bundler-multilock 1.4.0 → 2.0.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 96d2ea242c1ed2649402ecdaef79a271a80e406158aed36ace8e1bcd54c499e2
-  data.tar.gz: cf18464bb04949db98e4c18cff115a80fa287b1013befd2032c03cad6c171e59
+  metadata.gz: a2008728954b70bf6b491a20e480903c0f0fb827e05259a00b185b5cbfd8c262
+  data.tar.gz: fb1083e142229ddb68c753d1380a9d0be289f84221be72f2b7cc240920c9a1d7
 SHA512:
-  metadata.gz: b2a454d5a6ce63f688233c70712d3dfec217c296b3a36c40081ae74f76bbf20fe6c347be91168d575dfe11df2ebb521b2e48d925464ddd02a18c7ce5e33095c6
-  data.tar.gz: edd63eaf7fdaf1b1c3809a8adeed6022ab954cacfc8feee0d44a855fe11ce39a83f3aa8aed6779291dfc009a77608381551100436b73bfedb2bdd92606e47dd9
+  metadata.gz: 13bc99524329cc8364b84ca27b54e8424472475123534109f92b97847fa0a47b54bed7b10f46b20d85ebc138133b7739cf16322041662eae9f719a1bbb8c9b18
+  data.tar.gz: 39ecee3398e36805e27654c403c0dbe685992bb70deff5394e91436cf7c453bf398836a0b71b10a0240563f73da7dccb9fff4d9f1bc97763cd095fe7435fcaef

data/lib/bundler/multilock/check.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
-
 require_relative "cache"
 
 module Bundler
@@ -13,8 +11,12 @@ module Bundler
         end
       end
 
-      def initialize(cache = Cache.new)
+      # @param check_installed [true, false]
+      #   If gems must be installed (not just locked) for a lockfile to be valid.
+      #   `bundle lock` doesn't install anything, so it shouldn't care.
+      def initialize(cache = Cache.new, check_installed: true)
         @cache = cache
+        @check_installed = check_installed
       end
 
       def run(skip_base_checks: false)
@@ -54,14 +56,28 @@ module Bundler
           # root needs to be set so that paths are output relative to the correct root in the lockfile
           Bundler.root = lockfile_definition[:gemfile].dirname
 
-          definition = Definition.build(lockfile_definition[:gemfile], lockfile_name, false)
-          next false unless definition.send(:current_platform_locked?)
+          lockfile_path = lockfile_name.relative_path_from(Dir.pwd)
+          gemfile_path = lockfile_definition[:gemfile].relative_path_from(Dir.pwd)
+
+          # (as the default lockfile, so that it isn't swapped for the active one)
+          definition = Bundler.with_default_lockfile(lockfile_name) do
+            Definition.build(lockfile_definition[:gemfile], lockfile_name, false)
+          end
+          unless definition.send(:current_platform_locked?)
+            next base_check_failed("#{lockfile_path} does not include the current platform " \
+                                   "(#{Bundler.local_platform}).")
+          end
+          # the lockfile's sources don't match the Gemfile's (like a different
+          # git remote); also, resolving would try to fetch the new source
+          if definition.instance_variable_get(:@source_changes)
+            next base_check_failed(source_changes_message(definition, lockfile_path, gemfile_path))
+          end
 
           begin
             definition.validate_runtime!
-            not_installed = Bundler.ui.silence { definition.missing_specs }
-          rescue RubyVersionMismatch, GemNotFound, SolveFailure
-            next false
+            not_installed = @check_installed ? Bundler.ui.silence { definition.missing_specs } : []
+          rescue RubyVersionMismatch, GemNotFound, SolveFailure, GitError => e
+            next base_check_failed("Could not check #{lockfile_path}: #{e.message}")
           end
 
           if Bundler.ui.error?
@@ -71,6 +87,19 @@ module Bundler
           end
 
           next false unless not_installed.empty?
+          # without checking installed gems, nothing above notices a dependency
+          # that was added to the Gemfile but isn't locked yet
+          unless @check_installed || definition.no_resolve_needed?
+            next base_check_failed("#{lockfile_path} is out of date, because #{definition.send(:change_reason)}.")
+          end
+
+          # (and even when checking installed gems, a dependency like a path gem
+          # or plugin can be "installed" without being locked)
+          unlocked = definition.dependencies.map(&:name) - definition.locked_gems.dependencies.keys
+          unless unlocked.empty?
+            next base_check_failed("#{lockfile_path} is missing dependencies from #{gemfile_path}: " \
+                                   "#{unlocked.join(", ")}.")
+          end
 
           # cache a sentinel so that we can share a cache regardless of the check_missing_deps argument
           next :missing_deps unless (definition.locked_gems.dependencies.values - definition.dependencies).empty?
@@ -86,12 +115,56 @@ module Bundler
         Bundler.root = default_root
       end
 
