bundler 2.1.4 → 2.2.33

data/lib/bundler/resolver.rb

@@ -5,6 +5,8 @@ module Bundler
     require_relative "vendored_molinillo"
     require_relative "resolver/spec_group"
 
+    include GemHelpers
+
     # Figures out the best possible configuration of gems that satisfies
     # the list of passed dependencies and any child dependencies without
     # causing any gem activation errors.
@@ -15,16 +17,14 @@ module Bundler
     # ==== Returns
     # <GemBundle>,nil:: If the list of dependencies can be resolved, a
     #   collection of gemspecs is returned. Otherwise, nil is returned.
-    def self.resolve(requirements, index, source_requirements = {}, base = [], gem_version_promoter = GemVersionPromoter.new, additional_base_requirements = [], platforms = nil)
-      platforms = Set.new(platforms) if platforms
+    def self.resolve(requirements, source_requirements = {}, base = [], gem_version_promoter = GemVersionPromoter.new, additional_base_requirements = [], platforms = nil)
       base = SpecSet.new(base) unless base.is_a?(SpecSet)
-      resolver = new(index, source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
+      resolver = new(source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
       result = resolver.start(requirements)
-      SpecSet.new(result)
+      SpecSet.new(SpecSet.new(result).for(requirements.reject{|dep| dep.name.end_with?("\0") }))
     end
 
-    def initialize(index, source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
-      @index = index
+    def initialize(source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
       @source_requirements = source_requirements
       @base = base
       @resolver = Molinillo::Resolver.new(self, self)
@@ -32,14 +32,13 @@ module Bundler
       @base_dg = Molinillo::DependencyGraph.new
       @base.each do |ls|
         dep = Dependency.new(ls.name, ls.version)
-        @base_dg.add_vertex(ls.name, DepProxy.new(dep, ls.platform), true)
+        @base_dg.add_vertex(ls.name, DepProxy.get_proxy(dep, ls.platform), true)
       end
       additional_base_requirements.each {|d| @base_dg.add_vertex(d.name, d) }
-      @platforms = platforms
+      @platforms = platforms.reject {|p| p != Gem::Platform::RUBY && (platforms - [p]).any? {|pl| generic(pl) == p } }
+      @resolving_only_for_ruby = platforms == [Gem::Platform::RUBY]
       @gem_version_promoter = gem_version_promoter
-      @allow_bundler_dependency_conflicts = Bundler.feature_flag.allow_bundler_dependency_conflicts?
       @use_gvp = Bundler.feature_flag.use_gem_version_promoter_for_major_updates? || !@gem_version_promoter.major?
-      @lockfile_uses_separate_rubygems_sources = Bundler.feature_flag.disable_multisource?
     end
 
     def start(requirements)
@@ -49,7 +48,6 @@ module Bundler
       verify_gemfile_dependencies_are_found!(requirements)
       dg = @resolver.resolve(requirements, @base_dg)
       dg.
-        tap {|resolved| validate_resolved_specs!(resolved) }.
         map(&:payload).
         reject {|sg| sg.name.end_with?("\0") }.
         map(&:to_specs).
@@ -75,12 +73,17 @@ module Bundler
       return unless debug?
       debug_info = yield
       debug_info = debug_info.inspect unless debug_info.is_a?(String)
-      warn debug_info.split("\n").map {|s| "  " * depth + s }
+      puts debug_info.split("\n").map {|s| depth == 0 ? "BUNDLER: #{s}" : "BUNDLER(#{depth}): #{s}" }
     end
 
     def debug?
       return @debug_mode if defined?(@debug_mode)
-      @debug_mode = ENV["DEBUG_RESOLVER"] || ENV["DEBUG_RESOLVER_TREE"] || false
+      @debug_mode =
+        ENV["BUNDLER_DEBUG_RESOLVER"] ||
+        ENV["BUNDLER_DEBUG_RESOLVER_TREE"] ||
+        ENV["DEBUG_RESOLVER"] ||
+        ENV["DEBUG_RESOLVER_TREE"] ||
+        false
     end
 
     def before_resolution
@@ -101,18 +104,18 @@ module Bundler
       specification.dependencies_for_activated_platforms
     end
 
