Pushing to 'allowed_push_host' without rubygems.org credentails fails

[callahat]

Without a rubygems_api_key a gem cannot be published to the host specified by the allowed_push_host. I was able to verify that with a valid key in ~/.gem/credentials I am able to publish instead to the geminabox server (and it doesn't wind up on rubygems.org). Line is here: https://github.com/bundler/bundler/blob/master/lib/bundler/gem_helper.rb#L95

[Cohen-Carlisle]

It would be nice to have this addressed.
Its a bit scary when you are prompted for Rubygems credentials when you are trying to push to a private gemserver.
I can also envision a situation in which someone sets their rubygem creds to be able to push to a private gemserver and then later forgets to set allowed_push_host in some gem and ends up pushing potentially proprietary code to a public gemserver.
👍

[Cohen-Carlisle]

It looks like simply moving the linked line down to after the if @gemspec.respond_to?(:metadata)'s end and checking allowed_push_host as well would work. I.e.,

def rubygem_push(path)
  allowed_push_host = nil
  gem_command = "gem push '#{path}'"
  if @gemspec.respond_to?(:metadata)
    allowed_push_host = @gemspec.metadata["allowed_push_host"]
    gem_command += " --host #{allowed_push_host}" if allowed_push_host
  end
  unless allowed_push_host || Pathname.new("~/.gem/credentials").expand_path.file?
    raise "Your rubygems.org credentials aren't set. Run `gem push` to set them."
  end
  sh(gem_command)
  Bundler.ui.confirm "Pushed #{name} #{version} to #{allowed_push_host ? allowed_push_host : "rubygems.org."}"
end

[segiddins]

@Cohen-Carlisle a PR for that would be 🚀

[Cohen-Carlisle]

What branch(es?) should a PR addressing this issue be against?

[segiddins]

Master