+      # @return [false]
+      def base_check_failed(message) # rubocop:disable Naming/PredicateMethod -- not a predicate
+        Bundler.ui.error(message)
+        false
+      end
+
+      def source_changes_message(definition, lockfile_path, gemfile_path)
+        locked = definition.locked_gems.sources
+        current = definition.send(:sources).lock_sources
+        only_locked = locked.reject { |source| current.include?(source) }
+        only_current = current.reject { |source| locked.include?(source) }
+
+        message = "The sources in #{lockfile_path} do not match #{gemfile_path}."
+        message << "\n  Only in #{lockfile_path}: #{only_locked.join(", ")}" unless only_locked.empty?
+        message << "\n  Only in #{gemfile_path}: #{only_current.join(", ")}" unless only_current.empty?
+        message
+      end
+
+      # checks that every gem has a checksum, and that gems in common (same version
+      # and source) with the parent lockfile have the same checksums
+      def checksums_valid?(parser, parent_parser, lockfile_path)
+        parent_specs = parent_parser.specs.to_h { |spec| [spec.full_name, spec] }
+        invalid = parser.specs.select do |spec|
+          next false unless spec.source.is_a?(Source::Rubygems)
+
+          checksums = spec.source.checksum_store.checksums_to_lock(spec.full_name)
+          unless checksums
+            Bundler.ui.error("#{lockfile_path} is missing a checksum for #{spec.lock_name}.")
+            next true
+          end
+
+          parent_spec = parent_specs[spec.full_name]
+          next false unless parent_spec && parent_spec.source == spec.source
+
+          parent_checksums = parent_spec.source.checksum_store.checksums_to_lock(spec.full_name)
+          next false if parent_checksums.nil? || checksums == parent_checksums
+
+          Bundler.ui.error("The checksum for #{spec.lock_name} in #{lockfile_path} " \
+                           "does not match the parent lockfile's (#{parent_checksums}).")
+          true
+        end
+        invalid.empty?
+      end
+
       # this checks for mismatches between the parent lockfile and the given lockfile,
       # and for pinned dependencies in lockfiles requiring them
       def deep_check(lockfile_definition, conflicts: nil)
         lockfile_name = lockfile_definition[:lockfile]
         @cache.deep_check(lockfile_name) do
-          success = true # -- work around rubocop bug
+          success = true
           proven_pinned = Set.new
           needs_pin_check = []
           parser = @cache.parser(lockfile_name)
@@ -100,18 +173,26 @@ module Bundler
           parent_parser = @cache.parser(parent_lockfile_name)
           unless parser.platforms == parent_parser.platforms
             Bundler.ui.error("The platforms in #{lockfile_path} do not match the parent lockfile.")
-            success = false # -- work around rubocop bug
+            success = false
           end
           unless parser.bundler_version == parent_parser.bundler_version
             Bundler.ui.error("bundler (#{parser.bundler_version}) in #{lockfile_path} " \
                              "does not match the parent lockfile's version (@#{parent_parser.bundler_version}).")
-            success = false # -- work around rubocop bug
+            success = false
           end
           unless parser.ruby_version == parent_parser.ruby_version
             Bundler.ui.error("ruby (#{parser.ruby_version || "<none>"}) in #{lockfile_path} " \
                              "does not match the parent lockfile's version (#{parent_parser.ruby_version}).")
             success = false
           end
+          unless !parser.checksums == !parent_parser.checksums
+            Bundler.ui.error("The parent lockfile #{parent_parser.checksums ? "has" : "does not have"} checksums, " \
+                             "but #{lockfile_path} #{parser.checksums ? "does" : "does not"}.")
+            success = false
+          end
+          if parser.checksums && parent_parser.checksums && !checksums_valid?(parser, parent_parser, lockfile_path)
+            success = false
+          end
 
           # look through top-level explicit dependencies for pinned requirements
           if lockfile_definition[:enforce_pinned_additional_dependencies]
@@ -177,8 +258,10 @@ module Bundler
 
             next if pinned
 
-            Bundler.ui.error("#{spec} in #{lockfile_path} has not been pinned to a specific version,  " \
-                             "which is required since it is not part of the parent lockfile.")
+            message = "#{spec} in #{lockfile_path} has not been pinned to a specific version,  " \
+                      "which is required since it is not part of the parent lockfile."
+            message << " Be sure to set the ref to a commit hash for git sources." if spec.source.is_a?(Source::Git)
+            Bundler.ui.error(message)
             success = false
           end
 

data/lib/bundler/multilock/ext/bundler.rb

@@ -19,7 +19,13 @@ module Bundler
         def default_lockfile(force_original: false)
           return @default_lockfile if @default_lockfile && !force_original
 
-          super()
+          # Multilock handles BUNDLE_LOCKFILE itself
+          env_lockfile = ENV.delete("BUNDLE_LOCKFILE")
+          begin
+            super()
+          ensure
+            ENV["BUNDLE_LOCKFILE"] = env_lockfile if env_lockfile
+          end
         end
 
         def with_default_lockfile(lockfile)

data/lib/bundler/multilock/ext/cli.rb

@@ -4,12 +4,44 @@ module Bundler
   module Multilock
     module Ext
       module CLI
+        # What we need to know from the CLI instance, when we can't find it
+        Invocation = Struct.new(:current_command_chain, :options)
+        private_constant :Invocation
+
         module ClassMethods
           def instance
             return @instance if instance_variable_defined?(:@instance)
 
             # this is a little icky, but there's no other way to determine which command was run
-            @instance = ObjectSpace.each_object(::Bundler::CLI).first
+            @instance = begin
+              ObjectSpace.each_object(::Bundler::CLI).first
+            rescue RuntimeError
+              # JRuby only supports ObjectSpace for classes and modules (unless
+              # it's run with -X+O), so parse the command line the same way Thor
+              # does instead
+              invocation_from_argv
+            end
+          end
+
+          private
+
+          def invocation_from_argv
+            # `bundle exec` loads Ruby executables (like bundler itself) in the
+            # same process, with their own ARGV. ObjectSpace would find the
+            # original `exec` command then, so be consistent with that. (Bundler
+            # only loads CLI::Exec when running `bundle exec`.)
+            return Invocation.new([:exec], {}) if ::Bundler::CLI.const_defined?(:Exec, false)
+
+            args = ARGV.dup
+            name = normalize_command_name(retrieve_command_name(args))
+            command = all_commands[name]
+            return unless command
+
+            _arguments, options = Bundler::Thor::Options.split(args)
+            options = Bundler::Thor::Options.new(class_options.merge(command.options)).parse(options)
+            Invocation.new([name.to_sym], options)
+          rescue Bundler::Thor::Error
+            nil
           end
         end
 

data/lib/bundler/multilock/ext/definition.rb

@@ -16,6 +16,13 @@ module Bundler
           super
         end
 
+        # `bundle install` sets the lockfile from BUNDLE_LOCKFILE, which Multilock handles itself
+        def lockfile=(lockfile)
+          lockfile = Bundler.default_lockfile if lockfile && lockfile.to_s == ENV.fetch("BUNDLE_LOCKFILE", nil)
+
+          super
+        end
+
         def validate_runtime!
           Multilock.loaded! unless Multilock.lockfile_definitions.empty?
 

