/bridge_model'
+
+module OpenC3
+  # Ensure every existing scope has a DEFAULT bridge_microservice (the Iroh hub
+  # that lets openc3-app run COSMOS interfaces on the host). New scopes get one
+  # via ScopeModel#deploy; this backfills any scope created before that.
+  class DefaultBridge < Migration
+    def self.run
+      ScopeModel.get_all_models(scope: nil).each do |scope, scope_model|
+        name = "#{scope}__BRIDGE__DEFAULT"
+        next if MicroserviceModel.get_model(name: name, scope: scope)
+
+        microservice = BridgeModel.build_microservice(bridge_name: "DEFAULT", scope: scope, shard: scope_model.shard)
+        microservice.create
+        microservice.deploy
+        Logger.info("Added DEFAULT bridge_microservice to scope #{scope}")
+      end
+    end
+  end
+end
+
+unless ENV['OPENC3_NO_MIGRATE']
+  OpenC3::DefaultBridge.run
+end

data/lib/openc3/migrations/20260731000000_system_health_json.rb

@@ -1,3 +1,14 @@
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
 require 'json'
 require 'openc3/utilities/local_mode'
 require 'openc3/utilities/migration'

data/lib/openc3/models/auth_model.rb

@@ -27,7 +27,7 @@ module OpenC3
     PRIMARY_KEY = 'OPENC3__TOKEN' # for argon2 password hash
     SESSIONS_KEY = 'OPENC3__SESSIONS' # for hash containing session tokens
 
-    # The length of time in minutes to keep redis values in memory
+    # The length of time in seconds to keep redis values in memory
     PW_HASH_CACHE_TIMEOUT = 5
     SESSION_CACHE_TIMEOUT = 5
 
@@ -44,6 +44,21 @@ module OpenC3
     SESSION_PREFIX = "ses_"
     OTP_PREFIX = "otp_"
 
+    # A session token is SESSION_PREFIX followed by the unpadded urlsafe base64
+    # encoding of 16 random bytes, i.e. exactly 22 characters of [A-Za-z0-9_-].
+    # Keep this in sync with generate_session.
+    SESSION_TOKEN_REGEX = /\A#{SESSION_PREFIX}[A-Za-z0-9_-]{22}\z/
+
+    # Whether the given value could have been produced by generate_session.
+    # Callers handling a token from an unauthenticated request use this to
+    # reject garbage before doing any Redis work. Checking only the prefix is
+    # not enough: something like "ses_AAA" would pass and still cost us a read.
+    # @param token [String] the value to check
+    # @return [Boolean] whether the value is shaped like a session token
+    def self.session_token?(token)
+      SESSION_TOKEN_REGEX.match?(token.to_s)
+    end
+
     def self.set?(key = PRIMARY_KEY)
       Store.exists(key) == 1
     end
@@ -56,7 +71,7 @@ module OpenC3
     def self.verify(token, no_password: true, service_only: false)
       # Handle a service password - Generally only used by ScriptRunner
       # TODO: Replace this with temporary service tokens
-      service_password = ENV['OPENC3_SERVICE_PASSWORD']
+      service_password = ENV.fetch('OPENC3_SERVICE_PASSWORD', nil)
       return true if service_password and service_password == token
 
       return false if service_only
@@ -78,15 +93,28 @@ module OpenC3
       # Check cached session tokens and password hash
       time = Time.now
       unless mode == :password
-        if @@session_cache and (time - @@session_cache_time) < SESSION_CACHE_TIMEOUT and @@session_cache[token]
+        # Drop the whole cache once it ages out rather than tracking per token
+        # times. This bounds how long a terminated token keeps working to
+        # SESSION_CACHE_TIMEOUT, same as before.
+        if @@session_cache.nil? or (time - @@session_cache_time) >= SESSION_CACHE_TIMEOUT
+          @@session_cache = {}
+          @@session_cache_time = time
+        end
+
+        if @@session_cache[token]
           terminate_otp(token)
           return true
         end
 
