Lock the checksum of Bundler itself in the lockfile#9366
Merged
Edouard-chin merged 1 commit intoruby:masterfrom Mar 18, 2026
Merged
Lock the checksum of Bundler itself in the lockfile#9366Edouard-chin merged 1 commit intoruby:masterfrom
Edouard-chin merged 1 commit intoruby:masterfrom
Conversation
Edouard-chin
changed the title
Edouard-chin
commented
Mar 5, 2026
Edouard-chin
commented
Mar 5, 2026
Edouard-chin
force-pushed
the
ec-bundler-checksum
branch
2 times, most recently
from
caff796 to
5fa57c3
Compare
- ### Problem With the Bundler autoswitch feature, system Bundler may install a `bundler.gem` that matches the Gemfile.lock. The `bundler.gem` that gets downloaded is like any other gems, but its treated differently (it doesn't appear in the Gemfile specs and we also don't lock its checksum). If for any reason Bundler itself gets compromised, it's a security concern. ### Details I'd like to introduce this change into two separate changes for easier reviews. The first (this commit) only produce the checksum in the lockfile, nothings consumes it or verify it yet. The second patch will make sure that whenever the Bundler auto-install kicks in, Bundler will verify that the locked checksum matches the Bundler version being downloaded and installed. ### Solution Overall the solution here is similar to how checksums are already generated for other gems. However, the `bundler` gem comes from a different source (the `Bundler::Source::Metadata`) and so it needs to be handled slightly differently. A big part ot the change is test related. Instead of having to modify all tests that assert the state of the lockfile (which will be broken now, since the lockfile includes the Bundler checksum), I opted to automatically include the checksum whenever the helper metod `checksums_section` is called.
Edouard-chin
force-pushed
the
ec-bundler-checksum
branch
from
5fa57c3 to
9ce52a2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was the end-user or developer problem that led to this PR?
I'd like to be able to lock the checksum of the
bundlergem itself. I find strange that all gems get their checksum locked, but bundler itself (which is the only gem that every application will need to install due to the auto-switch feature) isn't getting locked.I think this is a security vulnerability and I'd like to fix this.
With this patch, the lockfile will look like this:
What is your fix for the problem, implemented in this PR?
Details
I'd like to introduce this change into two separate changes for easier reviews. The first (this commit) only produce the checksum in the lockfile, nothings consumes it or verify it yet.
The second patch will make sure that whenever the Bundler auto-install kicks in, Bundler will verify that the locked checksum matches the Bundler version being downloaded and installed.
Though, please let me know if you'd prefer me doing the whole thing in just one PR.
Solution
Overall the solution here is similar to how checksums are already generated for other gems. However, the
bundlergem comes from a different source (theBundler::Source::Metadata) and so it needs to be handled slightly differently.A big part ot the change is test related. Instead of having to modify all tests that assert the state of the lockfile (which will be broken now, since the lockfile includes the Bundler checksum), I opted to automatically include the checksum whenever the helper metod
checksums_sectionis called.I'll add a few comments on the code directly for parts that may not be obvious.
Make sure the following tasks are checked