data/lib/bundler/multilock/ext/dsl.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "set"
-
 module Bundler
   module Multilock
     module Ext
@@ -16,9 +14,21 @@ module Bundler
           #    themselves
           #  * mark Multilock as loaded once the main gemfile is evaluated
           #    so that they're not loaded multiple times
+          #  * ignore a lockfile that Bundler derived from BUNDLE_LOCKFILE
+          #    before Multilock was loaded
+          #  * when evaluating again after Multilock is loaded (`lockfile` no
+          #    longer does anything then), still include the lockfile's block
           def evaluate(gemfile, lockfile, unlock)
+            if !Multilock.loaded? &&
+               (env_lockfile = ENV.fetch("BUNDLE_LOCKFILE", nil)) &&
+               lockfile.to_s == env_lockfile
+              lockfile = Bundler.default_lockfile(force_original: true)
+            end
+
             builder = new
-            builder.eval_gemfile(gemfile, &Multilock.prepare_block) if Multilock.prepare_block
+            prepare_block = Multilock.prepare_block
+            prepare_block ||= Multilock.lockfile_definitions.dig(lockfile, :prepare) if Multilock.loaded?
+            builder.eval_gemfile(gemfile, &prepare_block) if prepare_block
             builder.eval_gemfile(gemfile)
             if (ruby_version_requirement = builder.instance_variable_get(:@ruby_version)) &&
                Multilock.lockfile_definitions[lockfile]
@@ -52,7 +62,7 @@ module Bundler
           if block
             instance_eval(&block)
           else
-            instance_eval(contents.dup.tap { |x| x.untaint if RUBY_VERSION < "2.7" }, @gemfile.to_s, 1)
+            instance_eval(contents.dup, @gemfile.to_s, 1)
           end
         rescue Exception => e # rubocop:disable Lint/RescueException
           message = "There was an error " \
@@ -64,10 +74,35 @@ module Bundler
           @gemfile = original_gemfile
         end
 
-        def lockfile(*args, **kwargs, &)
+        # Significant changes:
+        #  * in a Gemfile we switched to (see #allow_duplicate_plugins_in), don't
+        #    warn the first time a plugin that's already declared is declared again
+        def plugin(name, *args)
+          unless @duplicate_plugins_gemfile &&
+                 @gemfile == @duplicate_plugins_gemfile &&
+                 !@allowed_duplicate_plugins.include?(name) &&
+                 @dependencies.any? { |dependency| dependency.name == name }
+            return super
+          end
+
+          @allowed_duplicate_plugins << name
+          # Bundler only warns about it (instead of raising) if the version
+          # requirements and the source match exactly
+          Bundler.ui.silence { super }
+        end
+
+        # @!visibility private
+        # Allows plugins to be declared again, once each, in the given Gemfile,
+        # without Bundler warning that they're listed more than once
+        def allow_duplicate_plugins_in(gemfile)
+          @duplicate_plugins_gemfile = Pathname.new(gemfile).expand_path
+          @allowed_duplicate_plugins = Set.new
+        end
+
+        def lockfile(*, **, &)
           return true if Multilock.loaded?
 
-          Multilock.add_lockfile(*args, builder: self, **kwargs, &)
+          Multilock.add_lockfile(*, builder: self, **, &)
         end
       end
     end

