# Ruby

What licenseal reads in a Bundler project. The rules that hold for every ecosystem are under [How a scan works](<https://licenseal.shcherbak.ai/concepts/index.md>).

- **Registry:** RubyGems and [deps.dev](<https://licenseal.shcherbak.ai/security/license-sources/index.md>)
- **Manifests:** `Gemfile`, `*.gemspec`
- **Lockfiles:** `Gemfile.lock`

## Dev dependencies

- A `Gemfile` gem is a dev dependency only when every group it belongs to is `:development` or `:test`; a gem in any other group, in a mixed list, or in no group is production, and so is one whose group name is not written as a literal.
- A gemspec `add_development_dependency` is a dev dependency.

## Off-registry dependencies

These are reported as [off-registry dependencies](<https://licenseal.shcherbak.ai/concepts/off-registry/index.md>):

- `GIT`, `PATH`, and `PLUGIN SOURCE` specs in `Gemfile.lock`;
- a `Gemfile` gem declared with a `git` / `github` / `gist` / `bitbucket` / `path` option or block.

## See also

- [Dependency resolution](<https://licenseal.shcherbak.ai/concepts/dependency-resolution/index.md>) and [Versions and estimates](<https://licenseal.shcherbak.ai/concepts/version-resolution/index.md>), which apply to every ecosystem
- [Alternate registries](<https://licenseal.shcherbak.ai/concepts/off-registry/#alternate-registries>), for a gem in a `Gemfile` `source` block
- [License lists](<https://licenseal.shcherbak.ai/concepts/license-expressions/#license-lists>), for a gem that declares several licenses
- [Network egress](<https://licenseal.shcherbak.ai/security/network/index.md>), for the hosts contacted and what each is asked