bundler 1.13.7 → 1.14.0.pre.1

data/lib/bundler/retry.rb

@@ -43,7 +43,10 @@ module Bundler
 
     def fail_attempt(e)
       @failed = true
-      raise e if last_attempt? || @exceptions.any? {|k| e.is_a?(k) }
+      if last_attempt? || @exceptions.any? {|k| e.is_a?(k) }
+        Bundler.ui.info "" unless Bundler.ui.debug?
+        raise e
+      end
       return true unless name
       Bundler.ui.info "" unless Bundler.ui.debug? # Add new line incase dots preceded this
       Bundler.ui.warn "Retrying #{name} due to error (#{current_run.next}/#{total_runs}): #{e.class} #{e.message}", Bundler.ui.debug?

data/lib/bundler/ruby_version.rb

@@ -128,6 +128,11 @@ module Bundler
       end
     end
 
+    def exact?
+      return @exact if defined?(@exact)
+      @exact = versions.all? {|v| Gem::Requirement.create(v).exact? }
+    end
+
   private
 
     def matches?(requirements, version)

data/lib/bundler/rubygems_ext.rb

@@ -169,6 +169,11 @@ module Gem
     def none?
       @none ||= (to_s == ">= 0")
     end unless allocate.respond_to?(:none?)
+
+    def exact?
+      return false unless @requirements.size == 1
+      @requirements[0][0] == "="
+    end unless allocate.respond_to?(:exact?)
   end
 
   class Platform

data/lib/bundler/rubygems_gem_installer.rb

@@ -12,5 +12,65 @@ module Bundler
     def check_executable_overwrite(filename)
       # Bundler needs to install gems regardless of binstub overwriting
     end
+
+    def pre_install_checks
+      super && validate_bundler_checksum(options[:bundler_expected_checksum])
+    end
+
+  private
+
+    def validate_bundler_checksum(checksum)
+      return true if Bundler.settings[:disable_checksum_validation]
+      return true unless checksum
+      return true unless source = @package.instance_variable_get(:@gem)
+      return true unless source.respond_to?(:with_read_io)
+      digest = source.with_read_io do |io|
+        digest = Digest::SHA256.new
+        digest << io.read(16_384) until io.eof?
+        io.rewind
+        send(checksum_type(checksum), digest)
+      end
+      unless digest == checksum
+        raise SecurityError, <<-MESSAGE
+          Bundler cannot continue installing #{spec.name} (#{spec.version}).
+          The checksum for the downloaded `#{spec.full_name}.gem` does not match \
+          the checksum given by the server. This means the contents of the downloaded \
+          gem is different from what was uploaded to the server, and could be a potential security issue.
+
+          To resolve this issue:
+          1. delete the downloaded gem located at: `#{spec.gem_dir}/#{spec.full_name}.gem`
+          2. run `bundle install`
+
+          If you wish to continue installing the downloaded gem, and are certain it does not pose a \
+          security issue despite the mismatching checksum, do the following:
+          1. run `bundle config disable.checksum_validation true` to turn off checksum verification
+          2. run `bundle install`
+
+          (More info: The expected SHA256 checksum was #{checksum.inspect}, but the \
+          checksum for the downloaded gem was #{digest.inspect}.)
+          MESSAGE
+      end
+      true
+    end
+
+    def checksum_type(checksum)
+      case checksum.length
+      when 64 then :hexdigest!
+      when 44 then :base64digest!
+      else raise InstallError, "The given checksum for #{spec.full_name} (#{checksum.inspect}) is not a valid SHA256 hexdigest nor base64digest"
+      end
+    end
+
+    def hexdigest!(digest)
+      digest.hexdigest!
+    end
+
+    def base64digest!(digest)
+      if digest.respond_to?(:base64digest!)
+        digest.base64digest!
+      else
+        [digest.digest!].pack("m0")
+      end
+    end
   end
 end

data/lib/bundler/rubygems_integration.rb

@@ -71,8 +71,13 @@ module Bundler
       spec.installed_by_version = Gem::Version.create(installed_by_version)
     end
 