-    def search_for(dependency)
-      platform = dependency.__platform
-      dependency = dependency.dep unless dependency.is_a? Gem::Dependency
-      search = @search_for[dependency] ||= begin
-        index = index_for(dependency)
-        results = index.search(dependency, @base[dependency.name])
+    def search_for(dependency_proxy)
+      platform = dependency_proxy.__platform
+      dependency = dependency_proxy.dep
+      name = dependency.name
+      @search_for[dependency_proxy] ||= begin
+        results = results_for(dependency, @base[name])
 
-        if vertex = @base_dg.vertex_named(dependency.name)
+        if vertex = @base_dg.vertex_named(name)
           locked_requirement = vertex.payload.requirement
         end
 
-        if !@prerelease_specified[dependency.name] && (!@use_gvp || locked_requirement.nil?)
+        if !@prerelease_specified[name] && (!@use_gvp || locked_requirement.nil?)
           # Move prereleases to the beginning of the list, so they're considered
           # last during resolution.
           pre, results = results.partition {|spec| spec.version.prerelease? }
@@ -131,9 +134,20 @@ module Bundler
           end
           nested.reduce([]) do |groups, (version, specs)|
             next groups if locked_requirement && !locked_requirement.satisfied_by?(version)
-            spec_group = SpecGroup.new(specs)
-            spec_group.ignores_bundler_dependencies = @allow_bundler_dependency_conflicts
-            groups << spec_group
+
+            specs_by_platform = Hash.new do |current_specs, current_platform|
+              current_specs[current_platform] = select_best_platform_match(specs, current_platform)
+            end
+
+            spec_group_ruby = SpecGroup.create_for(specs_by_platform, [Gem::Platform::RUBY], Gem::Platform::RUBY)
+            groups << spec_group_ruby if spec_group_ruby
+
+            next groups if @resolving_only_for_ruby
+
+            spec_group = SpecGroup.create_for(specs_by_platform, @platforms, platform)
+            groups << spec_group if spec_group
+
+            groups
           end
         else
           []
@@ -146,24 +160,18 @@ module Bundler
           @gem_version_promoter.sort_versions(dependency, spec_groups)
         end
       end
-      search.select {|sg| sg.for?(platform) }.each {|sg| sg.activate_platform!(platform) }
     end
 
     def index_for(dependency)
-      source = @source_requirements[dependency.name]
-      if source
-        source.specs
-      elsif @lockfile_uses_separate_rubygems_sources
-        Index.build do |idx|
-          if dependency.all_sources
-            dependency.all_sources.each {|s| idx.add_source(s.specs) if s }
-          else
-            idx.add_source @source_requirements[:default].specs
-          end
-        end
-      else
-        @index
-      end
+      source_for(dependency.name).specs
+    end
+
+    def source_for(name)
+      @source_requirements[name] || @source_requirements[:default]
+    end
+
+    def results_for(dependency, base)
+      index_for(dependency).search(dependency, base)
     end
 
     def name_for(dependency)
@@ -183,24 +191,15 @@ module Bundler
     end
 
     def requirement_satisfied_by?(requirement, activated, spec)
-      return false unless requirement.matches_spec?(spec) || spec.source.is_a?(Source::Gemspec)
-      spec.activate_platform!(requirement.__platform) if !@platforms || @platforms.include?(requirement.__platform)
-      true
+      requirement.matches_spec?(spec) || spec.source.is_a?(Source::Gemspec)
     end
 
-    def relevant_sources_for_vertex(vertex)
-      if vertex.root?
-        [@source_requirements[vertex.name]]
-      elsif @lockfile_uses_separate_rubygems_sources
-        vertex.recursive_predecessors.map do |v|
-          @source_requirements[v.name]
-        end << @source_requirements[:default]
-      end
+    def dependencies_equal?(dependencies, other_dependencies)
+      dependencies.map(&:dep) == other_dependencies.map(&:dep)
     end
 
     def sort_dependencies(dependencies, activated, conflicts)
       dependencies.sort_by do |dependency|
-        dependency.all_sources = relevant_sources_for_vertex(activated.vertex_named(dependency.name))
         name = name_for(dependency)
         vertex = activated.vertex_named(name)
         [
@@ -215,19 +214,13 @@ module Bundler
       end
     end
 
