Ruby formula's read-only bundled gems cause `gem pristine --all` to fail

[rgaufman]

brew config AND brew doctor output OR brew gist-logs <formula> link

(base) Romans-MBP.local ➜  ~  brew config
HOMEBREW_VERSION: 5.0.9
ORIGIN: https://github.com/Homebrew/brew
HEAD: bf65f9c19a7a62abcbdac9c30cf3ff844d0fd633
Last commit: 4 days ago
Branch: stable
Core tap JSON: 08 Jan 21:17 UTC
Core cask tap JSON: 08 Jan 21:17 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 28
HOMEBREW_EDITOR: nvim
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 14
Homebrew Ruby: 3.4.8 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.8/bin/ruby
CPU: 14-core 64-bit arm_palma
Clang: 17.0.0 build 1700
Git: 2.50.1 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.2-arm64
CLT: 26.2.0.0.1.1764812424
Xcode: 26.2
Metal Toolchain: N/A
Rosetta 2: false



(base) Romans-MBP.local ➜  ~  brew doctor
Your system is ready to brew.

Verification

• My brew doctor output says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update and am still able to reproduce my issue.
• I have resolved all warnings from brew doctor and that did not fix my problem.
• I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.
• My issue is not about a failure to build a formula from source.

What were you trying to do (and why)?

After upgrading Ruby via Homebrew, I ran gem pristine --all to restore gems to pristine condition (standard practice after Ruby upgrades to ensure native extensions are rebuilt).

What happened (include all command output)?

$ brew upgrade ruby
  # (upgraded from 3.4.x to 4.0.0)

  $ gem pristine --all
  Restoring gems to pristine condition...
  ERROR:  While executing gem ... (Gem::FilePermissionError)
      You don't have write permissions for the /opt/homebrew/Cellar/ruby/4.0.0/lib/ruby/gems/4.0.0/specifications/abbrev-0.1.2.gemspec directory.

  $ ls -la /opt/homebrew/Cellar/ruby/4.0.0/lib/ruby/gems/4.0.0/specifications/abbrev-0.1.2.gemspec
  -r--r--r-- 1 hackeron 1022 Dec 25 14:20 ...abbrev-0.1.2.gemspec

Files are mode 444 (read-only for everyone, including owner).

What did you expect to happen?

Gem files should be writable by owner (mode 644), allowing normal gem operations without requiring sudo chmod.

Step-by-step reproduction instructions (by running brew commands)

brew upgrade ruby
gem pristine --all
# Observe: Gem::FilePermissionError
ls -la /opt/homebrew/Cellar/ruby/4.0.0/lib/ruby/gems/4.0.0/specifications/*.gemspec
# Observe: -r--r--r-- (mode 444)


Workaround:


sudo chmod -R u+w /opt/homebrew/Cellar/ruby/4.0.0

[Bo98]

Does the same happen with older Ruby versions? The directory you mention is the one for gems that ship with Ruby (i.e. it is supposed to be immutable) - not the directory where you install stuff.

[rgaufman]

Yes, it happens on all my Macs: 2 laptops and 2 Mac Minis, with all versions, every time theres a new version of Ruby it breaks and I have to fix permissions manually on each of them.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[rgaufman]

This is still very much an issue and happens on every update.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[rgaufman]

This is still an issue, it happened again recently

[cho-m]

The problem is the bundled gems shipped with Ruby which Ruby seems to consider manageable by user. Default gems are skipped. Arch Linux did use a workaround to install bundled gems as default but RubyGems has deprecated that flag (ruby/rubygems@55745ee0f8) - https://archlinux.org/packages/extra/any/ruby-abbrev/

We can't hide the bundled gems as that will break basic functionality (e.g. irb). The paths searched are just those included in Gem.path.

---

Not many great options, e.g.

1. Allow modifications in Cellar (e.g. postinstall chmod u+w {*.gemspec, rdoc_plugin.rb}). Problem is this breaks immutable expectation.
2. Do a hacky postinstall to reinstall bundled gems as user-managed files in main prefix. I feel this is going in the wrong direction given we've been trying to get rid of these (e.g. we used to do this for Python).
3. Patch installation to allow using separate user-writable/managed directory like #{var}. But this usually will become a permanent patch which we don't want in Homebrew/core.

[Bo98]

Ideally user-installed gems would not be installed in the Homebrew prefix at all: https://github.com/Homebrew/homebrew-core/blob/main/Formula/r/ruby.rb#L201-L207

But this is a tricky change to make without being a breaking one. And I don't know if it necessarily fixes gem pristine.

[cho-m]

Pristine will still search the Gem.path which is related to default_path (i.e. our old_default_dir & private_dir, but this just restores original behavior):

homebrew-core/Formula/r/ruby.rb

Lines 246 to 250 in 29110c0

	def self.default_path
	if Gem.user_home && File.exist?(Gem.user_home)
	[user_dir, default_dir, old_default_dir, private_dir]
	else
	[default_dir, old_default_dir, private_dir]

I didn't see a way to selectively avoid scanning those:

• https://github.com/ruby/ruby/blob/v4.0.2/lib/rubygems/specification.rb#L758-L761
• https://github.com/ruby/ruby/blob/v4.0.2/lib/rubygems/commands/pristine_command.rb#L112-L115

[rgaufman]

The other issue is when doing bundle install, it caches git gems here:

$ pwd
/opt/homebrew/lib/ruby/gems/4.0.0/bundler/gems
$ ls -tra rtp-80c4fe30953d
.gemtest       .infinity_test .travis.yml    Gemfile        History.rdoc   Rakefile       lib            spec           .              rtp.gemspec
.gitignore     .rspec         CLAUDE.md      Gemfile.lock   README.rdoc    features       sarix_rtsp.py  ..             .git

So these get broken also every brew upgrade.

As a workaround, what I do is this:

  brew() {
    command brew "$@"
    local ret=$?
    if [[ "$1" =~ ^(upgrade|install|reinstall)$ ]]; then
      local ruby_prefix
      ruby_prefix="$(command brew --prefix ruby 2>/dev/null)"
      if [[ -d "$ruby_prefix" ]]; then
        chmod -R u+w "$ruby_prefix"
      fi
    fi
    return $ret
  }