bundler 1.11.1 → 2.2.6

data/lib/bundler/source/rubygems/remote.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Bundler
   class Source
     class Rubygems
@@ -14,7 +16,30 @@ module Bundler
           @anonymized_uri = remove_auth(@uri).freeze
         end
 
-      private
+        # @return [String] A slug suitable for use as a cache key for this
+        #         remote.
+        #
+        def cache_slug
+          @cache_slug ||= begin
+            return nil unless SharedHelpers.md5_available?
+
+            cache_uri = original_uri || uri
+
+            host = cache_uri.to_s.start_with?("file://") ? nil : cache_uri.host
+
+            uri_parts = [host, cache_uri.user, cache_uri.port, cache_uri.path]
+            uri_digest = SharedHelpers.digest(:MD5).hexdigest(uri_parts.compact.join("."))
+
+            uri_parts[-1] = uri_digest
+            uri_parts.compact.join(".")
+          end
+        end
+
+        def to_s
+          "rubygems remote at #{anonymized_uri}"
+        end
+
+        private
 
         def apply_auth(uri, auth)
           if auth && uri.userinfo.nil?
@@ -23,6 +48,10 @@ module Bundler
           end
 
           uri
+        rescue Bundler::URI::InvalidComponentError
+          error_message = "Please CGI escape your usernames and passwords before " \
+                          "setting them for authentication."
+          raise HTTPError.new(error_message)
         end
 
         def remove_auth(uri)

data/lib/bundler/source_list.rb

@@ -1,34 +1,66 @@
+# frozen_string_literal: true
+
+require "set"
+
 module Bundler
   class SourceList
     attr_reader :path_sources,
-      :git_sources
+      :git_sources,
+      :plugin_sources,
+      :global_rubygems_source,
+      :metadata_source
 
     def initialize
-      @path_sources       = []
-      @git_sources        = []
-      @rubygems_aggregate = Source::Rubygems.new
-      @rubygems_sources   = []
+      @path_sources           = []
+      @git_sources            = []
+      @plugin_sources         = []
+      @global_rubygems_source = nil
+      @rubygems_aggregate     = rubygems_aggregate_class.new
+      @rubygems_sources       = []
+      @metadata_source        = Source::Metadata.new
     end
 
     def add_path_source(options = {})
-      add_source_to_list Source::Path.new(options), path_sources
+      if options["gemspec"]
+        add_source_to_list Source::Gemspec.new(options), path_sources
+      else
+        add_source_to_list Source::Path.new(options), path_sources
+      end
     end
 
     def add_git_source(options = {})
-      add_source_to_list Source::Git.new(options), git_sources
+      add_source_to_list(Source::Git.new(options), git_sources).tap do |source|
+        warn_on_git_protocol(source)
+      end
     end
 
     def add_rubygems_source(options = {})
       add_source_to_list Source::Rubygems.new(options), @rubygems_sources
     end
 
+    def add_plugin_source(source, options = {})
+      add_source_to_list Plugin.source(source).new(options), @plugin_sources
+    end
+
+    def global_rubygems_source=(uri)
+      if Bundler.feature_flag.disable_multisource?
+        @global_rubygems_source ||= rubygems_aggregate_class.new("remotes" => uri)
+      end
+      add_rubygems_remote(uri)
+    end
+
     def add_rubygems_remote(uri)
+      return if Bundler.feature_flag.disable_multisource?
       @rubygems_aggregate.add_remote(uri)
       @rubygems_aggregate
     end
 
+    def default_source
+      global_rubygems_source || @rubygems_aggregate
+    end
+
     def rubygems_sources
-      @rubygems_sources + [@rubygems_aggregate]
+      @rubygems_sources + [default_source]
     end
 
     def rubygems_remotes
@@ -36,34 +68,40 @@ module Bundler
     end
 
     def all_sources
-      path_sources + git_sources + rubygems_sources
+      path_sources + git_sources + plugin_sources + rubygems_sources + [metadata_source]
     end
 
     def get(source)
-      source_list_for(source).find {|s| source == s }
+      source_list_for(source).find {|s| equal_source?(source, s) || equivalent_source?(source, s) }
     end
 
     def lock_sources
-      lock_sources = (path_sources + git_sources).sort_by(&:to_s)
-      lock_sources << combine_rubygems_sources
+      lock_sources = (path_sources + git_sources + plugin_sources).sort_by(&:to_s)
+      if Bundler.feature_flag.disable_multisource?
+        lock_sources + rubygems_sources.sort_by(&:to_s)
+      else
+        lock_sources << combine_rubygems_sources
+      end
     end
 
+    # Returns true if there are changes
     def replace_sources!(replacement_sources)
       return true if replacement_sources.empty?
 
