Merge pull request #393 from oneclick/avoid-etc

Update operating_system.rb to avoid early load of etc.so

resources/files/operating_system.rb

@@ -54,8 +54,8 @@ def operating_system_defaults
 end
 
 begin
-  config_fname = Gem::ConfigFile::SYSTEM_WIDE_CONFIG_FILE
-  unless File.exist?(config_fname)
+  config_dir = ENV['ProgramData']
+  if config_dir && !File.exist?(config_fname = File.join(config_dir, "gemrc"))
     File.open(config_fname, File::CREAT | File::EXCL | File::WRONLY) do |fd|
       fd.write <<-EOT
 # This is the system wide config file for Rubygems.

test/test_gemrc.rb

@@ -0,0 +1,10 @@
+#frozen_string_literal: true
+require "minitest/autorun"
+require "yaml"
+
+class TestGemrc < Minitest::Test
+  def test_gemrc
+    y = YAML.load_file(Gem::ConfigFile::SYSTEM_WIDE_CONFIG_FILE)
+    assert_kind_of Hash, y, "a default gemrc file should have been generated at the very first rubygems call for security reasons"
+  end
+end