`source :rubygems` is deprecated because it hits insecure HTTP source