Project

General

Profile

Under what circumstances would Gemfile.lock be modified by commands other than using bundle?

Added by Deoren Moor over 7 years ago

I ran into a similar situation about two years ago with a completely different gem, but this past Tuesday evening I ran into a problem that I eventually managed to trace back to a modified REDMINE_INSTALL_DIR/Gemfile.lock file.

This box has a cron job that runs every five minutes to fetch new emails that users submit as tickets. At 6:25 pm the Gemfile.lock file had an entry for the rbpdf-font gem, and then at 6:30 pm it did not. I've yet to find another activity (in a log file for example) that directly coincides with the modification date on the file.

The current setup for this box:

Environment:
  Redmine version                3.2.3.stable.15489
  Ruby version                   1.9.3-p0 (2011-10-30) [i686-linux]
  Rails version                  4.2.5.2
  Environment                    production
  Database adapter               Mysql2
SCM:
  Subversion                     1.6.17
  Git                            1.7.9.5
  Filesystem                     
Redmine plugins:
  no plugin installed

This is what I found was missing in the file:

--- oct2/redmine/Gemfile.lock   2016-06-07 10:02:11.000000000 -0500
+++ oct5/redmine/Gemfile.lock   2016-10-04 18:30:02.000000000 -0500
@@ -124,7 +124,6 @@
     rbpdf (1.19.0)
       htmlentities (= 4.3.1)
       rbpdf-font (~> 1.19.0)
-    rbpdf-font (1.19.0)
     rdoc (4.2.2)
       json (~> 1.4)
     redcarpet (3.3.4)

When I added that entry back and restarted Apache (I use Apache + Passenger on the affected system), Redmine was once again functional. I've yet to figure out exactly why the entry in the Gemfile.lock file "disappeared" in the first place.

P.S.

The cron job makes multiple calls like this one to scrape several IMAP accounts:

bundle exec rake -f /opt/redmine/Rakefile redmine:email:receive_imap \
    RAILS_ENV="development" 
...

Is rake (or rake tasks) known to modify the Gemfile.lock file? Does bundle itself have a history of corrupting the Gemfile.lock file?