-    # Sort platforms from most general to most specific
-    def self.sort_platforms(platforms)
-      platforms.sort_by do |platform|
-        platform_sort_key(platform)
-      end
-    end
-
     def self.platform_sort_key(platform)
-      return ["", "", ""] if Gem::Platform::RUBY == platform
-      platform.to_a.map {|part| part || "" }
+      # Prefer specific platform to not specific platform
+      return ["99-LAST", "", "", ""] if Gem::Platform::RUBY == platform
+      ["00", *platform.to_a.map {|part| part || "" }]
     end
 
-  private
+    private
 
     # returns an integer \in (-\infty, 0]
     # a number closer to 0 means the dependency is less constraining
@@ -260,12 +253,6 @@ module Bundler
         next if name == "bundler"
         next unless search_for(requirement).empty?
 
-        cache_message = begin
-                            " or in gems cached in #{Bundler.settings.app_cache_path}" if Bundler.app_cache.exist?
-                          rescue GemfileNotFound
-                            nil
-                          end
-
         if (base = @base[name]) && !base.empty?
           version = base.first.version
           message = "You have requested:\n" \
@@ -274,18 +261,17 @@ module Bundler
             "Try running `bundle update #{name}`\n\n" \
             "If you are updating multiple gems in your Gemfile at once,\n" \
             "try passing them all to `bundle update`"
-        elsif source = @source_requirements[name]
-          specs = source.specs[name]
+        else
+          source = source_for(name)
+          specs = source.specs.search(name)
           versions_with_platforms = specs.map {|s| [s.version, s.platform] }
+          cache_message = begin
+                              " or in gems cached in #{Bundler.settings.app_cache_path}" if Bundler.app_cache.exist?
+                            rescue GemfileNotFound
+                              nil
+                            end
           message = String.new("Could not find gem '#{SharedHelpers.pretty_dependency(requirement)}' in #{source}#{cache_message}.\n")
-          message << if versions_with_platforms.any?
-            "The source contains '#{name}' at: #{formatted_versions_with_platforms(versions_with_platforms)}"
-          else
-            "The source does not contain any versions of '#{name}'"
-          end
-        else
-          message = "Could not find gem '#{requirement}' in any of the gem sources " \
-            "listed in your Gemfile#{cache_message}."
+          message << "The source contains the following versions of '#{name}': #{formatted_versions_with_platforms(versions_with_platforms)}" if versions_with_platforms.any?
         end
         raise GemNotFound, message
       end
@@ -305,10 +291,16 @@ module Bundler
     def version_conflict_message(e)
       # only show essential conflicts, if possible
       conflicts = e.conflicts.dup
-      conflicts.delete_if do |_name, conflict|
-        deps = conflict.requirement_trees.map(&:last).flatten(1)
-        !Bundler::VersionRanges.empty?(*Bundler::VersionRanges.for_many(deps.map(&:requirement)))
+
+      if conflicts["bundler"]
+        conflicts.replace("bundler" => conflicts["bundler"])
+      else
+        conflicts.delete_if do |_name, conflict|
+          deps = conflict.requirement_trees.map(&:last).flatten(1)
+          !Bundler::VersionRanges.empty?(*Bundler::VersionRanges.for_many(deps.map(&:requirement)))
+        end
       end
+
       e = Molinillo::VersionConflict.new(conflicts, e.specification_provider) unless conflicts.empty?
 
       solver_name = "Bundler"
@@ -336,32 +328,32 @@ module Bundler
         :additional_message_for_conflict => lambda do |o, name, conflict|
           if name == "bundler"
             o << %(\n  Current Bundler version:\n    bundler (#{Bundler::VERSION}))
-            other_bundler_required = !conflict.requirement.requirement.satisfied_by?(Gem::Version.new(Bundler::VERSION))
-          end
 