data/lib/bundler/multilock/preamble.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+module Bundler
+  module Multilock
+    # @!visibility private
+    # Keeps the preamble that loads the plugin in the Gemfile up to date:
+    #
+    #   plugin "bundler-multilock", "~> 2.0"
+    #   return unless Plugin.loaded?("bundler-multilock")
+    module Preamble
+      class << self
+        # @return [String] the version requirement for the plugin in the preamble
+        def requirement
+          version = Gem::Version.new(VERSION)
+          # a prerelease doesn't satisfy `~> 2.0`, so allow later prereleases
+          # (and releases) of this minor version instead
+          return "~> #{version}" if version.prerelease?
+
+          "~> #{version.segments.first}.0"
+        end
+
+        # Adds the preamble to the Gemfile, or updates an existing one
+        def inject
+          Bundler.ui.debug("Injecting multilock preamble")
+
+          requirement = self.requirement
+          bundle_preamble1_match = /plugin\(?\s*["']bundler-multilock["']/
+          bundle_preamble1 = <<~RUBY
+            plugin "bundler-multilock", "#{requirement}"
+          RUBY
+          bundle_preamble2 = <<~RUBY
+            return unless Plugin.loaded?("bundler-multilock")
+          RUBY
+
+          builder = Bundler::Plugin::DSL.new
+          # this method is called as part of the plugin loading, but @loaded_plugin_names
+          # hasn't been set yet, so avoid re-entrancy issues
+          plugins = Bundler::Plugin.instance_variable_get(:@loaded_plugin_names)
+          original_plugins = plugins.dup
+          plugins << "bundler-multilock"
+          begin
+            builder.eval_gemfile(Bundler.default_gemfile)
+          ensure
+            plugins.replace(original_plugins)
+          end
+          gemfile_paths = builder.instance_variable_get(:@gemfiles).to_a
+          gemfiles = gemfile_paths.to_h { |path| [path, path.read] }
+          originals = gemfiles.transform_values(&:dup)
+
+          gemfiles.each_value { |contents| upgrade(contents, requirement) }
+
+          gemfile = gemfiles[Bundler.default_gemfile.expand_path] || Bundler.default_gemfile.read
+
+          # skip past leading comments, blank lines, and sources.
+          # (\G anchors at injection_point; ^ would match any later line)
+          injection_point = 0
+          while injection_point < gemfile.length && gemfile.match?(/\G(?:#|\n|source)/, injection_point)
+            if gemfile[injection_point] == "\n"
+              injection_point += 1
+            else
+              injection_point = (gemfile.index("\n", injection_point) || (gemfile.length - 1)) + 1
+            end
+          end
+          guard_match = Regexp.new(Regexp.escape(bundle_preamble2).gsub('"', %(["'])))
+          guard_present = gemfiles.each_value.any? { |contents| match_in_code?(contents, guard_match) }
+          # if the plugin is already declared, the guard has to go after it (in
+          # whichever Gemfile it's in), so that Bundler can still find the plugin
+          # while it's not loaded
+          guarded_declaration = !guard_present && gemfiles.each_value.any? do |contents|
+            insert_after_statement(contents, bundle_preamble1_match, bundle_preamble2)
+          end
+          unless guarded_declaration
+            # don't append to the end of the last line. (if we got to the end, the
+            # Gemfile is only comments and sources, so the preamble will be injected.)
+            if injection_point == gemfile.length && !gemfile.empty? && !gemfile.end_with?("\n")
+              gemfile << "\n"
+              injection_point += 1
+            end
+
+            inject_specific(gemfile, gemfiles.values, injection_point, bundle_preamble2, add_newline: true)
+            inject_specific(gemfile,
+                            gemfiles.values,
+                            injection_point,
+                            bundle_preamble1,
+                            match: bundle_preamble1_match,
+                            add_newline: false)
+          end
+          gemfiles[Bundler.default_gemfile.expand_path] = gemfile
+
+          gemfiles.each do |path, contents|
+            path.write(contents) unless contents == originals[path]
+          end
+        end
+
+        private
+
+        # Bundler loads the plugin before evaluating the Gemfile, so manually
+        # loading it is no longer necessary. But Bundler also pre-parses the
+        # Gemfile for plugins _without_ loading them, so the rest of the Gemfile
+        # needs to be skipped when the plugin isn't loaded (not just installed).
+        # Also update the version requirement if it doesn't allow this version,
+        # or if it still references a prerelease after a release.
+        def upgrade(gemfile, requirement)
+          load_plugin = /^\n?[ \t]*Plugin\.send\(:load_plugin, (["'])bundler-multilock\1\)[ \t]*\n/
+          gsub_code!(gemfile, load_plugin, "Plugin") { "" }
+          # normalize the guard (with or without parentheses), so that it's
+          # recognized as already present
+          guard = /return\ unless\ Plugin\.(?:installed|loaded)\?
+                   (?:\(\s*(["'])bundler-multilock\1\s*\) # parenthesized
+                   |\s+(["'])bundler-multilock\2)          # or not
+                  /x
+          gsub_code!(gemfile, guard, "return") do |m|
+            quote = m[1] || m[2]
+            "return unless Plugin.loaded?(#{quote}bundler-multilock#{quote})"
+          end
+          # every string argument after the name is a version constraint, until
+          # options (like `source:`, or `"source" =>`) start. there may be
+          # newlines and comments between them.
+          constraint = /\s*,(?:\s|\#[^\n]*)*(["'])[^"'\n]*\k<-1>(?!\s*=>)/
+          gsub_code!(gemfile, /^([ \t]*plugin\(?\s*(["'])bundler-multilock\2)((?:#{constraint})+)/, "plugin") do |m|
+            match = m[0]
+            prefix, constraints = m[1], m[3].gsub(/\#[^\n]*/, "")
+            quote = constraints[/["']/]
+            existing_requirement = Gem::Requirement.new(*constraints.scan(/(["'])([^"'\n]*)\1/).map(&:last))
+            version = Gem::Version.new(VERSION)
+            if existing_requirement.satisfied_by?(version) && (version.prerelease? || !existing_requirement.prerelease?)
+              next match
+            end
+
+            "#{prefix}, #{quote}#{requirement}#{quote}"
+          rescue Gem::Requirement::BadRequirementError
+            match
+          end
+        end
+
+        # Like String#gsub!, but skips matches whose `keyword` is inside a string,
+        # heredoc, or comment, instead of actual Ruby code
+        #
+        # @yieldparam match [MatchData]
+        def gsub_code!(source, pattern, keyword)
+          non_code = non_code_ranges(source)
+          result = +""
+          copied_until = 0
+          replaced = false
+          each_match(source, pattern) do |match|
+            offset = match.pre_match.bytesize + match[0].b.index(keyword)
+            next if non_code.any? { |range| range.cover?(offset) }
+
+            result << source[copied_until...match.begin(0)] << yield(match)
+            copied_until = match.end(0)
+            replaced = true
+          end
+          return unless replaced
+
+          source.replace(result << source[copied_until..])
+        end
+
+        # Yields each match of pattern in source
+        #
+        # @yieldparam match [MatchData]
+        def each_match(source, pattern)
+          position = 0
+          while (match = pattern.match(source, position))
+            yield match
+            # (always move forward, even after an empty match)
+            position = [match.end(0), match.begin(0) + 1].max
+          end
+        end
+
+        # @return [true, false] if pattern matches somewhere other than in a string, heredoc, or comment
+        def match_in_code?(source, pattern)
+          !code_match_offsets(source, pattern).empty?
+        end
+
+        # @return [Array<Integer>] the byte offsets of matches that aren't in a string, heredoc, or comment
+        def code_match_offsets(source, pattern)
+          non_code = non_code_ranges(source)
+          offsets = []
+          each_match(source, pattern) do |match|
+            offset = match.pre_match.bytesize
+            offsets << offset if non_code.none? { |range| range.cover?(offset) }
+          end
+          offsets
+        end
+
+        # Inserts text on the line after the first statement (in code) matching pattern
+        #
+        # @return [true, false] if there was such a statement
+        def insert_after_statement(source, pattern, text) # rubocop:disable Naming/PredicateMethod -- not a predicate
+          offset = code_match_offsets(source, pattern).first
+          return false unless offset
+
+          insertion = statement_end(source, offset)
+          text = "\n#{text}" if insertion == source.bytesize && !source.end_with?("\n")
+          source.insert(source.byteslice(0, insertion).length, text)
+          true
+        end
+
+        # @return [Integer] the byte offset of the start of the line after the
+        #   statement at offset
+        def statement_end(source, offset)
+          require "ripper"
+
+          line_offsets = [0]
+          source.each_line { |line| line_offsets << (line_offsets.last + line.bytesize) }
+
+          depth = 0
+          Ripper.lex(source).each do |(line, column), type, _token, state|
+            start = line_offsets[line - 1] + column
+            next if start < offset
+
+            case type
+            when :on_lparen, :on_lbracket, :on_lbrace then depth += 1
+            when :on_rparen, :on_rbracket, :on_rbrace then depth -= 1
+            when :on_nl, :on_semicolon
+              return line_end(source, start) if depth.zero?
+            when :on_comment
+              # a comment after a complete expression ends the statement
+              return line_end(source, start) if depth.zero? && state.anybits?(Ripper::EXPR_END_ANY)
+            end
+          end
+          source.bytesize
+        end
+
+        def line_end(source, offset)
+          (source.byteindex("\n", offset) || (source.bytesize - 1)) + 1
+        end
+
+        # @return [Array<Range>] the byte ranges of strings, heredocs, and comments in Ruby source
+        def non_code_ranges(source)
+          require "ripper"
+
+          line_offsets = [0]
+          source.each_line { |line| line_offsets << (line_offsets.last + line.bytesize) }
+
+          Ripper.lex(source).filter_map do |(line, column), type, token|
+            start = line_offsets[line - 1] + column
+            case type
+            when :on_tstring_content, :on_comment, :on_embdoc then start...(start + token.bytesize)
+            when :on___end__ then start...source.bytesize
+            end
+          end
+        end
+
+        def inject_specific(gemfile, gemfiles, injection_point, preamble, add_newline:, match: nil) # rubocop:disable Naming/PredicateMethod -- not a predicate
+          # allow either type of quotes
+          match ||= Regexp.new(Regexp.escape(preamble).gsub('"', %(["'])))
+          return false if gemfiles.any? { |g| match_in_code?(g, match) }
+
+          add_newline = false unless gemfile[injection_point - 1] == "\n"
+
+          gemfile.insert(injection_point, "\n") if add_newline
+          gemfile.insert(injection_point, preamble)
+
+          true
+        end
+      end
+    end
+  end
+end