-      [path_sources, git_sources].each do |source_list|
+      [path_sources, git_sources, plugin_sources].each do |source_list|
         source_list.map! do |source|
           replacement_sources.find {|s| s == source } || source
         end
       end
 
-      replacement_rubygems =
+      replacement_rubygems = !Bundler.feature_flag.disable_multisource? &&
         replacement_sources.detect {|s| s.is_a?(Source::Rubygems) }
       @rubygems_aggregate = replacement_rubygems if replacement_rubygems
 
-      # Return true if there were changes
-      lock_sources.to_set != replacement_sources.to_set ||
-        rubygems_remotes.to_set != replacement_rubygems.remotes.to_set
+      return true if !equal_sources?(lock_sources, replacement_sources) && !equivalent_sources?(lock_sources, replacement_sources)
+      return true if replacement_rubygems && rubygems_remotes.to_set != replacement_rubygems.remotes.to_set
+
+      false
     end
 
     def cached!
@@ -78,7 +116,11 @@ module Bundler
       @rubygems_aggregate.remotes
     end
 
-  private
+    private
+
+    def rubygems_aggregate_class
+      Source::Rubygems
+    end
 
     def add_source_to_list(source, list)
       list.unshift(source).uniq!
@@ -87,9 +129,10 @@ module Bundler
 
     def source_list_for(source)
       case source
-      when Source::Git      then git_sources
-      when Source::Path     then path_sources
-      when Source::Rubygems then rubygems_sources
+      when Source::Git          then git_sources
+      when Source::Path         then path_sources
+      when Source::Rubygems     then rubygems_sources
+      when Plugin::API::Source  then plugin_sources
       else raise ArgumentError, "Invalid source: #{source.inspect}"
       end
     end
@@ -97,5 +140,44 @@ module Bundler
     def combine_rubygems_sources
       Source::Rubygems.new("remotes" => rubygems_remotes)
     end
+
+    def warn_on_git_protocol(source)
+      return if Bundler.settings["git.allow_insecure"]
+
+      if source.uri =~ /^git\:/
+        Bundler.ui.warn "The git source `#{source.uri}` uses the `git` protocol, " \
+          "which transmits data without encryption. Disable this warning with " \
+          "`bundle config set --local git.allow_insecure true`, or switch to the `https` " \
+          "protocol to keep your data secure."
+      end
+    end
+
+    def equal_sources?(lock_sources, replacement_sources)
+      lock_sources.to_set == replacement_sources.to_set
+    end
+
+    def equal_source?(source, other_source)
+      source == other_source
+    end
+
+    def equivalent_source?(source, other_source)
+      return false unless Bundler.settings[:allow_deployment_source_credential_changes] && source.is_a?(Source::Rubygems)
+
+      equivalent_rubygems_sources?([source], [other_source])
+    end
+
+    def equivalent_sources?(lock_sources, replacement_sources)
+      return false unless Bundler.settings[:allow_deployment_source_credential_changes]
+
+      lock_rubygems_sources, lock_other_sources = lock_sources.partition {|s| s.is_a?(Source::Rubygems) }
+      replacement_rubygems_sources, replacement_other_sources = replacement_sources.partition {|s| s.is_a?(Source::Rubygems) }
+
+      equivalent_rubygems_sources?(lock_rubygems_sources, replacement_rubygems_sources) && equal_sources?(lock_other_sources, replacement_other_sources)
+    end
+
+    def equivalent_rubygems_sources?(lock_sources, replacement_sources)
+      actual_remotes = replacement_sources.map(&:remotes).flatten.uniq
+      lock_sources.all? {|s| s.equivalent_remotes?(actual_remotes) }
+    end
   end
 end

data/lib/bundler/spec_set.rb

@@ -1,48 +1,43 @@
+# frozen_string_literal: true
+
 require "tsort"
-require "forwardable"
+require "set"
 
 module Bundler
   class SpecSet
-    extend Forwardable
-    include TSort, Enumerable
-
-    def_delegators :@specs, :<<, :length, :add, :remove
-    def_delegators :sorted, :each
+    include Enumerable
+    include TSort
 
     def initialize(specs)
-      @specs = specs.sort_by(&:name)
+      @specs = specs
     end
 
-    def for(dependencies, skip = [], check = false, match_current_platform = false)
-      handled = {}
+    def for(dependencies, skip = [], check = false, match_current_platform = false, raise_on_missing = true)
+      handled = Set.new
       deps = dependencies.dup
       specs = []
-      skip << "bundler"
-
-      until deps.empty?
-        dep = deps.shift
-        next if handled[dep] || skip.include?(dep.name)
+      skip += ["bundler"]
 
-        spec = lookup[dep.name].find do |s|
-          if match_current_platform
-            Gem::Platform.match(s.platform)
-          else
-            s.match_platform(dep.__platform)
-          end
-        end
+      loop do
+        break unless dep = deps.shift
+        next if !handled.add?(dep) || skip.include?(dep.name)
 
-        handled[dep] = true
+        specs_for_dep = spec_for_dependency(dep, match_current_platform)
+        if specs_for_dep.any?
+          specs += specs_for_dep
 