-        # Check stored session tokens
-        @@session_cache = Store.hgetall(SESSIONS_KEY)
-        @@session_cache_time = time
-        if @@session_cache[token]
+        # Check the stored session tokens for just this token. Deliberately not
+        # HGETALL: verify_token is unauthenticated, so reading the entire
+        # session hash here lets any caller make us pull every session ever
+        # created on every request, and that hash only grows. HGET is O(1) and
+        # can't be amplified. The cache then fills with the tokens actually in
+        # use instead of all of them.
+        stored = Store.hget(SESSIONS_KEY, token)
+        if stored
+          @@session_cache[token] = stored
           terminate_otp(token)
           return true
         end

data/lib/openc3/models/bridge_model.rb

@@ -0,0 +1,133 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/models/model'
+require 'openc3/models/microservice_model'
+require 'base64'
+require 'json'
+require 'securerandom'
+
+module OpenC3
+  # Stores the identity of a named Iroh bridge (the bridge_microservice hub).
+  #
+  # A bridge is the COSMOS-side Iroh server that openc3-app and host interfaces
+  # connect to. This model stores the bridge's Iroh public key (its EndpointId)
+  # and most recent connection ticket, plus the authorized openc3-app control
+  # identity (app_public_key) recorded during enrollment. The bridge's own
+  # private key lives in the secrets store, never here.
+  #
+  # This Ruby model mirrors the Python BridgeModel (same scoped primary key and
+  # JSON shape) so the openc3cli `bridgeenroll` command can read and update the
+  # same records the Python BridgeMicroservice maintains.
+  class BridgeModel < Model
+    PRIMARY_KEY = 'openc3_bridges'
+    ENROLLMENT_CODE_TTL_SECONDS = 10 * 60
+
+    attr_accessor :public_key
+    attr_accessor :ticket
+    attr_accessor :app_public_key
+    attr_accessor :enroll_code
+    attr_accessor :enroll_code_generated_at
+    attr_accessor :port
+
+    # The bridge stack (bridge_microservice.py) is Python and runs from the core
+    # library regardless of the interfaces bridged through it.
+    def self.bridge_python_bin
+      ENV['OPENC3_PYTHON_BIN'] || '/openc3/python/.venv/bin/python'
+    end
+
+    BRIDGE_WORK_DIR = '/openc3/python/openc3/microservices'
+
+    # Build (but do not create) the MicroserviceModel for a bridge_microservice
+    # hub named `bridge_name` in `scope`. Centralizes the cmd/work_dir/options so
+    # ScopeModel, the DEFAULT-bridge migration, and InterfaceModel stay in sync.
+    def self.build_microservice(bridge_name:, scope:, parent: nil, shard: 0, plugin: nil)
+      microservice_name = "#{scope}__BRIDGE__#{bridge_name.to_s.upcase}"
+      MicroserviceModel.new(
+        name: microservice_name,
+        cmd: [bridge_python_bin, 'bridge_microservice.py', microservice_name],
+        work_dir: BRIDGE_WORK_DIR,
+        options: [['BRIDGE_NAME', bridge_name.to_s.upcase]],
+        parent: parent,
+        shard: shard.to_i,
+        plugin: plugin,
+        scope: scope
+      )
+    end
+
+    # NOTE: The following three class methods are reimplemented (like other
+    # scoped models) so the ModelController and Model class methods work.
+    def self.get(name:, scope:)
+      super("#{scope}__#{PRIMARY_KEY}", name: name)
+    end
+
+    def self.names(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+
+    def self.all(scope:)
+      super("#{scope}__#{PRIMARY_KEY}")
+    end
+    # END NOTE
+
+    def initialize(
+      name:,
+      scope:,
+      public_key: nil,
+      ticket: nil,
+      app_public_key: nil,
+      enroll_code: nil,
+      enroll_code_generated_at: nil,
+      port: nil,
+      updated_at: nil,
+      plugin: nil
+    )
+      super("#{scope}__#{PRIMARY_KEY}", name: name, updated_at: updated_at, plugin: plugin, scope: scope)
+      @public_key = public_key
+      @ticket = ticket
+      @app_public_key = app_public_key
+      @enroll_code = enroll_code
+      @enroll_code_generated_at = enroll_code_generated_at
+      @port = port
+    end
+
+    def as_json(*_a)
+      {
+        'name' => @name,
+        'scope' => @scope,
+        'updated_at' => @updated_at,
+        'plugin' => @plugin,
+        'public_key' => @public_key,
+        'ticket' => @ticket,
+        'app_public_key' => @app_public_key,
+        'enroll_code' => @enroll_code,
+        'enroll_code_generated_at' => @enroll_code_generated_at,
+        'port' => @port
+      }
+    end
+
+    # Generate a one-time manual-enrollment code, store it on this bridge, and
+    # return a token (base64 JSON of bridge name + hub ticket + code) that a
+    # remote openc3-app pastes to enroll. Requires the bridge to be up (ticket
+    # present). The code is redeemed once over the api/enroll ALPN.
+    def generate_enrollment_token
+      raise "Bridge '#{@name}' has no ticket yet; is its bridge_microservice running?" if @ticket.nil? || @ticket.empty?
+
+      @enroll_code = SecureRandom.hex(16)
+      @enroll_code_generated_at = Time.now.to_i
+      update()
+      payload = { 'v' => 1, 'bridge' => @name, 'ticket' => @ticket, 'code' => @enroll_code }
+      Base64.urlsafe_encode64(JSON.generate(payload), padding: false)
+    end
+  end
+end

