[dlisboa]

I've been messing around with FreeBSD for a few days and it has RubyGems set up very conveniently. Root installed packages (like the ones from ports) would already be attended through the root installed RubyGem.

Aside from OpenBSD which has their security procedures for installed software it doesn't seem like any ports distro really need to have copies of gems in their package tree if the RubyGems package is set up correctly. They could delegate that function to RubyGems, it'd be transparent to the user.

Some package managers go down a more drastic route and simply tell the user to install the dependency through the correct package manager (Homebrew does that with Node, top of my mind). Users can still do it locally with rbenv/rvm/chruby if they want, it doesn't change much.

The bigger I'd think is that they don't want to rely on external package managers for the stability of their system. Which is a very valid reason, if RubyGems is out you can't install certain ports. Or worse, the gems aren't safe. The system is then self-contained and tested, proven to work with the provided copies of gems.

But as a simple dependency resolution perspective I don't see it being the case.

[hosh]

I can tell you that deploying a Rails app needs to come from using rubygem and bundler, never the OS's package management.

As for security concerns: you can and should vet gems, but it won't matter if the application itself has vulnerabilities.

We don't have very many Rails app written as a packaged system for deployment. The kind you see are often SAAS apps or something to interact with people internally. They are often bespoke and written for specific needs.

[csense]

> never the OS's package management

Non-OS installation is a huge barrier to new users of a Ruby application. I installed Gitlab recently. Take a look at the length of the installation guide [1]. There are seven numbered steps, some of which involve multiple commands.

Upgrading from 4.0 to 4.1 was about the same complexity.

Thanks to the thoroughness of its author, the guide largely worked as advertised. But being able to install and upgrade with apt-get would have saved me hours.

[1] https://github.com/gitlabhq/gitlabhq/blob/stable/doc/install...

[hosh]

It is the case for now, but won't be much for longer. I expect application developers to start versioning Vagrantfile, Berkfile, etc. so that someone can bring up at least dev versions of apps.