Buy my course: Security for Rails Developers.
Since the Ruby Central drama, there are new tools popping up to manage Ruby versions and to install gems. Ore is one of these tools, but it is more of a bundler companion than replacement. It does one thing: downloading gems and installing them. It doesn’t manage rubies, it doesn’t even need Ruby to be installed. It is written in go and can be installed as a binary, let’s see what Ore does:
❯ ore --help
ore
Usage: ore [OPTIONS] [COMMAND]
Options:
-V, --version Print version info and exit
-h, --help Print help
Commands:
init Create a new Gemfile
add Add gems to Gemfile
remove Remove gems from Gemfile
update Update gems to their latest versions within constraints
outdated List gems with newer versions available
lock Regenerate Gemfile.lock from Gemfile
fetch Download gems into cache (no Ruby required)
install Install gems from Gemfile.lock
check Verify all gems are installed
list List all gems in the current bundle
show Show the source location of a gem
info Show detailed information about a gem
search Search for gems on RubyGems.org
why Show dependency chains for a gem
exec Run commands with ore-managed environment
clean Remove unused gems from vendor directory
cache Inspect or prune the ore gem cache
pristine Restore gems to pristine condition (no Ruby required)
config Get and set Bundler configuration options
platform Display platform compatibility information
stats Show Ruby environment statistics
completion Generate shell completion scripts
audit Audit dependencies for known vulnerabilities
See 'ore <command> --help' for more information on a specific command.
As you can see it has feature parity with bundler, it gives you tools to find
out why you have a gem(ore why GEM) audit licences, search the gem catalog,
etc.
It also has a built-in audit command to check for vulnerable gems in your
Gemfile. It was pretty fast during my tests, so if speed matters to you, I
definitely recommend to give it a try.
I pretty good documentation in the Readme, so I won’t repeat all of the to show how to use and install it, check the Readme and let me know what you think!
Or follow me on Twitter
I run an indie startup providing vulnerability scanning for your Ruby on Rails app.
It is free to use at the moment, and I am grateful for any feedback about it.If you would like to give it a spin, you can do it here: Vulnerability Scanning for your Ruby on Rails app!