data/lib/openc3/models/config_keyword_model.rb

@@ -0,0 +1,63 @@
+# encoding: ascii-8bit
+
+# Copyright 2026 OpenC3, Inc.
+# All Rights Reserved.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+# See LICENSE.md for more details.
+#
+# This file may also be used under the terms of a commercial license
+# if purchased from OpenC3, Inc.
+
+require 'openc3/utilities/secrets'
+
+# Mixin providing plugin.txt keyword handling shared by the models the operator
+# turns into running containers (InterfaceModel / RouterModel and
+# MicroserviceModel). Including classes must initialize @ports to an Array.
+module OpenC3
+  module ConfigKeywordModel
+    # Parse a PORT keyword, appending [number, protocol] to @ports.
+    def parse_port(parser, keyword, parameters)
+      usage = "PORT <Number> <Protocol (Optional)"
+      parser.verify_num_parameters(1, 2, usage)
+      begin
+        @ports << [Integer(parameters[0])]
+      rescue # In case Integer fails
+        raise ConfigParser::Error.new(parser, "Port must be an integer: #{parameters[0]}", usage)
+      end
+      protocol = ConfigParser.handle_nil(parameters[1])
+      if protocol
+        # Per https://kubernetes.io/docs/concepts/services-networking/service/#protocol-support
+        if %w(TCP UDP SCTP).include?(protocol.upcase)
+          @ports[-1] << protocol.upcase
+        else
+          raise ConfigParser::Error.new(parser, "Unknown port protocol: #{parameters[1]}", usage)
+        end
+      else
+        @ports[-1] << 'TCP'
+      end
+    end
+
+    # Validate a SECRET / BRIDGE_SECRET definition. FILE type paths are restricted
+    # to Secrets.secret_file_dir to prevent reading or overwriting arbitrary files.
+    def validate_secret(parser, keyword, parameters)
+      type = parameters[0].to_s.upcase
+      unless ['ENV', 'FILE'].include?(type)
+        raise ConfigParser::Error.new(parser, "Unknown secret type '#{parameters[0]}' for #{keyword}. Must be ENV or FILE.")
+      end
+      # Normalize in place so the stored secret matches what the operator and
+      # Secrets.setup match on, both of which compare against 'ENV' / 'FILE' and
+      # use the path exactly as given.
+      parameters[0] = type
+      if type == 'FILE'
+        begin
+          parameters[2] = Secrets.validate_file_path(parameters[2])
+        rescue ArgumentError => error
+          raise ConfigParser::Error.new(parser, "#{keyword} #{error.message}")
+        end
+      end
+    end
+  end
+end

data/lib/openc3/models/gem_model.rb

@@ -22,6 +22,7 @@ require 'rubygems'
 require 'rubygems/uninstaller'
 require 'tempfile'
 require 'openc3/utilities/process_manager'
+require 'openc3/utilities/rubygems_url'
 require 'openc3/api/api'
 require 'pathname'
 
