Answers: <p>To take your points one by one:</p>
  
  <blockquote>
    <p>but in the interests of good system hygiene I would like to avoid as much as possible duplication</p>
  </blockquote>
  
  <p>Can you ensure your system ruby will evolve at the same pace as the Chef's ruby ? Main point of chef coming as a bundle with its own ruby comes back from Chef 10 which was installed via a simple gem command and was usually a problem switching between ruby needed for applications and ruby needed by chef, the same goes for gem dependencies. I would advise against mixing system and chef ruby.</p>
  
  <blockquote>
    <p>the Gems I have in the system Ruby come from the known-good local Yum repo and are installed via RPM over the LAN whereas chef_gem goes off to the public Internet</p>
  </blockquote>
  
  <p>While I understand and agree with the worrying about recent pipy events, there's two things here:</p>
  
  <ul>
  <li>Your system ruby install gems from yum repository because your system ruby's <code>gem</code> command has been tweaked for that, that's specific to your distribution. -</li>
  <li>Chef's ruby use usual ruby method going to rubygems.org, as any ruby installed by rbenv or any other way than yum install would do.</li>
  </ul>
  
  <p>If you really want to use a local repo you'll have to <a href="http://guides.rubygems.org/run-your-own-gem-server/" rel="nofollow noreferrer">set up a gem server</a> (alternatively, some artifact repositories can handle that also) and set-up the sources for gem using chef's <a href="http://guides.rubygems.org/command-reference/#gem-sources" rel="nofollow noreferrer"><code>gem sources</code></a> in <code>/opt/chef/embedded/bin</code>.</p>
  
  <p>If you're using a chef client above 13.0 your can use the <code>rubygems_url</code> in client.rb to tweak that:</p>
  
  <blockquote>
  <pre><code>rubygems_url
  </code></pre>
    
    <p>The location to source rubygems. It can be set to a string or array of
    strings for URIs to set as rubygems sources. This allows individuals
    to setup an internal mirror of rubygems for “airgapped” environments.
    Default value: <a href="https://www.rubygems.org" rel="nofollow noreferrer">https://www.rubygems.org</a>.<br>
    Changed in Chef Client 13.0.</p>
  </blockquote>
  
  <p>And finally:</p>
  
  <blockquote>
    <p>I have tried setting ENV['GEM_PATH'] in my recipe both before and
    inside a ruby_block but this appears to have no effect, I get a
    failure on require</p>
  </blockquote>
  
  <p>Chef omnibus package hardcode some values specially to avoid interfering with the system ruby, I think the GEM_PATH environment variable is ignored when searching for gem you <code>require</code> within the recipe code. I don't think there's a workaround for this, and again you're heading to a compatibility problem on mid term as you'll have a drift between chef's ruby and system ruby.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-10-09T08:32:47.660Z
Answers: 2017-10-09T08:32:47.660Z
Answers: Tensibai
Body: <p>I know about the <code>chef_gem</code> resource obv, but in the interests of good system hygiene I would like to avoid as much as possible duplication, so I would like to share Gems between the embedded Ruby within Chef, and the system-wide one. Additionally I have become aware of a troubling situation: the Gems I have in the system Ruby come from the known-good local Yum repo and are installed via RPM over the LAN whereas <code>chef_gem</code> goes off to the public Internet, and <a href="http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/" rel="nofollow noreferrer">recent events in the Python community</a> have made me very concerned about this. I have tried setting <code>ENV['GEM_PATH']</code> in my recipe both before and inside a <code>ruby_block</code> but this appears to have no effect, I get a failure on <code>require</code>. What am I missing?</p>
  
Tags: <chef><security>
Title: Sharing Gems between Chef and System Ruby
UserDisplayName: Gaius
ThreadText: # Sharing Gems between Chef and System Ruby
  
  (Asked by: username_0 on 2017-10-07)
  
  I know about the `chef_gem` resource obv, but in the interests of good system hygiene I would like to avoid as much as possible duplication, so I would like to share Gems between the embedded Ruby within Chef, and the system-wide one. Additionally I have become aware of a troubling situation: the Gems I have in the system Ruby come from the known-good local Yum repo and are installed via RPM over the LAN whereas `chef_gem` goes off to the public Internet, and [recent events in the Python community](http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/) have made me very concerned about this. I have tried setting `ENV['GEM_PATH']` in my recipe both before and inside a `ruby_block` but this appears to have no effect, I get a failure on `require`. What am I missing?
  
  **Tags:** chef, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-10-09. Score: 2 | Accepted answer
  
  To take your points one by one:
  
  > but in the interests of good system hygiene I would like to avoid as much as possible duplication
  
  Can you ensure your system ruby will evolve at the same pace as the Chef's ruby ? Main point of chef coming as a bundle with its own ruby comes back from Chef 10 which was installed via a simple gem command and was usually a problem switching between ruby needed for applications and ruby needed by chef, the same goes for gem dependencies. I would advise against mixing system and chef ruby.
  
  > the Gems I have in the system Ruby come from the known-good local Yum repo and are installed via RPM over the LAN whereas chef\_gem goes off to the public Internet
  
  While I understand and agree with the worrying about recent pipy events, there's two things here:
  
  * Your system ruby install gems from yum repository because your system ruby's `gem` command has been tweaked for that, that's specific to your distribution. -
  * Chef's ruby use usual ruby method going to rubygems.org, as any ruby installed by rbenv or any other way than yum install would do.
  
  If you really want to use a local repo you'll have to [set up a gem server](http://guides.rubygems.org/run-your-own-gem-server/) (alternatively, some artifact repositories can handle that also) and set-up the sources for gem using chef's [`gem sources`](http://guides.rubygems.org/command-reference/#gem-sources) in `/opt/chef/embedded/bin`.
  
  If you're using a chef client above 13.0 your can use the `rubygems_url` in client.rb to tweak that:
  
  > ```
  > rubygems_url
  >
  > ```
  >
  > The location to source rubygems. It can be set to a string or array of
  > strings for URIs to set as rubygems sources. This allows individuals
  > to setup an internal mirror of rubygems for “airgapped” environments.
  > Default value: <https://www.rubygems.org>.  
  > Changed in Chef Client 13.0.
  
  And finally:
  
  > I have tried setting ENV['GEM\_PATH'] in my recipe both before and
  > inside a ruby\_block but this appears to have no effect, I get a
  > failure on require
  
  Chef omnibus package hardcode some values specially to avoid interfering with the system ruby, I think the GEM\_PATH environment variable is ignored when searching for gem you `require` within the recipe code. I don't think there's a workaround for this, and again you're heading to a compatibility problem on mid term as you'll have a drift between chef's ruby and system ruby.
  
  
  ---
  
  