FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: further isolate bundled jars/wars from wider environment by chadlwilson · Pull Request #650 · jruby/warbler · GitHub

/ warbler Public

fix: further isolate bundled jars/wars from wider environment - #650

Merged
chadlwilson merged 1 commit into
jruby:masterfrom
chadlwilson:better-isolate-bundler
Aug 29, 2026
Merged

fix: further isolate bundled jars/wars from wider environment#650
chadlwilson merged 1 commit into
jruby:masterfrom
chadlwilson:better-isolate-bundler

Conversation

chadlwilson commented Aug 29, 2026
edited
Loading

Copy link
Copy Markdown
Contributor

Currently there are many gotchas with warbler's bundling that require user awareness. We can do much better to "do the right thing" by default, by setting opinionated bundler config that is baked into the warbled application. This change

  • bakes in a .bundle/config to the application, rather than relying on env vars, to ensure the strongest level of enforcement of isolation that will otherwise break the warbled jar/war
  • ensures the following settings
    • BUNDLE_VERSION = system - ensure that bundler never tries to switch versions; and clarify that bundler will always run from the given jruby version's bundler.
    • BUNDLE_FROZEN = true - invert the previous default. Frozen should be the default, for both security and correctness. Users can still opt-out, if we have missed some case.
    • BUNDLE_PATH__SYSTEM = true - not strictly necessary, but clarifies that the jars/wars Warbler creates put all the gems onto what is effectively the system path at runtime.
    • BUNDLE_AUTO_INSTALL = false - enforce that installation of gems at runtime is impossible. Doubt anyone opts-in for this, but clarify that it won't work, and goes against the design goals of warbler.

Also cleans up related bugs for modern bundler

Currently there are many gotchas with warbler's bundling that require user awareness. We can do much better to "do the right thing" by defualt, by setting opinionated bundler config that is baked into the warbled application. This change
- bakes in a `.bundle/config` to the application, rather than relying on env vars, to ensure the strongest level of enforcement
- ensures the following settings
  - `BUNDLE_VERSION = system` - ensure that bundler never tries to switch versions; and clarify that bundler will always run from the given jruby version's bundler.
  - `BUNDLE_FROZEN = true` - invert the previous default. Frozen should be the default, for both security and correctness. Users can still opt-out, if we have missed some case.
  - `BUNDLE_PATH__SYSTEM = true` - not strictly necessary, but clarifies that the jars/wars Warbler creates put all the gems onto what is effectively the system path at runtime.
  - `BUNDLE_AUTO_INSTALL = false` - enforce that installation of gems at runtime is impossible. Doubt anyone opts-in for this, but clarify that it won't work, and goes against the design goals of warbler.

  Also cleans things up related bugs for modern bundler
  - properly excludes default gem stubs from being included, which for bundler can cause `CorruptBundlerInstallError` if there is any version mismatch.
  - avoid duplicate gems when bundling relative path dependencies (jruby#465)
  - remove unnecessary legacy `:warbler_excluded` workaround for bundler issue handling excluded git specs (from jruby#42)
  - correct support for `gem_excludes` within bundler git specs. (jruby#331)
chadlwilson added this to the 2.1.2 milestone Aug 29, 2026
chadlwilson marked this pull request as ready for review August 29, 2026 09:46
chadlwilson merged commit 7c8ea0c into jruby:master Aug 29, 2026
14 checks passed
chadlwilson deleted the better-isolate-bundler branch August 29, 2026 09:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant


Back | FazBrowse Home | New Git URL