data/lib/bundler/multilock/version.rb

@@ -2,6 +2,6 @@
 
 module Bundler
   module Multilock
-    VERSION = "1.4.0"
+    VERSION = "2.0.0.beta1"
   end
 end

data/lib/bundler/multilock.rb

@@ -3,11 +3,11 @@
 require_relative "multilock/ext/bundler"
 require_relative "multilock/ext/definition"
 require_relative "multilock/ext/dsl"
-require_relative "multilock/ext/plugin"
 require_relative "multilock/ext/plugin/dsl"
 require_relative "multilock/ext/shared_helpers"
 require_relative "multilock/ext/source"
 require_relative "multilock/ext/source_list"
+require_relative "multilock/preamble"
 require_relative "multilock/version"
 
 module Bundler
@@ -33,22 +33,13 @@ module Bundler
       # @yield
       #   Block executed only when this lockfile is active.
       # @return [true, false] if the lockfile is the active lockfile
-      def add_lockfile(lockfile = nil,
+      def add_lockfile(lockfile = nil, # rubocop:disable Naming/PredicateMethod -- not a predicate
                        builder:,
                        gemfile: nil,
                        active: nil,
-                       default: nil,
                        parent: nil,
-                       allow_mismatched_dependencies: nil,
                        enforce_pinned_additional_dependencies: false,
                        &block)
-        # backcompat
-        active = default if active.nil?
-        Bundler.ui.warn("lockfile(default:) is deprecated. Use lockfile(active:) instead.") if default
-        unless allow_mismatched_dependencies.nil?
-          Bundler.ui.warn("lockfile(allow_mismatched_dependencies:) is deprecated.")
-        end
-
         active = true if active.nil? && lockfile_definitions.empty? && lockfile.nil? && gemfile.nil?
 
         # if a gemfile was provided, but not a lockfile, infer the default lockfile for that gemfile
@@ -58,9 +49,11 @@ module Bundler
 
         raise ArgumentError, "Lockfile #{lockfile} is already defined" if lockfile_definitions.key?(lockfile)
 
-        env_lockfile = lockfile if active && ENV["BUNDLE_LOCKFILE"] == "active"
-        env_lockfile ||= ENV["BUNDLE_LOCKFILE"]&.then { |l| expand_lockfile(l) }
-        active = env_lockfile == lockfile if env_lockfile
+        env_lockfile_names = self.env_lockfile_names
+        unless env_lockfile_names.empty?
+          active = (active && env_lockfile_names.include?("active")) ||
+                   env_lockfile_names.any? { |name| expand_lockfile(name) == lockfile }
+        end
 
         if active && (old_active = lockfile_definitions.each_value.find { |definition| definition[:active] })
           raise ArgumentError, "Only one lockfile (#{old_active[:lockfile]}) can be flagged as active"
@@ -85,8 +78,8 @@ module Bundler
         # If they're using BUNDLE_LOCKFILE, then they really do want to
         # use a particular lockfile, and it overrides whatever they
         # dynamically set in their gemfile
-        if !env_lockfile && defined?(CLI) &&
-           %i[check install lock update].include?(CLI.instance&.current_command_chain&.first)
+        if env_lockfile_names.empty? &&
+           %i[check install lock update].include?(cli&.current_command_chain&.first)
           # always use Gemfile.lock for `bundle check`, `bundle install`,
           # `bundle lock`, and `bundle update`.
           active = lockfile == Bundler.default_lockfile(force_original: true)
@@ -105,6 +98,8 @@ module Bundler
             Bundler.root = Bundler.default_gemfile.dirname
             Bundler.default_lockfile = lockfile
 
