How does Bundler decipher which commit corresponds to a certain Gem version?

Question

I've been researching Bundler's page and RubyGem's page (and SO posts) but can't seem to figure this out.

In the Gemfile, you specify to Bundler which version of the Gem to use. That's about all I know as true...the rest is me guessing at what goes on behind the scenes.

So it looks like Bundler then goes to RubyGems.org or some other source to figure out the Gem's versions, dependencies, and location of the source files. This is my big assumption.

Then most likely Bundler goes to the code repository, most likely Github, to download the source code. This is where I'm stuck at. If someone specifies a verion of 1.0.0, how does Bundler know which Git commit corresponds to version 1.0.0?

-Does Bundler go by tags?

-Or does Bundler go to the head a a branch that is named the same as the version number?

-Or is there a specific commit specified somewhere in RubyForge?

-Or is a snapshot of the source code available straight through RubyForge?

I'm wondering because if I specify a Gem to be at 1.0.0 and do a bundle install. Bundle takes the commit at the head of the 1.0.0 branch (if that's how Bundler does it), then if there are subsequent commits on that branch (but the version remains the same), does that mean I would have a different version of that Gem than someone who bundles after me (after the subsequent commits on the branch)?

It would make sense that bundler resolves the version to a particular commit, but how does bundler choose the commit? Because version 1.0.0 can exist across multiple commits.

Thank you for your time!

Answer 1

When a gem is uploaded to RubyGems.org, the code is packaged with the gemspec in a .gem file (which is essentially an archive like a .zip or .tar.gz file). RubyGems.org then unpacks the gemspec and reads it to get the version information, etc.

When you specify a gem version in Bundler, it checks with RubyGems.org to see if that version is available. If so, it downloads the .gem file directly from RubyGems.org and unpacks it, all of the code is right there in the .gem file so there's no need to download it from GitHub. If you specify a version that doesn't exist on RubyGems.org you'll get an error.

The only time Bundler downloads anything from GitHub is if you specify git or github instead of a version. In that case, it will download either the latest commit in the master branch (or whichever branch your Gemfile specifies) or, if Gemfile.lock exists, whichever commit is listed in Gemfile.lock.