Install bundler normally (with `gem install`) on `gem update --system`

[eregon]

Describe the problem as clearly as you can

Currently, when updating RubyGems with gem update --system, the latest Bundler is installed under site_ruby.
This has one notable side effect that checksums for that version of Bundler are not generated, causing lockfile churn (see #9512, #9558, #9735).
This is not fixed even with latest RubyGems & Bundler.

Concretely, we noticed on every single bundle install in dd-trace-rb we'd get an added checksum line for bundler, and that's because the automation updating these lockfiles uses gem update --system.
We have found a workaround by using:

gem update --system
gem install bundler

# Or using specific versions
gem update --system 4.0.17
gem install bundler --version 4.0.17

Which brings the question, should gem update --system install Bundler like a normal gem, i.e. using gem install bundler?

Does gem update --system need to change the default Bundler gem, or could it only install latest bundler like a regular gem?

Did you try upgrading RubyGems?

Yes, and upgrading RubyGems is part of this issue.

Post steps to reproduce the problem

See below.

Which command did you run?

$ chruby 4.0.6
$ gem update --system
$ echo > Gemfile
$ bundle install
$ cat Gemfile.lock
GEM
  specs:

PLATFORMS
  arm64-darwin-25
  ruby

DEPENDENCIES

CHECKSUMS

BUNDLED WITH
  4.0.18

$ gem install bundler
$ cat Gemfile.lock
GEM
  specs:

PLATFORMS
  arm64-darwin-25
  ruby

DEPENDENCIES

CHECKSUMS
  bundler (4.0.18) sha256=02d9a17429de1847b4e0c9f27a9ee4b20c0a74c0a641b4e77195d6019e3618ac

BUNDLED WITH
  4.0.18

Notice the added bundler checksum line.

What were you expecting to happen?

I'd expect the line to be there without needing a separate gem install bundler after gem update --system.

Also my expectations for gem update --system would be:

• Either install Bundler like a regular gem (effectively using gem install bundler) and ideally not under site_ruby. Installing in both places works though, but feels less clean.
• Or don't install Bundler when updating RubyGems (but probably too controversial so ignore this one).

What actually happened?

Lockfile churn, especially if lockfiles updates are done regularly by some automation which happens to update RubyGems (gem update --system).
Without automation it might stabilize if the added checksum line is committed (thanks to #9658), but could happen again when updating to a newer Bundler version.

Run gem env and paste the output below

gem env
RubyGems Environment:
  - RUBYGEMS VERSION: 4.0.18
  - RUBY VERSION: 4.0.6 (2026-07-14 patchlevel 0) [arm64-darwin25]
  - INSTALLATION DIRECTORY: /Users/benoit.daloze/.local/share/mise/installs/ruby/4.0.6/lib/ruby/gems/4.0.0
  - USER INSTALLATION DIRECTORY: /Users/benoit.daloze/.gem/ruby/4.0.0
  - CREDENTIALS FILE: /Users/benoit.daloze/.local/share/gem/credentials
  - RUBY EXECUTABLE: /Users/benoit.daloze/.local/share/mise/installs/ruby/4.0.6/bin/ruby
  - GIT EXECUTABLE: /opt/homebrew/bin/git
  - EXECUTABLE DIRECTORY: /Users/benoit.daloze/.local/share/mise/installs/ruby/4.0.6/bin
  - SPEC CACHE DIRECTORY: /Users/benoit.daloze/.gem/specs
  - SYSTEM CONFIGURATION DIRECTORY: /Users/benoit.daloze/.local/share/mise/installs/ruby/4.0.6/etc
  - RUBYGEMS PLATFORMS:
     - ruby
     - arm64-darwin-25
  - GEM PATHS:
     - /Users/benoit.daloze/.local/share/mise/installs/ruby/4.0.6/lib/ruby/gems/4.0.0
     - /Users/benoit.daloze/.gem/ruby/4.0.0
  - GEM CONFIGURATION:
     - :update_sources => true
     - :verbose => true
     - :backtrace => true
     - :bulk_threshold => 1000
     - "gem" => "--no-document"
  - REMOTE SOURCES:
     - https://rubygems.org/
  - SHELL PATH:
     ...

[eregon]

I added a complete reproduction, it reproduces with latest RubyGems and Bundler.

Given the wording in #9735

Bundler's own checksum is only included when its .gem file is cached, which
may not be the case when Bundler is installed as a default gem.

Maybe just adding the bundler gem in the cache during gem update --system would be enough to get the checksum line?
That could be another way to fix this, with minor changes.

My preference would be to not install Bundler under site_ruby, but there might be reasons to do it?