@@ -34,8 +35,8 @@ module OpenC3
     extend Api
 
     def self.names
-      if Dir.exist?("#{ENV['GEM_HOME']}/gems")
-        result = Pathname.new("#{ENV['GEM_HOME']}/gems").children.select { |c| c.directory? }.collect { |p| File.basename(p) + '.gem' }
+      if Dir.exist?("#{ENV.fetch('GEM_HOME', nil)}/gems")
+        result = Pathname.new("#{ENV.fetch('GEM_HOME', nil)}/gems").children.select { |c| c.directory? }.collect { |p| File.basename(p) + '.gem' }
       else
         result = []
       end
@@ -43,9 +44,9 @@ module OpenC3
     end
 
     def self.get(name)
-      path = "#{ENV['GEM_HOME']}/cosmoscache/#{name}"
+      path = "#{ENV.fetch('GEM_HOME', nil)}/cosmoscache/#{name}"
       return path if File.exist?(path)
-      path = "#{ENV['GEM_HOME']}/cache/#{name}"
+      path = "#{ENV.fetch('GEM_HOME', nil)}/cache/#{name}"
       return path if File.exist?(path)
       raise "Gem '#{name}' not found"
     end
@@ -54,8 +55,8 @@ module OpenC3
       if File.file?(gem_file_path)
         gem_filename = File.basename(gem_file_path)
         # Put into cosmoscache folder that we control
-        FileUtils.mkdir_p("#{ENV['GEM_HOME']}/cosmoscache") unless Dir.exist?("#{ENV['GEM_HOME']}/cosmoscache")
-        FileUtils.cp(gem_file_path, "#{ENV['GEM_HOME']}/cosmoscache/#{File.basename(gem_file_path)}")
+        FileUtils.mkdir_p("#{ENV.fetch('GEM_HOME', nil)}/cosmoscache") unless Dir.exist?("#{ENV.fetch('GEM_HOME', nil)}/cosmoscache")
+        FileUtils.cp(gem_file_path, "#{ENV.fetch('GEM_HOME', nil)}/cosmoscache/#{File.basename(gem_file_path)}")
         if gem_install
           Logger.info "Installing gem: #{gem_filename}"
           result = OpenC3::ProcessManager.instance.spawn(["ruby", "/openc3/bin/openc3cli", "geminstall", gem_filename, scope], "package_install", gem_filename, Time.now + 3600.0, scope: scope)
@@ -79,9 +80,11 @@ module OpenC3
         rubygems_url = get_setting('rubygems_url', scope: scope)
       rescue
         # If Redis isn't running try the ENV, then simply rubygems.org
-        rubygems_url = ENV['RUBYGEMS_URL']
-        rubygems_url ||= 'https://rubygems.org'
+        rubygems_url = ENV.fetch('RUBYGEMS_URL', RubygemsUrl::DEFAULT)
       end
+      # The url comes from a user-writable setting or ENV so validate it before
+      # using it as a Gem source
+      rubygems_url = RubygemsUrl.validate(rubygems_url) if rubygems_url
       Gem.sources = [rubygems_url] if rubygems_url
       Gem.done_installing_hooks.clear
       begin
@@ -92,7 +95,7 @@ module OpenC3
         Gem.install(gem_file_path, "> 0.pre", build_args: ['--no-document, --without development,test'], prerelease: true, domain: :both)
       end
     rescue => e
-      message = "Gem file #{gem_file_path} error installing to #{ENV['GEM_HOME']}\n#{e.formatted}"
+      message = "Gem file #{gem_file_path} error installing to #{ENV.fetch('GEM_HOME', nil)}\n#{e.formatted}"
       Logger.error message
       raise e
     end