-          if name == "bundler" && other_bundler_required
-            o << "\n"
-            o << "This Gemfile requires a different version of Bundler.\n"
-            o << "Perhaps you need to update Bundler by running `gem install bundler`?\n"
-          end
-          if conflict.locked_requirement
+            conflict_dependency = conflict.requirement
+            conflict_requirement = conflict_dependency.requirement
+            other_bundler_required = !conflict_requirement.satisfied_by?(Gem::Version.new(Bundler::VERSION))
+
+            if other_bundler_required
+              o << "\n\n"
+
+              candidate_specs = source_for(:default_bundler).specs.search(conflict_dependency)
+              if candidate_specs.any?
+                target_version = candidate_specs.last.version
+                new_command = [File.basename($PROGRAM_NAME), "_#{target_version}_", *ARGV].join(" ")
+                o << "Your bundle requires a different version of Bundler than the one you're running.\n"
+                o << "Install the necessary version with `gem install bundler:#{target_version}` and rerun bundler using `#{new_command}`\n"
+              else
+                o << "Your bundle requires a different version of Bundler than the one you're running, and that version could not be found.\n"
+              end
+            end
+          elsif conflict.locked_requirement
             o << "\n"
             o << %(Running `bundle update` will rebuild your snapshot from scratch, using only\n)
             o << %(the gems in your Gemfile, which may resolve the conflict.\n)
           elsif !conflict.existing
             o << "\n"
 
-            relevant_sources = if conflict.requirement.source
-              [conflict.requirement.source]
-            elsif conflict.requirement.all_sources
-              conflict.requirement.all_sources
-            elsif @lockfile_uses_separate_rubygems_sources
-              # every conflict should have an explicit group of sources when we
-              # enforce strict pinning
-              raise "no source set for #{conflict}"
-            else
-              []
-            end.compact.map(&:to_s).uniq.sort
+            relevant_source = conflict.requirement.source || source_for(name)
 
             metadata_requirement = name.end_with?("\0")
 
@@ -374,12 +366,10 @@ module Bundler
             end
             o << " "
 
-            o << if relevant_sources.empty?
-              "in any of the sources.\n"
-            elsif metadata_requirement
-              "is not available in #{relevant_sources.join(" or ")}"
+            o << if metadata_requirement
+              "is not available in #{relevant_source}"
             else
-              "in any of the relevant sources:\n  #{relevant_sources * "\n  "}\n"
+              "in #{relevant_source}.\n"
             end
           end
         end,
@@ -393,29 +383,5 @@ module Bundler
         end
       )
     end
-
-    def validate_resolved_specs!(resolved_specs)
-      resolved_specs.each do |v|
-        name = v.name
-        next unless sources = relevant_sources_for_vertex(v)
-        sources.compact!
-        if default_index = sources.index(@source_requirements[:default])
-          sources.delete_at(default_index)
-        end
-        sources.reject! {|s| s.specs[name].empty? }
-        sources.uniq!
-        next if sources.size <= 1
-
-        multisource_disabled = Bundler.feature_flag.disable_multisource?
-
-        msg = ["The gem '#{name}' was found in multiple relevant sources."]
-        msg.concat sources.map {|s| "  * #{s}" }.sort
-        msg << "You #{multisource_disabled ? :must : :should} add this gem to the source block for the source you wish it to be installed from."
-        msg = msg.join("\n")
-
-        raise SecurityError, msg if multisource_disabled
-        Bundler.ui.warn "Warning: #{msg}"
-      end
-    end
   end
 end

data/lib/bundler/retry.rb

@@ -32,7 +32,7 @@ module Bundler
     end
     alias_method :attempts, :attempt
 
-  private
+    private
 
     def run(&block)
       @failed = false
@@ -49,7 +49,7 @@ module Bundler
         raise e
       end
       return true unless name
-      Bundler.ui.info "" unless Bundler.ui.debug? # Add new line incase dots preceded this
+      Bundler.ui.info "" unless Bundler.ui.debug? # Add new line in case dots preceded this
       Bundler.ui.warn "Retrying #{name} due to error (#{current_run.next}/#{total_runs}): #{e.class} #{e.message}", Bundler.ui.debug?
     end
 

data/lib/bundler/ruby_version.rb

@@ -123,7 +123,7 @@ module Bundler
       @exact = versions.all? {|v| Gem::Requirement.create(v).exact? }
     end
 
