ruby/ruby · error · Gem::Security::Exception

trust directory #{@dir} is not a directory

Error message

trust directory #{@dir} is not a directory

What it means

Gem::Security::TrustDir#verify ensures the directory where trusted certificates live (~/.gem/trust by default) exists and is a directory with 0700 permissions. The error fires when the path exists but is a regular file (or symlink to one), so certificates cannot be stored under it. Any trust operation (gem cert --add/--list, installing with a -P policy) hits this.

Source

Thrown at lib/rubygems/security/trust_dir.rb:108

    verify

    destination = cert_path certificate

    File.open destination, "wb", 0o600 do |io|
      io.write certificate.to_pem
      io.chmod(@permissions[:trusted_cert])
    end
  end

  ##
  # Make sure the trust directory exists.  If it does exist, make sure it's
  # actually a directory.  If not, then create it with the appropriate
  # permissions.

  def verify
    require "fileutils"
    if File.exist? @dir
      raise Gem::Security::Exception,
        "trust directory #{@dir} is not a directory" unless
          File.directory? @dir

      FileUtils.chmod 0o700, @dir
    else
      FileUtils.mkdir_p @dir, mode: @permissions[:trust_dir]
    end
  end
end

View on GitHub (pinned to 0e5b888e1c)

Solutions

1. Remove or rename the offending file so RubyGems can create the directory: mv ~/.gem/trust ~/.gem/trust.bak, then rerun the command
2. If the path is managed elsewhere, point the trust dir at a clean location via the :trust_dir opt used to construct Gem::Security::TrustDir
3. Check for a provisioning script creating ~/.gem/trust and fix it to mkdir -p -m 700 instead

Example fix

# before
$ ls -la ~/.gem/trust
-rw-r--r-- 1 user user 0 trust   # a file, not a directory
$ gem cert --list
#=> trust directory /home/user/.gem/trust is not a directory

# after
$ mv ~/.gem/trust ~/.gem/trust.bak
$ gem cert --list   # RubyGems recreates the dir with 0700

dir = Gem::Security.trust_dir.cert_directory rescue Gem::Security.trust_dir.dir # path RubyGems will use
if File.exist?(dir) && !File.directory?(dir)
  raise "#{dir} exists as a file — move it aside so RubyGems can create the trust directory"
end

When it happens

Trigger: gem cert --add cert.pem or gem install -P HighSecurity when ~/.gem/trust exists as a file; a misrestored backup, editor artifact, or provisioning script that created a file named 'trust' inside ~/.gem.

Common situations: Dotfile-management or container images that materialize ~/.gem contents as files; HOME pointed at an odd location where 'trust' collides with something else; leftover artifacts from interrupted setups.

Related errors

• Unknown environment option [#{arg}]
• #{command_name || class_name} failed#{error.message}
• root cert #{root.subject} is not trusted
• trusted root certificate #{root.subject} checksum does not m
• no certs provided

AI-assisted analysis of ruby/ruby@0e5b888e1c (2026-08-21). Data as JSON: /api/errors/2799c9095ca7d122. Report an issue: GitHub.