set https to the default protocol for git

[colby-swandale]

This PR is setting Git gems to be fetched over https by default.

See #6785

[segiddins]

This breaks the 1.x specs... maybe it should be turned into a feature flag?

[colby-swandale]

Yea, i wasn't really sure what to do about this but a feature flag sounds ideal.

[olleolleolle]

We've longed for this change!

[deivid-rodriguez]

Hi! I haven't looked at the CI failures, but the new feature flag and the setting github.https seem redundant to me. Can we instead change the default value of the github.https setting in bundler 2 by making it a feature flag and making it have the bundler_2_mode value?

Also, the deprecation warning does not makes a lot of sense right now. We're saying that this setting will be deprecated but introducing another one that does the same thing. I think we want to delay the deprecation horizon to bundler 3.

Finally, I see two directions here but I'm not sure which one we're heading to:

• Completely remove the github: option. I thought this was what we were doing and instead we were encouraging users to include the shortcuts they need (for github or other similar systems) right in the Gemfile. This is what Create Gemfiles with an HTTPS github source defined #5728 explains.

• Keep the github option but change the default to https.

Are we doing the latter for bundler 2, and still planning the former for later versions, or are we only doing the latter?

[colby-swandale]

Hi! I haven't looked at the CI failures, but the new feature flag and the setting github.https seem redundant to me. Can we instead change the default value of the github.https setting in bundler 2 by making it a feature flag and making it have the bundler_2_mode value?

But github.https can't be a feature flag unless we change the config name.

Also, the deprecation warning does not makes a lot of sense right now. We're saying that this setting will be deprecated but introducing another one that does the same thing. I think we want to delay the deprecation horizon to bundler 3.

Keep in mind that master is still accepting pull requests for Bundler 1 and is still only v2. The feature flags won't be bumped to Bundler 3 until after 2.0.0 has been released. When i merge this into 2-0-stable i will adjust the version being used in the major deprecation.

Are we doing the latter for bundler 2, and still planning the former for later versions

Correct, for Bundler 2 we're using https by default to fix a security problem people have been needing to adjust their Gemfile for. But we're also thinking about removing it in a future major release.

[segiddins]

We can definitely use github.https as a feature flag name, I think you’ll just need to manually construct the accessor method for it

[colby-swandale]

hmm i would prefer to avoid doing that but i will adjust it