-    def spec_missing_extensions?(spec)
-      !spec.respond_to?(:missing_extensions?) || spec.missing_extensions?
+    def spec_missing_extensions?(spec, default = true)
+      return spec.missing_extensions? if spec.respond_to?(:missing_extensions?)
+
+      return false if spec.respond_to?(:default_gem?) && spec.default_gem?
+      return false if spec.extensions.empty?
+
+      default
     end
 
     def path(obj)
@@ -80,6 +85,7 @@ module Bundler
     end
 
     def platforms
+      return [Gem::Platform::RUBY] if Bundler.settings[:force_ruby_platform]
       Gem.platforms
     end
 
@@ -194,6 +200,10 @@ module Bundler
       end
     end
 
+    def load_plugins
+      Gem.load_plugins if Gem.respond_to?(:load_plugins)
+    end
+
     def ui=(obj)
       Gem::DefaultUserInteraction.ui = obj
     end
@@ -243,6 +253,10 @@ module Bundler
       end
     end
 
+    def install_with_build_args(args)
+      with_build_args(args) { yield }
+    end
+
     def gem_from_path(path, policy = nil)
       require "rubygems/format"
       Gem::Format.from_file_by_path(path, policy)
@@ -710,6 +724,10 @@ module Bundler
       def repository_subdirectories
         Gem::REPOSITORY_SUBDIRECTORIES
       end
+
+      def install_with_build_args(args)
+        yield
+      end
     end
 
     # RubyGems 2.1.0
@@ -750,6 +768,14 @@ module Bundler
           end.map(&:to_spec)
         end
       end
+
+      def use_gemdeps(gemfile)
+        ENV["BUNDLE_GEMFILE"] ||= File.expand_path(gemfile)
+        runtime = Bundler.setup
+        Bundler.ui = nil
+        activated_spec_names = runtime.requested_specs.map(&:to_spec).sort_by(&:name)
+        [Gemdeps.new(runtime), activated_spec_names]
+      end
     end
   end
 

data/lib/bundler/runtime.rb

@@ -140,7 +140,8 @@ module Bundler
 
       Bundler.ui.info "Updating files in #{Bundler.settings.app_cache_path}"
 
-      specs.each do |spec|
+      specs_to_cache = Bundler.settings[:cache_all_platforms] ? @definition.resolve.materialized_for_all_platforms : specs
+      specs_to_cache.each do |spec|
         next if spec.name == "bundler"
         next if spec.source.is_a?(Source::Gemspec)
         spec.source.send(:fetch_gem, spec) if Bundler.settings[:cache_all_platforms] && spec.source.respond_to?(:fetch_gem, true)

data/lib/bundler/settings.rb

@@ -7,6 +7,7 @@ module Bundler
       allow_offline_install
       auto_install
       cache_all
+      disable_checksum_validation
       disable_exec_load
       disable_local_branch_check
       disable_shared_gems
@@ -17,6 +18,7 @@ module Bundler
       major_deprecations
       no_install
       no_prune
+      force_ruby_platform
       only_update_to_newer_versions
       plugins
       silence_root_warning
@@ -42,11 +44,18 @@ module Bundler
       @local_config    = load_config(local_config_file)
       @global_config   = load_config(global_config_file)
       @cli_flags_given = false
+      @temporary       = {}
     end
 
     def [](name)
       key = key_for(name)
-      value = (@local_config[key] || ENV[key] || @global_config[key] || DEFAULT_CONFIG[name])
+      value = @temporary.fetch(name) do
+              @local_config.fetch(key) do
+              ENV.fetch(key) do
+              @global_config.fetch(key) do
+              DEFAULT_CONFIG.fetch(name) do
+                nil
+              end end end end end
 
       if value.nil?
         nil
@@ -76,9 +85,19 @@ module Bundler
       local_config_file || raise(GemfileNotFound, "Could not locate Gemfile")
       set_key(key, value, @local_config, local_config_file)
     end
-
     alias_method :set_local, :[]=
 
