rails_preflight 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02fcbcfa3f7d98bbc550334fcf9bd65919fbb2eb5266088823b87c0fd7465ae3
-  data.tar.gz: 42c66fa2d33b67e47fed5a36a7127eba476c34b57705d0f3c2591dea9fa1f5eb
+  metadata.gz: e083ff064d2ee34d2b8862a68c3ea41ca63c1f39107237adec73647e8755b1ec
+  data.tar.gz: 770f2d5ac5a2b6b5a8bd491517c735be6c3874b45fdbafa7b25f5d1035af78ab
 SHA512:
-  metadata.gz: ab95dfb109b6fee6cd50d1014792f85d4e941ba7871734766b834844bea2a2bfb15e526e426f7a19a97be7abd58339141bfea037365d9e0b34a3e6f5063b8226
-  data.tar.gz: 1606dfaa001672ed19d45469592f212979228c2efb6500b9e7f8b8017d9977817e1814b25045f79b3ada23a9d3d9fe32b09fbe71e74c3b606e5e69e761ea7731
+  metadata.gz: 7c3486a813bd9c02965df146309c21966bc0c463905ea89c06760b74714b32e0ab5f75c2eabdaa20211e68c88f13aba0c03ddf368132d6a740ea772ccc34b9ce
+  data.tar.gz: 9d31b9cf5a20aedfbac6452d437760d0f509a169a44837ba9d651364b9d05516d770bac23a165b4f1b327d56be8400a414fc3107ec4f14c10f51e84724f52628

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.1 (2026-10-09)
+
+- rubygems.org lookups also trust the certificates RubyGems ships for rubygems.org, so they work wherever `gem install` does, even when Ruby's OpenSSL can't find the system certificates
+- Failed lookups are reported once per distinct error, under their own "rubygems.org lookup" entry with the gem names listed once, instead of the same error repeated for every gem under a second "Private Gems" card
+- A certificate failure says what to do: behind a VPN or proxy that inspects HTTPS, point `SSL_CERT_FILE` at a bundle that includes its root certificate, or pass `--offline`
+- The terminal warns when lookups fail
+
 ## 0.1.0 (2026-10-09)
 
 First release. Point it at a Rails 5.0 – 8.1 app and a target version: it writes a report into the app as HTML, Markdown or JSON, plus a short terminal summary. Read-only and static.

data/lib/rails_preflight/report_generator.rb

@@ -280,7 +280,7 @@ module RailsPreflight
             <div class="limits">
               <% @summary.fetch(:cant_see, []).each do |entry| %>
                 <div class="limit">
-                  <h3><%= h(entry[:section]) %></h3>
+                  <h3><%= h(entry[:title] || entry[:section]) %></h3>
                   <p><%= code_html(entry[:message]) %></p>
                   <% names = Array(entry[:names]) %>
                   <% if names.any? %><p class="names"><%= h(names.join(" · ")) %></p><% end %>
@@ -477,7 +477,10 @@ module RailsPreflight
       h(text).gsub(/(?<![\w&;])&#39;(.+?)&#39;(?![\w&])/) { "<code>#{$1}</code>" }
     end
 
+    # A titled entry (the rubygems.org lookup) says what to do in its own message.
     def cant_see_next(entry)
+      return if entry[:title]
+
       case entry[:section]
       when "Private Gems" then "Check each gemspec's Rails dependency, and bump them in the same step."
       when "Gem Compatibility"

