Problem
On VMs, puppetserver sees three gem sources: the server tarball's vendored gems, the deps of the openvox gem, and the openvox-agent AIO vendor_gems (defined by the rubygem-* components in puppet-runtime's agent-runtime-8.x.rb, shared with puppetserver via gem-path). Our image covers the first two and deliberately drops the third with the agent Ruby.
That third list changes upstream without us noticing - hiera-eyaml was exactly this case: present on every VM via the agent package, silently missing in the container.
Idea
Add a CI check that diffs the canonical upstream list against the built image:
- Fetch the
rubygem-* component names from OpenVoxProject/puppet-runtime configs/projects/agent-runtime-8.x.rb (branch is stable for the 8.x series; a 9.x variant exists as agent-runtime-main.rb)
- Run
puppetserver gem list in the built image
- Diff against a maintained ignore list of gems that are deliberately absent (agent/CLI/native-extension territory:
net-ssh, thor, ffi, sys-filesystem, ruby-dbus, CFPropertyList, minitar, erubi, multi_json, rexml, ...), each entry with a one-line reason
- Fail on new, unclassified gems
A new gem appearing upstream then shows up as a CI failure, and the decision to bundle or ignore it becomes explicit instead of being discovered in production (or at a conference).
Current known deltas as a starting point for the ignore list: see the analysis in #598 (hiera-eyaml is the one gem that should be bundled; multi_json is handled by openvox's fallback and dropped in openvox 9; the rest is agent-side).
Problem
On VMs, puppetserver sees three gem sources: the server tarball's vendored gems, the deps of the openvox gem, and the openvox-agent AIO
vendor_gems(defined by therubygem-*components in puppet-runtime'sagent-runtime-8.x.rb, shared with puppetserver viagem-path). Our image covers the first two and deliberately drops the third with the agent Ruby.That third list changes upstream without us noticing - hiera-eyaml was exactly this case: present on every VM via the agent package, silently missing in the container.
Idea
Add a CI check that diffs the canonical upstream list against the built image:
rubygem-*component names fromOpenVoxProject/puppet-runtimeconfigs/projects/agent-runtime-8.x.rb(branch is stable for the 8.x series; a 9.x variant exists asagent-runtime-main.rb)puppetserver gem listin the built imagenet-ssh,thor,ffi,sys-filesystem,ruby-dbus,CFPropertyList,minitar,erubi,multi_json,rexml, ...), each entry with a one-line reasonA new gem appearing upstream then shows up as a CI failure, and the decision to bundle or ignore it becomes explicit instead of being discovered in production (or at a conference).
Current known deltas as a starting point for the ignore list: see the analysis in #598 (hiera-eyaml is the one gem that should be bundled;
multi_jsonis handled by openvox's fallback and dropped in openvox 9; the rest is agent-side).