+    def temporary(update)
+      existing = Hash[update.map {|k, _| [k, @temporary[k]] }]
+      @temporary.update(update)
+      return unless block_given?
+      begin
+        yield
+      ensure
+        existing.each {|k, v| v.nil? ? @temporary.delete(k) : @temporary[k] = v }
+      end
+    end
+
     def delete(key)
       @local_config.delete(key_for(key))
     end
@@ -221,7 +240,12 @@ module Bundler
     end
 
     def to_bool(value)
-      !(value.nil? || value == "" || value =~ /^(false|f|no|n|0)$/i || value == false)
+      case value
+      when nil, /\A(false|f|no|n|0|)\z/i, false
+        false
+      else
+        true
+      end
     end
 
     def is_num(value)
@@ -279,10 +303,10 @@ module Bundler
     }xo
 
     def load_config(config_file)
-      return {} unless config_file
+      return {} if !config_file || ignore_config?
       SharedHelpers.filesystem_access(config_file, :read) do |file|
         valid_file = file.exist? && !file.size.zero?
-        return {} if ignore_config? || !valid_file
+        return {} unless valid_file
         require "bundler/yaml_serializer"
         YAMLSerializer.load file.read
       end

data/lib/bundler/setup.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-require "bundler/postit_trampoline" unless ENV["BUNDLE_DISABLE_POSTIT"]
+require "bundler/postit_trampoline"
 require "bundler/shared_helpers"
 
 if Bundler::SharedHelpers.in_bundle?

data/lib/bundler/shared_helpers.rb

@@ -8,6 +8,7 @@ require "bundler/current_ruby"
 
 module Gem
   class Dependency
+    # This is only needed for RubyGems < 1.4
     unless method_defined? :requirement
       def requirement
         version_requirements
@@ -18,8 +19,6 @@ end
 
 module Bundler
   module SharedHelpers
-    attr_accessor :gem_loaded
-
     def default_gemfile
       gemfile = find_gemfile
       raise GemfileNotFound, "Could not locate Gemfile" unless gemfile
@@ -39,10 +38,12 @@ module Bundler
       bundle_dir = find_directory(".bundle")
       return nil unless bundle_dir
 
-      global_bundle_dir = File.join(Bundler.rubygems.user_home, ".bundle")
+      bundle_dir = Pathname.new(bundle_dir)
+
+      global_bundle_dir = Bundler.user_home.join(".bundle")
       return nil if bundle_dir == global_bundle_dir
 
-      Pathname.new(bundle_dir)
+      bundle_dir
     end
 
     def in_bundle?
@@ -109,8 +110,14 @@ module Bundler
       raise TemporaryResourceError.new(path, action)
     rescue Errno::EPROTO
       raise VirtualProtocolError.new
+    rescue Errno::ENOSPC
+      raise NoSpaceOnDeviceError.new(path, action)
     rescue *[const_get_safely(:ENOTSUP, Errno)].compact
       raise OperationNotSupportedError.new(path, action)
+    rescue Errno::EEXIST, Errno::ENOENT
+      raise
+    rescue SystemCallError => e
+      raise GenericSystemCallError.new(e, "There was an error accessing `#{path}`.")
     end
 
     def const_get_safely(constant_name, namespace)
@@ -202,29 +209,33 @@ module Bundler
 
     def set_rubylib
       rubylib = (ENV["RUBYLIB"] || "").split(File::PATH_SEPARATOR)
-      rubylib.unshift File.expand_path("../..", __FILE__)
+      rubylib.unshift bundler_ruby_lib
       ENV["RUBYLIB"] = rubylib.uniq.join(File::PATH_SEPARATOR)
     end
 
+    def bundler_ruby_lib
+      File.expand_path("../..", __FILE__)
+    end
+
     def clean_load_path
       # handle 1.9 where system gems are always on the load path
-      if defined?(::Gem)
-        me = File.expand_path("../../", __FILE__)
-        me = /^#{Regexp.escape(me)}/
+      return unless defined?(::Gem)
 
-        loaded_gem_paths = Bundler.rubygems.loaded_gem_paths
+      bundler_lib = bundler_ruby_lib
 
