nexus-public: Nexus failing to find gems via Bundler when using a group repo

Originally reported in forum post Nexus failing to find Gems as a Bundler source but which exist in the Nexus UI

What problem are you trying to solve?

When running Bundler, Nexus reports the following error:

Resolving dependencies…
Your bundle is locked to GEM_NAME (GEM_VERSION) from rubygems repository https://nexus.example.com/repository/rubygems/ or installed locally, but that version can no longer be found in that source.
That means the author of GEM_NAME (GEM_VERSION) has removed it. You’ll need to update your bundle to a version other than GEM_NAME (GEM_VERSION) that hasn’t been removed in order to install.

where GEM_NAME and GEM_VERSION refer to some internal or public gem. Exactly which gem fails depends on what needs updating on a particular machine. It has also been seen to work then fail if the gem is removed and bundle install is run again.

The gem referenced is clearly available in Nexus when browsing via the UI
In the case of public gems, the gem and specified version are available on rubygems.org
There is no evidence in Nexus logs of what is happening (errors, warning or informational)

Do you have a workaround you are using at present?

Taking the group out of the picture seems to work, however this completely defeats the purpose of using a repo group and means updating many projects.

# source '.../rubygems
source '.../rubygems-proxy'

source '.../rubygems-hosted' do
  # Internal gems
end

# Public gems

What feature or behavior is this required for?

Installing project dependencies

How could we solve this issue? (Not knowing is okay!)

Without any diagnostic information, we have no idea why this is occurring.

Tell us about your Nexus Repository deployment: what version, operating system, and database are you using?

Reproduced with Nexus OSS 3.53.0, 3.53.1 and 3.54.1-01
Operating system is Ubuntu 18.04 installed with the unix package. No database is specified.
We are using a standard group setup with a hosted rubygems repo for internal gems and proxy for public gems
Our install has been working fine for years and no configuration changes were made since an upgrade 6-7 months before this started happening

Anything else?

Nope

About this issue

Original URL
State: closed
Created a year ago
Reactions: 1
Comments: 22 (4 by maintainers)

Most upvoted comments

@niventc @dan-drew I do want to highlight something in the release notes for 3.63 that may improve the situation. At the bottom you’ll noticed that we fixed a few issues related to the ruby ecosystem that affected a small percentage of gems.

Testing with the latest (actually a pre-release of 3.64 due Jan 9, but I expect no changes to ruby from 3.63), I’m able to proxy the concurrent-ruby-1.1.10 gem listed here by @niventc through both proxy and group repositories.

The didja_rails component mentioned I’m having a harder time. It appears that package is no longer present in rubygems.org? See the log extract below, executed from the ruby:3.1 docker image:

root@5efd9aea0291:/# gem search -a didja_rails

*** REMOTE GEMS ***


root@5efd9aea0291:/# gem sources --add https://somenexus.sonatype.com/repository/rubygem-proxy/
https://somenexus.sonatype.com/repository/rubygem-proxy/ added to sources
root@5efd9aea0291:/# gem sources --remove https://rubygems.org
root@5efd9aea0291:/# gem search -a -s https://somenexus.sonatype.com/repository/rubygem-proxy/ didja_rails

*** REMOTE GEMS ***


root@5efd9aea0291:/# gem search -a concurrent-ruby

*** REMOTE GEMS ***

concurrent-ruby (1.2.2, 1.2.1, 1.2.0, 1.1.10, 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1, 1.0.5 ruby java, 1.0.4 ruby java, 1.0.3 ruby java, 1.0.2 ruby java, 1.0.1 ruby java, 1.0.0 ruby java, 0.9.2 ruby java, 0.9.1 ruby java, 0.9.0 ruby java, 0.8.0 ruby java, 0.7.2 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.7.1 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.7.0 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.6.1, 0.6.0, 0.5.0, 0.4.1, 0.4.0, 0.3.2, 0.3.1, 0.3.0, 0.2.2, 0.2.1, 0.2.0, 0.1.1, 0.1.0, 0.0.1)
concurrent-ruby-edge (0.7.0, 0.6.0, 0.5.0, 0.4.1, 0.3.1, 0.3.0, 0.2.4, 0.2.3, 0.2.2, 0.2.1, 0.2.0, 0.1.2, 0.1.1, 0.1.0)
concurrent-ruby-ext (1.2.2 ruby x64-mingw32 x86-mingw32, 1.2.1 ruby x64-mingw32 x86-mingw32, 1.2.0 ruby x64-mingw32 x86-mingw32, 1.1.10 ruby x64-mingw32 x86-mingw32, 1.1.9 ruby x64-mingw32 x86-mingw32, 1.1.8 ruby x64-mingw32 x86-mingw32, 1.1.7 ruby x64-mingw32 x86-mingw32, 1.1.6 ruby x64-mingw32 x86-mingw32, 1.1.5 ruby x64-mingw32 x86-mingw32, 1.1.4 ruby x64-mingw32 x86-mingw32, 1.1.3 ruby x64-mingw32 x86-mingw32, 1.1.2 ruby x64-mingw32 x86-mingw32, 1.1.1 ruby x64-mingw32 x86-mingw32, 1.0.5 ruby x64-mingw32 x86-mingw32, 1.0.4 ruby x64-mingw32 x86-mingw32, 1.0.3 ruby x64-mingw32 x86-mingw32, 1.0.2 ruby x64-mingw32 x86-mingw32, 1.0.1 ruby x64-mingw32 x86-mingw32, 1.0.0 ruby x64-mingw32 x86-mingw32, 0.9.2 ruby x64-mingw32 x86-mingw32, 0.9.1 ruby x64-mingw32 x86-mingw32, 0.9.0 ruby x64-mingw32 x86-mingw32, 0.8.0 ruby x64-mingw32 x86-mingw32)
o-concurrent-ruby (1.1.13, 1.1.12, 1.1.11)
o-concurrent-ruby-ext (1.1.13, 1.1.12, 1.1.11)