+            # that Gemfile should declare its plugins too, but they may already be declared
+            builder.allow_duplicate_plugins_in(Bundler.default_gemfile)
             builder.eval_gemfile(Bundler.default_gemfile)
 
             return false
@@ -119,7 +114,7 @@ module Bundler
         previous_recursive = @recursive
 
         return if lockfile_definitions.empty?
-        return if ENV["BUNDLE_LOCKFILE"] # explicitly working against a single lockfile
+        return if env_lockfile # explicitly working against a single lockfile
 
         # must be running `bundle cache`
         return unless Bundler.default_lockfile == Bundler.default_lockfile(force_original: true)
@@ -128,7 +123,8 @@ module Bundler
 
         if Bundler.frozen_bundle? && !install
           # only do the checks if we're frozen
-          exit 1 unless Check.run
+          # `bundle lock` doesn't install anything
+          exit 1 unless Check.new(check_installed: false).run
           return
         end
 
@@ -149,7 +145,7 @@ module Bundler
         default_root = Bundler.root
 
         cache = Cache.new
-        checker = Check.new(cache)
+        checker = Check.new(cache, check_installed: install)
         synced_any = false
         local_parser_cache = {}
         Bundler.settings.temporary(cache_all_platforms: true, suppress_install_using_messages: true) do
@@ -279,12 +275,6 @@ module Bundler
                 end
 
                 lockfile.platforms.replace(parent_lockfile.platforms).uniq!
-                # prune more specific platforms
-                lockfile.platforms.delete_if do |p1|
-                  lockfile.platforms.any? do |p2|
-                    p2 != "ruby" && p1 != p2 && MatchPlatform.platforms_match?(p2, p1)
-                  end
-                end
                 lockfile.instance_variable_set(:@ruby_version, parent_lockfile.ruby_version) if lockfile.ruby_version
                 unless lockfile.bundler_version == parent_lockfile.bundler_version
                   unlocking_bundler = parent_lockfile.bundler_version
@@ -342,16 +332,21 @@ module Bundler
         return if loaded?
 
         @loaded = true
-        return if lockfile_definitions.empty?
+        if lockfile_definitions.empty?
+          # nothing for Multilock to manage; use BUNDLE_LOCKFILE as a plain path, like Bundler would
+          if env_lockfile && !env_lockfile_names.include?("active")
+            Bundler.default_lockfile = Pathname.new(File.expand_path(env_lockfile))
+          end
+          return
+        end
 
         return unless lockfile_definitions.each_value.none? { |definition| definition[:active] }
 
-        if ENV["BUNDLE_LOCKFILE"]&.then { |l| expand_lockfile(l) } ==
-           Bundler.default_lockfile(force_original: true)
+        if env_lockfile_names.any? { |name| expand_lockfile(name) == Bundler.default_lockfile(force_original: true) }
           return
         end
 
-        raise GemfileNotFound, "Could not locate lockfile #{ENV["BUNDLE_LOCKFILE"].inspect}" if ENV["BUNDLE_LOCKFILE"]
+        raise GemfileNotFound, "Could not locate lockfile #{env_lockfile.inspect}" if env_lockfile
 
         # Gemfile.lock isn't explicitly specified, otherwise it would be active
         default_lockfile_definition = self.default_lockfile_definition
@@ -366,55 +361,41 @@ module Bundler
       end
 
       # @!visibility private
-      def inject_preamble
-        Bundler.ui.debug("Injecting multilock preamble")
-
-        minor_version = Gem::Version.new(::Bundler::Multilock::VERSION).segments[0..1].join(".")
-        bundle_preamble1_match = /plugin ["']bundler-multilock["']/
-        bundle_preamble1 = <<~RUBY
-          plugin "bundler-multilock", "~> #{minor_version}"
-        RUBY
-        bundle_preamble2 = <<~RUBY
-          return unless Plugin.installed?("bundler-multilock")
-
-          Plugin.send(:load_plugin, "bundler-multilock")
-        RUBY
-
-        gemfile = Bundler.default_gemfile.read
-
-        injection_point = 0
-        while gemfile.match?(/^(?:#|\n|source)/, injection_point)
-          if gemfile[injection_point] == "\n"
-            injection_point += 1
-          else
-            injection_point = gemfile.index("\n", injection_point)
-            injection_point += 1 if injection_point
-            injection_point ||= -1
-          end
-        end
+      # The BUNDLE_LOCKFILE the user asked for, if any, as close as possible to
+      # how they wrote it
+      def env_lockfile
+        env_lockfile_and_recovered&.first
+      end
 
-        builder = Bundler::Plugin::DSL.new
-        # this method is called as part of the plugin loading, but @loaded_plugin_names
-        # hasn't been set yet, so avoid re-entrancy issues
-        plugins = Bundler::Plugin.instance_variable_get(:@loaded_plugin_names)
-        original_plugins = plugins.dup
-        plugins << "bundler-multilock"
-        begin
-          builder.eval_gemfile(Bundler.default_gemfile)
-        ensure
-          plugins.replace(original_plugins)
-        end
-        gemfiles = builder.instance_variable_get(:@gemfiles).map(&:read)
+      # @!visibility private
+      # What BUNDLE_LOCKFILE could have been written as; usually just one
+      # thing (see #env_lockfile_and_recovered)
+      #
+      # @return [Array<String>]
+      def env_lockfile_names
+        lockfile, recovered = env_lockfile_and_recovered
+        return [] unless lockfile
+        return [lockfile] if recovered
+
+        # we can't tell if Bundler expanded a short name (or "active") to an
+        # absolute path, or if it was written that way, so allow either
+        relative = Pathname.new(lockfile).relative_path_from(Pathname.pwd).to_s
+        relative.include?("/") ? [lockfile] : [lockfile, relative]
+      end
 
