Gem yank API endpoint

[Nick Quaranto]

In the spirit of the Apache Foundation's axiom of "If it didn't happen on-list, it didn't happen"...

So I FINALLY got some time to review jtrupiano's gem yank code, and it's seriously great. It takes into account pretty much every concern we had during the last discussion and is tested thoroughly. Gems aren't actually deleted from S3 so we should be able to recover from 'why'-esque incident easily, if that was ever to happen. I want to look into the versioning API or just use COPY's to really protect us from abuse, but I don't think it should be a blocker for getting this out there.

My final issue with this is the actual endpoint. Right now it's...

DELETE /api/v1/gems/#{gem_name}/yank form data: {:version => "1.2.3"}

I think this mixed url/data approach could be better. We could do...

DELETE /api/v1/gems {:gem_name => "SomeGem", :version => "1.2.3"}

or...

DELETE /api/v1/gems/SomeGem-1.2.3/yank

Any preferences?

-Nick

[John Trupiano]

I'd prefer the data approach.

 

DELETE /api/v1/gems {:gem_name => "SomeGem", :version => "1.2.3"}

-John 

[Nick Quaranto]

So, after some discussion on IRC (so sorry, Apache!), it seems that the original intention was that at some point the API would support removing *all* versions of a gem along with specific versions. 

I think to start we can just go as is...and take this into consideration for /api/v2. (Hurray for versioned APIs!) Of course, feedback or ideas on this are always appreciated.

-Nick

[John Barnette]

On Feb 26, 2010, at 7:12 PM, Nick Quaranto wrote:
> So, after some discussion on IRC (so sorry, Apache!), it seems that the original intention was that at some point the API would support removing *all* versions of a gem along with specific versions.
>
> I think to start we can just go as is...and take this into consideration for /api/v2. (Hurray for versioned APIs!) Of course, feedback or ideas on this are always appreciated.

Pretty easy to cover both cases in a more resourcey way if you want to (in a v2+):

DELETE /api/v2/gems/badgem # deletes all versions
DELETE /api/v2/gems/badgem/1.2.1 # only deletes 1.2.1

~ j.

[Chad Woolley]

On Fri, Feb 26, 2010 at 7:49 PM, Nick Quaranto <ni...@quaran.to> wrote:
> Gems aren't actually
> deleted from S3 so we should be able to recover from 'why'-esque incident
> easily, if that was ever to happen.

Recover how? What if someone just yanks a gem that I happen to be
using? Is this recovery going to be a manual process of asking you to
get the S3 Gem and mail it to me, or will there be a permanent
download link somewhere?

Thanks,
-- Chad

[John Trupiano]

Chad, the gem will still be available for download, it will just be ignored when you don't explicitly ask for it.  The URL will not change after a gem is yanked.

-John

[Chad Woolley]

On Sat, Feb 27, 2010 at 11:39 AM, John Trupiano <jtru...@gmail.com> wrote:
> Chad, the gem will still be available for download, it will just be ignored
> when you don't explicitly ask for it.  The URL will not change after a gem
> is yanked.

Great. That's what I thought and hoped, just wanted to confirm it got
implemented that way. Thanks for doing the work!