root@5efd9aea0291:/# gem sources --add https://somenexus.sonatype.com/repository/rubygem-group/
https://somenexus.sonatype.com/repository/rubygem-group/ added to sources
root@5efd9aea0291:/# gem sources --remove https://somenexus.sonatype.com/repository/rubygem-proxy/
https://somenexus.sonatype.com/repository/rubygem-proxy/ removed from sources
root@5efd9aea0291:/# gem search -a concurrent-ruby

*** REMOTE GEMS ***

concurrent-ruby (1.2.2, 1.2.1, 1.2.0, 1.1.10, 1.1.9, 1.1.8, 1.1.7, 1.1.6, 1.1.5, 1.1.4, 1.1.3, 1.1.2, 1.1.1, 1.0.5 ruby java, 1.0.4 ruby java, 1.0.3 ruby java, 1.0.2 ruby java, 1.0.1 ruby java, 1.0.0 ruby java, 0.9.2 ruby java, 0.9.1 ruby java, 0.9.0 ruby java, 0.8.0 ruby java, 0.7.2 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.7.1 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.7.0 ruby java x64-mingw32 x86-linux x86-mingw32 x86-solaris-2.11 x86_64-linux, 0.6.1, 0.6.0, 0.5.0, 0.4.1, 0.4.0, 0.3.2, 0.3.1, 0.3.0, 0.2.2, 0.2.1, 0.2.0, 0.1.1, 0.1.0, 0.0.1)
concurrent-ruby-edge (0.7.0, 0.6.0, 0.5.0, 0.4.1, 0.3.1, 0.3.0, 0.2.4, 0.2.3, 0.2.2, 0.2.1, 0.2.0, 0.1.2, 0.1.1, 0.1.0)
concurrent-ruby-ext (1.2.2 ruby x64-mingw32 x86-mingw32, 1.2.1 ruby x64-mingw32 x86-mingw32, 1.2.0 ruby x64-mingw32 x86-mingw32, 1.1.10 ruby x64-mingw32 x86-mingw32, 1.1.9 ruby x64-mingw32 x86-mingw32, 1.1.8 ruby x64-mingw32 x86-mingw32, 1.1.7 ruby x64-mingw32 x86-mingw32, 1.1.6 ruby x64-mingw32 x86-mingw32, 1.1.5 ruby x64-mingw32 x86-mingw32, 1.1.4 ruby x64-mingw32 x86-mingw32, 1.1.3 ruby x64-mingw32 x86-mingw32, 1.1.2 ruby x64-mingw32 x86-mingw32, 1.1.1 ruby x64-mingw32 x86-mingw32, 1.0.5 ruby x64-mingw32 x86-mingw32, 1.0.4 ruby x64-mingw32 x86-mingw32, 1.0.3 ruby x64-mingw32 x86-mingw32, 1.0.2 ruby x64-mingw32 x86-mingw32, 1.0.1 ruby x64-mingw32 x86-mingw32, 1.0.0 ruby x64-mingw32 x86-mingw32, 0.9.2 ruby x64-mingw32 x86-mingw32, 0.9.1 ruby x64-mingw32 x86-mingw32, 0.9.0 ruby x64-mingw32 x86-mingw32, 0.8.0 ruby x64-mingw32 x86-mingw32)
o-concurrent-ruby (1.1.13, 1.1.12, 1.1.11)
o-concurrent-ruby-ext (1.1.13, 1.1.12, 1.1.11)

nblair on Dec 21, 2023

We have this same issue. It appears to be related to a change on the rubygems API (https://help.sonatype.com/repomanager3/product-information/release-notes/2023-release-notes/sonatype-nexus-repository-3.53.0---3.53.1-release-notes?_ga=2.123942926.505566307.1693925851-922094735.1685002131#SonatypeNexusRepository3.53.03.53.1ReleaseNotes-ruby).

Running the command gem install concurrent-ruby -v 1.1.10 --verbose against the proxy source and the group source we see the following.

A successful request directly to our proxy shows this in the logs

HEAD https://internal-nexus/repository/rubygems_proxy/api/v1/dependencies
404 Not Found
...
Successfully installed concurrent-ruby-1.1.10

Whereas the same request to our group shows

HEAD https://internal-nexus/repository/rubygems_group/api/v1/dependencies 200 OK
GET https://internal-nexus/repository/rubygems_group/api/v1/dependencies?gems=concurrent-ruby 200 OK
ERROR: Could not find a valid gem 'concurrent-ruby' (=1.1.10) in any repository

From the nexus logs we can see that the request gets forwarded to rubygems which then returns a 404

"GET https://rubygems.org/api/v1/dependencies?gems=concurrent-ruby HTTP/1.1" 404 -1 265 "Nexus/3.60.0-02

In summary it appears the /api/v1/dependencies now correctly returns 404 for proxy repos, however continues to return 200 for group repos.

niventc on Nov 9, 2023