Enabling TOTP on rubygems.org breaks rake release

[fnando]

If you enable 2FA for both UI and API, you can't release new gems with rake release. AFAICT, there's no way one can inform a TOTP code when issuing a gem push. Upgrading to latest rubygems with gem update --system makes --otp available to gem push.

$ gem -v     
3.0.1

$ gem push -h
Usage: gem push GEM [options]

  Options:
    -k, --key KEYNAME                Use the given API key
                                     from ~/.gem/credentials
        --otp CODE                   Digit code for multifactor authentication
        --host HOST                  Push to another gemcutter-compatible host
                                       (e.g. https://rubygems.org)


  Local/Remote Options:
    -p, --[no-]http-proxy [URL]      Use HTTP proxy for remote operations


  Common Options:
    -h, --help                       Get help on this command
    -V, --[no-]verbose               Set the verbose level of output
    -q, --quiet                      Silence command progress meter
        --silent                     Silence RubyGems output
        --config-file FILE           Use this config file instead of default
        --backtrace                  Show stack backtrace on errors
        --debug                      Turn on Ruby debugging
        --norc                       Avoid loading any .gemrc file


  Arguments:
    GEM       built gem to push up

  Summary:
    Push a gem up to the gem server

  Description:
    The push command uploads a gem to the push server (the default is
    https://rubygems.org) and adds it to the index.
    
    The gem can be removed from the index and deleted from the server using the
    yank
    command.  For further discussion see the help for the yank command.

[sonalkr132]

Thanks for reporting this. Looks like we need to add an argument to rake release:rubygem_push.
Even without --otp, gem push command is suppose to give you a prompt asking for OTP, I guess that is not working because of sh (?)
https://github.com/bundler/bundler/blob/45c7667cd79c6b9e886f75a4980a8921c2adf5c4/lib/bundler/gem_helper.rb#L107

Guides for using MFA with gem command are here. Please let us know your suggestions if we can improve it (PR for MFA guide).
We will update bundler docs after we fix this.

cc: @ecnelises

[segiddins]

sh calls system, which should indeed be passing through STDIN to the subprocess, so gem push should be able to ask for the TOPT code

[deivid-rodriguez]

Will be fixed by #7005, I think.