Re: [PATCH] Add yaggo.

[Ricardo Wurmus]

> I must reiterate my concern about this approach to the wider
> guix-devel audience.  From what I can see, the gem archives hosted on
> rubygems.org are build artifacts and should probably be treated like
> pre-built binaries.  They are not the complete, corresponding source
> code.  Can anyone else weigh in here?

The gemspec file must list all files (either explicitly or via patterns)
that are to be distributed and thus needed at runtime.

As far as I can tell "gem push name.gem" can be used to upload anything
to rubygems.org that is considered a valid gem.  rubygems.org will only
extract the gemspec metadata and process them for later display[1].  The
parsed and possibly validated gemspecs are included in the gem when
doing "gem build name.gemspec".  For more info on what "gem build" does
see [2].

This means that using standard tools (unmodified "gem") the generated
gem is packaged according to the information in the gemspec file.  A gem
seems to be little more than a tar archive.  I would not consider this a
"build artifact", but release tarballs.  We don't have a problem with
using release tarballs over git clones for non-Ruby applications, even
though the tarballs may contain somewhat different sources (e.g. added
ChangeLog).

Of course, a gem created with a modified tool could contain more or less
than what the gemspec file declares.  But I would treat this in much the
same manner as I would treat broken release tarballs.

~~ Ricardo

[1]: 
https://github.com/rubygems/rubygems.org/blob/master/app/models/pusher.rb#L47
[2]: https://github.com/rubygems/rubygems/blob/master/lib/rubygems/package.rb