-        if spec
-          specs << spec
-
-          spec.dependencies.each do |d|
+          specs_for_dep.first.dependencies.each do |d|
             next if d.type == :development
-            d = DepProxy.new(d, dep.__platform) unless match_current_platform
+            d = DepProxy.get_proxy(d, dep.__platform) unless match_current_platform
             deps << d
           end
         elsif check
           return false
+        elsif raise_on_missing
+          others = lookup[dep.name] if match_current_platform
+          message = "Unable to find a spec satisfying #{dep} in the set. Perhaps the lockfile is corrupted?"
+          message += " Found #{others.join(", ")} that did not match the current platform." if others && !others.empty?
+          raise GemNotFound, message
         end
       end
 
@@ -66,7 +61,6 @@ module Bundler
       @specs << value
       @lookup = nil
       @sorted = nil
-      value
     end
 
     def sort!
@@ -82,32 +76,80 @@ module Bundler
     end
 
     def materialize(deps, missing_specs = nil)
-      materialized = self.for(deps, [], false, true).to_a
+      materialized = self.for(deps, [], false, true, !missing_specs).to_a
       deps = materialized.map(&:name).uniq
       materialized.map! do |s|
         next s unless s.is_a?(LazySpecification)
         s.source.dependency_names = deps if s.source.respond_to?(:dependency_names=)
         spec = s.__materialize__
-        if missing_specs
-          missing_specs << s unless spec
-        else
-          raise GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
+        unless spec
+          unless missing_specs
+            raise GemNotFound, "Could not find #{s.full_name} in any of the sources"
+          end
+          missing_specs << s
         end
-        spec if spec
+        spec
+      end
+      SpecSet.new(missing_specs ? materialized.compact : materialized)
+    end
+
+    # Materialize for all the specs in the spec set, regardless of what platform they're for
+    # This is in contrast to how for does platform filtering (and specifically different from how `materialize` calls `for` only for the current platform)
+    # @return [Array<Gem::Specification>]
+    def materialized_for_all_platforms
+      names = @specs.map(&:name).uniq
+      @specs.map do |s|
+        next s unless s.is_a?(LazySpecification)
+        s.source.dependency_names = names if s.source.respond_to?(:dependency_names=)
+        s.source.remote!
+        spec = s.__materialize__
+        raise GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
+        spec
       end
-      SpecSet.new(materialized.compact)
     end
 
     def merge(set)
       arr = sorted.dup
-      set.each do |s|
-        next if arr.any? {|s2| s2.name == s.name && s2.version == s.version && s2.platform == s.platform }
-        arr << s
+      set.each do |set_spec|
+        full_name = set_spec.full_name
+        next if arr.any? {|spec| spec.full_name == full_name }
+        arr << set_spec
       end
       SpecSet.new(arr)
     end
 
-  private
+    def find_by_name_and_platform(name, platform)
+      @specs.detect {|spec| spec.name == name && spec.match_platform(platform) }
+    end
+
+    def what_required(spec)
+      unless req = find {|s| s.dependencies.any? {|d| d.type == :runtime && d.name == spec.name } }
+        return [spec]
+      end
+      what_required(req) << spec
+    end
+
+    def <<(spec)
+      @specs << spec
+    end
+
+    def length
+      @specs.length
+    end
+
+    def size
+      @specs.size
+    end
+
+    def empty?
+      @specs.empty?
+    end
+
+    def each(&b)
+      sorted.each(&b)
+    end
+
+    private
 
     def sorted
       rake = @specs.find {|s| s.name == "rake" }
@@ -116,26 +158,19 @@ module Bundler
       rescue TSort::Cyclic => error
         cgems = extract_circular_gems(error)
         raise CyclicDependencyError, "Your bundle requires gems that depend" \
-          " depend on each other, creating an infinite loop. Please remove" \
-          " either gem '#{cgems[1]}' or gem '#{cgems[0]}' and try again."
+          " on each other, creating an infinite loop. Please remove either" \
+          " gem '#{cgems[1]}' or gem '#{cgems[0]}' and try again."
       end
     end
 
     def extract_circular_gems(error)
-      if Bundler.current_ruby.mri? && Bundler.current_ruby.on_19?
-        error.message.scan(/(\w+) \([^)]/).flatten
-      else
-        error.message.scan(/@name="(.*?)"/).flatten
-      end
+      error.message.scan(/@name="(.*?)"/).flatten
     end
 
     def lookup
       @lookup ||= begin
         lookup = Hash.new {|h, k| h[k] = [] }
-        specs = @specs.sort_by do |s|
-          s.platform.to_s == "ruby" ? "\0" : s.platform.to_s
-        end
-        specs.reverse_each do |s|
+        Index.sort_specs(@specs).reverse_each do |s|
           lookup[s.name] << s
         end
         lookup
@@ -143,7 +178,17 @@ module Bundler
     end
 
     def tsort_each_node
-      @specs.each {|s| yield s }
+      # MUST sort by name for backwards compatibility
+      @specs.sort_by(&:name).each {|s| yield s }
+    end
+
+    def spec_for_dependency(dep, match_current_platform)
+      specs_for_platforms = lookup[dep.name]
+      if match_current_platform
+        GemHelpers.select_best_platform_match(specs_for_platforms, Bundler.local_platform)
+      else
+        GemHelpers.select_best_platform_match(specs_for_platforms, dep.__platform)
+      end
     end
 
     def tsort_each_child(s)