-        modified = inject_specific_preamble(gemfile, gemfiles, injection_point, bundle_preamble2, add_newline: true)
-        modified = true if inject_specific_preamble(gemfile,
-                                                    gemfiles,
-                                                    injection_point,
-                                                    bundle_preamble1,
-                                                    match: bundle_preamble1_match,
-                                                    add_newline: false)
+      # @!visibility private
+      # @return [Bundler::CLI, nil] the bundler command that's running, if any
+      def cli
+        # Bundler autoloads its CLI, so it's only running if it's already loaded
+        # (and checking that the constant is defined doesn't tell us that)
+        return unless cli_loaded? && CLI.respond_to?(:instance)
 
-        Bundler.default_gemfile.write(gemfile) if modified
+        CLI.instance
+      end
+
+      # @!visibility private
+      def cli_loaded?
+        Bundler.autoload?(:CLI).nil? && !defined?(Bundler::CLI).nil?
       end
 
       # @!visibility private
@@ -430,6 +411,30 @@ module Bundler
 
       private
 
+      # @return [Array(String, true or false), nil]
+      #   BUNDLE_LOCKFILE, and if it's known to be exactly how the user wrote it
+      def env_lockfile_and_recovered
+        lockfile = ENV.fetch("BUNDLE_LOCKFILE", nil)
+        return if lockfile.nil? || lockfile.empty?
+        # not expanded by Bundler (yet)
+        return [lockfile, true] unless Pathname.new(lockfile).absolute?
+
+        # Bundler expands BUNDLE_LOCKFILE to an absolute path, relative to the
+        # current directory, but remembers the original value. That original
+        # is inherited by nested bundler commands though, so make sure it's
+        # actually the one that was expanded.
+        original = ENV.fetch("#{EnvironmentPreserver::BUNDLER_PREFIX}BUNDLE_LOCKFILE", nil)
+        if original == EnvironmentPreserver::INTENTIONALLY_NIL
+          # Bundler sets BUNDLE_LOCKFILE to the default lockfile for subprocesses
+          # when nobody asked for a particular lockfile
+          return if lockfile == Bundler.default_lockfile(force_original: true).to_s
+        elsif original && File.expand_path(original) == lockfile
+          return [original, true]
+        end
+
+        [lockfile, false]
+      end
+
       def expand_lockfile(lockfile)
         if lockfile.is_a?(String) && !(lockfile.include?("/") || lockfile.end_with?(".lock"))
           lockfile = "Gemfile.#{lockfile}.lock"
@@ -440,17 +445,49 @@ module Bundler
         lockfile || Bundler.default_lockfile(force_original: true)
       end
 
-      def inject_specific_preamble(gemfile, gemfiles, injection_point, preamble, add_newline:, match: nil)
-        # allow either type of quotes
-        match ||= Regexp.new(Regexp.escape(preamble).gsub('"', %(["'])))
-        return false if gemfiles.any? { |g| match.match?(g) }
+      # Gems resolved from what's installed locally don't have checksums. Copy
+      # them from the parent lockfile for gems in common (so that they match),
+      # or else compute them from cached gems (without fetching anything).
+      #
+      # @return [Array] specs that still don't have checksums
+      def fill_checksums(definition, parent_lockfile, cache)
+        return [] if Bundler.frozen_bundle? || !definition.locked_checksums
+
+        require "rubygems/package"
+
+        parent_specs = cache.parser(parent_lockfile).specs.to_h { |spec| [spec.full_name, spec] }
+        definition.resolve.select do |spec|
+          next false unless spec.source.is_a?(Source::Rubygems)
+
+          store = spec.source.checksum_store
+          if (parent_spec = parent_specs[spec.full_name]) &&
+             parent_spec.source == spec.source &&
+             (checksums = parent_spec.source.checksum_store.checksums_to_lock(spec.full_name))
+            checksums.split(",").each do |checksum|
+              store.replace(spec, Checksum.from_lock(checksum, parent_lockfile.to_s))
+            end
+          end
+          next false unless store.missing?(spec) || store.empty?(spec)
 
-        add_newline = false unless gemfile[injection_point - 1] == "\n"
+          cached_gem = spec.source.cached_built_in_gem(spec, local: true)
+          store.register(spec, Checksum.from_gem_package(Gem::Package.new(cached_gem))) if cached_gem
+          store.missing?(spec) || store.empty?(spec)
+        end
+      end
 
-        gemfile.insert(injection_point, "\n") if add_newline
-        gemfile.insert(injection_point, preamble)
+      # Resolves with only local gems. Bundler warns that scoped sources don't
+      # implement a dependency API when they're restricted to local gems, but
+      # that's expected here; if this fails, we resolve remotely instead.
+      def resolve_locally(definition)
+        definition.define_singleton_method(:non_dependency_api_warning) { nil }
+        definition.resolve_with_cache!
+      ensure
+        definition.singleton_class.remove_method(:non_dependency_api_warning)
+      end
 
-        true
+      # @return [true, false] if running with `--local`, so nothing should be fetched
+      def local_only?
+        cli&.options&.[]("local") ? true : false
       end
 
       def write_lockfile(lockfile_definition,
@@ -477,6 +514,16 @@ module Bundler
         definition = builder.to_definition(lockfile, { bundler: unlocking_bundler })
         definition.instance_variable_set(:@dependency_changes, dependency_changes) if dependency_changes
 
+        # match the parent lockfile in whether there are checksums
+        unless Bundler.frozen_bundle?
+          parent_checksums = cache.parser(lockfile_definition[:parent]).checksums
+          if parent_checksums && !definition.locked_checksums
+            definition.add_checksums
+          elsif !parent_checksums && definition.locked_checksums
+            definition.instance_variable_set(:@locked_checksums, false)
+          end
+        end
+
         current_lockfile = lockfile_definition[:lockfile]
         definition.instance_variable_set(:@lockfile_contents, current_lockfile.read) if current_lockfile.exist?
 
@@ -499,7 +546,7 @@ module Bundler
             # if something has changed, we skip this step; it's unlocking anyway
             next unless current_definition.no_resolve_needed?
 