data/lib/rails_preflight/upgrade_analyzer.rb

@@ -246,9 +246,18 @@ module RailsPreflight
         if mixed_gems.any?
           result[:checks] << { message: "Looked up #{mixed_gems.size} gems on rubygems.org, since Gemfile.lock lists them under both rubygems.org and #{mixed_remotes.join(', ')}. Pass --offline to skip.", status: :passed, fix_effort: :low }
         end
-        if inconclusive.any?
-          names = inconclusive.map { |name, error| "#{name} (#{error})" }
-          result[:checks] << { message: "Could not verify #{inconclusive.size} gems against rubygems.org", status: :warning, kind: :unknown, names: names, fix_effort: :unknown }
+        # One entry per distinct error: a missing certificate fails every lookup the same way.
+        inconclusive.group_by { |_, error| error }.each do |error, failed|
+          gems = failed.map(&:first).sort
+          @out.puts "Couldn't reach rubygems.org for #{gems.size} gems (#{error}). See \"Couldn't check\" in the report."
+          # A VPN or proxy that inspects HTTPS re-signs certificates with a root the OS trusts but Ruby's OpenSSL doesn't read.
+          advice = if error.include?("certificate verify failed")
+                     "Behind a VPN or proxy that inspects HTTPS, point SSL_CERT_FILE at a certificate bundle that includes its root certificate, or pass --offline."
+                   else
+                     "Run it again once rubygems.org is reachable, or pass --offline."
+                   end
+          result[:checks] << { message: "Couldn't reach rubygems.org for #{gems.size} #{gems.size == 1 ? 'gem' : 'gems'} (#{error}), so whether #{gems.size == 1 ? "it's private and when it was" : "they're private and when they were"} last released is unknown. #{advice}",
+                               title: "rubygems.org lookup", status: :warning, kind: :unknown, names: gems, fix_effort: :unknown }
           result[:status] = :warning
         end
       end
@@ -272,6 +281,7 @@ module RailsPreflight
       found = {}
       inconclusive = {}
       lock = Mutex.new
+      store = rubygems_cert_store
 
       Array.new([names.size, 8].min) do
         Thread.new do
@@ -279,14 +289,16 @@ module RailsPreflight
             begin
               url = URI("https://rubygems.org/api/v1/gems/#{name}.json")
               # Certificate errors are reported as inconclusive, never silently trusted.
-              response = Net::HTTP.start(url.host, url.port, use_ssl: true, open_timeout: 5, read_timeout: 5) do |http|
+              response = Net::HTTP.start(url.host, url.port, use_ssl: true, cert_store: store, open_timeout: 5, read_timeout: 5) do |http|
                 http.request(Net::HTTP::Get.new(url))
               end
               raise "HTTP #{response.code}" unless %w[200 404].include?(response.code) # e.g. 429 when rate limited
               info = response.code == "200" && (JSON.parse(response.body.to_s) rescue {})
               lock.synchronize { found[name] = info }
             rescue StandardError => e
-              lock.synchronize { inconclusive[name] = "#{e.class.name}: #{e.message}" }
+              # The peer address changes per connection; without it, the same failure reads the same for every gem.
+              # The peer address changes per connection; without it, the same failure reads the same for every gem.
+              lock.synchronize { inconclusive[name] = "#{e.class.name}: #{e.message.sub(/ peeraddr=\S+/, '')}" }
             end
           end
         end
@@ -295,6 +307,20 @@ module RailsPreflight
       [found, inconclusive]
     end
 
+    # The system's certificates plus the ones RubyGems ships for rubygems.org, which is why `gem install` works on a
+    # machine whose OpenSSL can't find the system store. Verification stays on.
+    def rubygems_cert_store
+      require 'rubygems/request'
+      OpenSSL::X509::Store.new.tap do |store|
+        store.set_default_paths
+        Gem::Request.get_cert_files.each do |file|
+          store.add_file(file)
+        rescue OpenSSL::X509::StoreError
+          # already in the system store
+        end
+      end
+    end
+
     # From the lockfile: :public, :private (git, path, or only non-rubygems.org remotes), or, when one GEM
     # section lists rubygems.org next to another remote (Bundler before 2.2), whatever the Gemfile says; :mixed if it doesn't.
     def gem_origin(spec)

data/lib/rails_preflight/version.rb

@@ -1,3 +1,3 @@
 module RailsPreflight
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_preflight
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Syed Aslam