-        $LOAD_PATH.reject! do |p|
-          next if File.expand_path(p) =~ me
-          loaded_gem_paths.delete(p)
-        end
-        $LOAD_PATH.uniq!
+      loaded_gem_paths = Bundler.rubygems.loaded_gem_paths
+
+      $LOAD_PATH.reject! do |p|
+        next if File.expand_path(p).start_with?(bundler_lib)
+        loaded_gem_paths.delete(p)
       end
+      $LOAD_PATH.uniq!
     end
 
     def prints_major_deprecations?
       require "bundler"
-      return false unless Bundler.settings[:major_deprecations]
+      deprecation_release = Bundler::VERSION.split(".").drop(1).include?("99")
+      return false if !deprecation_release && !Bundler.settings[:major_deprecations]
       require "bundler/deprecate"
       return false if Bundler::Deprecate.skip
       true

data/lib/bundler/source.rb

@@ -14,6 +14,7 @@ module Bundler
 
     def version_message(spec)
       message = "#{spec.name} #{spec.version}"
+      message += " (#{spec.platform})" if spec.platform != Gem::Platform::RUBY && !spec.platform.nil?
 
       if Bundler.locked_gems
         locked_spec = Bundler.locked_gems.specs.find {|s| s.name == spec.name }
@@ -33,5 +34,9 @@ module Bundler
     def include?(other)
       other == self
     end
+
+    def inspect
+      "#<#{self.class}:0x#{object_id} #{self}>"
+    end
   end
 end

data/lib/bundler/source/git.rb

@@ -292,7 +292,7 @@ module Bundler
       def fetch
         git_proxy.checkout
       rescue GitError
-        raise unless Bundler.settings[:allow_offline_install]
+        raise unless Bundler.feature_flag.allow_offline_install?
         Bundler.ui.warn "Using cached git data because of network errors"
       end
     end

data/lib/bundler/source/git/git_proxy.rb

@@ -224,6 +224,11 @@ module Bundler
           raise GitError, "The git source #{uri} is not yet checked out. Please run `bundle install` before trying to start your application"
         end
 
+        # TODO: Replace this with Open3 when upgrading to bundler 2
+        # Similar to #git_null, as Open3 is not cross-platform,
+        # a temporary way is to use Tempfile to capture the stderr.
+        # When replacing this using Open3, make sure git_null is
+        # also replaced by Open3, so stdout and stderr all got handled properly.
         def capture_and_filter_stderr(uri)
           return_value, captured_err = ""
           backup_stderr = STDERR.dup

data/lib/bundler/source/path.rb

@@ -46,7 +46,7 @@ module Bundler
 
       def to_lock
         out = String.new("PATH\n")
-        out << "  remote: #{relative_path}\n"
+        out << "  remote: #{lockfile_path}\n"
         out << "  glob: #{@glob}\n" unless @glob == DEFAULT_GLOB
         out << "  specs:\n"
       end
@@ -129,6 +129,11 @@ module Bundler
           "`#{somepath}`.\nThe error message was: #{e.message}."
       end
 
+      def lockfile_path
+        return relative_path if path.absolute?
+        expand(path).relative_path_from(Bundler.root)
+      end
+
       def app_cache_path(custom_path = nil)
         @app_cache_path ||= Bundler.app_cache(custom_path).join(app_cache_dirname)
       end

data/lib/bundler/source/rubygems.rb

@@ -140,7 +140,9 @@ module Bundler
               :bin_dir             => bin_path.to_s,
               :ignore_dependencies => true,
               :wrappers            => true,
-              :env_shebang         => true
+              :env_shebang         => true,
+              :build_args          => opts[:build_args],
+              :bundler_expected_checksum => spec.respond_to?(:checksum) && spec.checksum
             ).install
           end
           spec.full_gem_path = installed_spec.full_gem_path
@@ -291,6 +293,10 @@ module Bundler
             next if spec.name == "bundler" && spec.version.to_s != VERSION
             have_bundler = true if spec.name == "bundler"
             spec.source = self
+            if Bundler.rubygems.spec_missing_extensions?(spec, false)
+              Bundler.ui.debug "Source #{self} is ignoring #{spec} because it is missing extensions"
+              next
+            end
             idx << spec
           end
 
@@ -321,6 +327,10 @@ module Bundler
             next if gemfile =~ /^bundler\-[\d\.]+?\.gem/
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
+            if Bundler.rubygems.spec_missing_extensions?(s, false)
+              Bundler.ui.debug "Source #{self} is ignoring #{s} because it is missing extensions"
+              next
+            end
             idx << s
           end
         end