-            current_definition.resolve_with_cache!
+            resolve_locally(current_definition)
             if current_definition.missing_specs.any?
               cache.invalidate_checks(current_lockfile)
               Bundler.with_default_lockfile(current_lockfile) do
@@ -532,16 +579,28 @@ module Bundler
             # in the lockfile (that we know are there from a prior remote
             # resolution), and add them to the locally installed spec list.
             definition.send(:source_map).locked_specs.each do |spec|
-              next if spec.match_platform(Bundler.local_platform)
+              next if spec.installable_on_platform?(Bundler.local_platform)
 
               spec.source.specs << spec
             end
-            definition.resolve_with_cache!
+            resolve_locally(definition)
+            missing_checksums = fill_checksums(definition, lockfile_definition[:parent], cache)
+            # fetch checksums that aren't available locally
+            raise SolveFailure unless missing_checksums.empty? || local_only?
           rescue GemNotFound, SolveFailure
+            raise if local_only?
+
             definition = orig_definition
 
             definition.resolve_remotely!
             resolved_remotely = true
+            missing_checksums = fill_checksums(definition, lockfile_definition[:parent], cache)
+          end
+          if local_only? && !missing_checksums.empty?
+            raise GemNotFound,
+                  "Could not find checksums for #{missing_checksums.map(&:full_name).join(", ")} " \
+                  "(for #{lockfile_definition[:lockfile].relative_path_from(Dir.pwd)}) locally. " \
+                  "Run without `--local` to fetch them."
           end
           SharedHelpers.capture_filesystem_access do
             definition.instance_variable_set(:@resolved_bundler_version, unlocking_bundler) if unlocking_bundler
@@ -549,12 +608,9 @@ module Bundler
             # need to force it to _not_ preserve unknown sections, so that it
             # will overwrite the ruby version
             definition.instance_variable_set(:@unlocking_bundler, true)
-            if Bundler.gem_version >= Gem::Version.new("2.5.6")
-              definition.instance_variable_set(:@lockfile, lockfile_definition[:lockfile])
-              definition.lock
-            else
-              definition.lock(lockfile_definition[:lockfile])
-            end
+            # not `lockfile=`, which may substitute the lockfile from BUNDLE_LOCKFILE
+            definition.instance_variable_set(:@lockfile, lockfile_definition[:lockfile])
+            definition.lock
           end
         ensure
           Bundler.ui.level = previous_ui_level
@@ -579,11 +635,9 @@ module Bundler
   end
 end
 
-# see https://github.com/rubygems/rubygems/pull/7368
-Bundler::LazySpecification.include(Bundler::MatchMetadata) if defined?(Bundler::MatchMetadata)
-Bundler::Multilock.inject_preamble unless Bundler::Multilock.loaded?
+Bundler::Multilock::Preamble.inject unless Bundler::Multilock.loaded?
 
-if defined?(Bundler::CLI)
+if Bundler::Multilock.cli_loaded?
   require_relative "multilock/ext/cli"
 
   # this is terrible, but we can't prepend into these modules because we only load
@@ -605,7 +659,13 @@ if defined?(Bundler::CLI)
       next unless $!.nil?
       next if $!.is_a?(SystemExit) && !$!.success?
 
-      Bundler::Multilock.after_install_all(install: false)
+      begin
+        Bundler::Multilock.after_install_all(install: false)
+      rescue Bundler::BundlerError => e
+        # this is outside of Bundler's usual error handling
+        Bundler.ui.error(e.message)
+        exit e.status_code
+      end
     end
   end
 end

data/plugins.rb

@@ -20,6 +20,12 @@
 
 require_relative "lib/bundler/multilock"
 
+# Registering for this event makes Bundler load the plugin before it evaluates
+# the Gemfile, so `lockfile` is available without loading the plugin manually.
+Bundler::Plugin.add_hook(Bundler::Plugin::Events::GEM_BEFORE_EVAL) do |_gemfile, _lockfile|
+  # nothing to do; loading the plugin is all that's needed
+end
+
 Bundler::Plugin.add_hook(Bundler::Plugin::Events::GEM_AFTER_INSTALL_ALL) do |_|
   Bundler::Multilock.after_install_all
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bundler-multilock
 version: !ruby/object:Gem::Version
-  version: 1.4.0
+  version: 2.0.0.beta1
 platform: ruby
 authors:
 - Instructure
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-09 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,22 +15,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.4.19
+        version: 4.1.0.beta2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
+        version: '5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.4.19
+        version: 4.1.0.beta2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '2.7'
-description:
-email:
+        version: '5'
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -43,12 +40,12 @@ files:
 - lib/bundler/multilock/ext/cli.rb
 - lib/bundler/multilock/ext/definition.rb
 - lib/bundler/multilock/ext/dsl.rb
-- lib/bundler/multilock/ext/plugin.rb
 - lib/bundler/multilock/ext/plugin/dsl.rb
 - lib/bundler/multilock/ext/shared_helpers.rb
 - lib/bundler/multilock/ext/source.rb
 - lib/bundler/multilock/ext/source_list.rb
 - lib/bundler/multilock/lockfile_generator.rb
+- lib/bundler/multilock/preamble.rb
 - lib/bundler/multilock/ui/capture.rb
 - lib/bundler/multilock/version.rb
 - plugins.rb
@@ -57,7 +54,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -65,15 +61,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.8
-signing_key:
+rubygems_version: 4.0.22
 specification_version: 4
 summary: Support Multiple Lockfiles
 test_files: []

data/lib/bundler/multilock/ext/plugin.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module Bundler
-  module Multilock
-    module Ext
-      module PluginExt
-        module ClassMethods
-          ::Bundler::Plugin.singleton_class.prepend(self)
-
-          def load_plugin(name)
-            return if @loaded_plugin_names.include?(name)
-
-            super
-          end
-        end
-      end
-    end
-  end
-end