-  private
+    private
 
     def matches?(requirements, version)
       # Handles RUBY_PATCHLEVEL of -1 for instances like ruby-head

data/lib/bundler/rubygems_ext.rb

@@ -47,14 +47,13 @@ module Gem
       full_require_paths
     end
 
-    if method_defined?(:extension_dir)
-      alias_method :rg_extension_dir, :extension_dir
-      def extension_dir
-        @bundler_extension_dir ||= if source.respond_to?(:extension_dir_name)
-          File.expand_path(File.join(extensions_dir, source.extension_dir_name))
-        else
-          rg_extension_dir
-        end
+    alias_method :rg_extension_dir, :extension_dir
+    def extension_dir
+      @bundler_extension_dir ||= if source.respond_to?(:extension_dir_name)
+        unique_extension_dir = [source.extension_dir_name, File.basename(full_gem_path)].uniq.join("-")
+        File.expand_path(File.join(extensions_dir, unique_extension_dir))
+      else
+        rg_extension_dir
       end
     end
 
@@ -86,7 +85,11 @@ module Gem
       dependencies - development_dependencies
     end
 
-  private
+    def deleted_gem?
+      !default_gem? && !File.directory?(full_gem_path)
+    end
+
+    private
 
     def dependencies_to_gemfile(dependencies, group = nil)
       gemfile = String.new
@@ -106,7 +109,7 @@ module Gem
   end
 
   class Dependency
-    attr_accessor :source, :groups, :all_sources
+    attr_accessor :source, :groups
 
     alias_method :eql?, :==
 
@@ -117,7 +120,7 @@ module Gem
     end
 
     def to_yaml_properties
-      instance_variables.reject {|p| ["@source", "@groups", "@all_sources"].include?(p.to_s) }
+      instance_variables.reject {|p| ["@source", "@groups"].include?(p.to_s) }
     end
 
     def to_lock
@@ -130,20 +133,97 @@ module Gem
     end
   end
 
+  # comparison is done order independently since rubygems 3.2.0.rc.2
+  unless Gem::Requirement.new("> 1", "< 2") == Gem::Requirement.new("< 2", "> 1")
+    class Requirement
+      module OrderIndependentComparison
+        def ==(other)
+          if _requirements_sorted? && other._requirements_sorted?
+            super
+          else
+            _with_sorted_requirements == other._with_sorted_requirements
+          end
+        end
+
+        protected
+
+        def _requirements_sorted?
+          return @_are_requirements_sorted if defined?(@_are_requirements_sorted)
+          strings = as_list
+          @_are_requirements_sorted = strings == strings.sort
+        end
+
+        def _with_sorted_requirements
+          @_with_sorted_requirements ||= _requirements_sorted? ? self : self.class.new(as_list.sort)
+        end
+      end
+
+      prepend OrderIndependentComparison
+    end
+  end
+
+  if Gem::Requirement.new("~> 2.0").hash == Gem::Requirement.new("~> 2.0.0").hash
+    class Requirement
+      module CorrectHashForLambdaOperator
+        def hash
+          if requirements.any? {|r| r.first == "~>" }
+            requirements.map {|r| r.first == "~>" ? [r[0], r[1].to_s] : r }.sort.hash
+          else
+            super
+          end
+        end
+      end
+
+      prepend CorrectHashForLambdaOperator
+    end
+  end
+
+  require "rubygems/platform"
+
   class Platform
     JAVA  = Gem::Platform.new("java") unless defined?(JAVA)
     MSWIN = Gem::Platform.new("mswin32") unless defined?(MSWIN)
     MSWIN64 = Gem::Platform.new("mswin64") unless defined?(MSWIN64)
     MINGW = Gem::Platform.new("x86-mingw32") unless defined?(MINGW)
     X64_MINGW = Gem::Platform.new("x64-mingw32") unless defined?(X64_MINGW)
+  end
+
+  Platform.singleton_class.module_eval do
+    unless Platform.singleton_methods.include?(:match_spec?)
+      def match_spec?(spec)
+        match_gem?(spec.platform, spec.name)
+      end
+
+      def match_gem?(platform, gem_name)
+        match_platforms?(platform, Gem.platforms)
+      end
 
-    undef_method :hash if method_defined? :hash
-    def hash
-      @cpu.hash ^ @os.hash ^ @version.hash
+      private
+
+      def match_platforms?(platform, platforms)
+        platforms.any? do |local_platform|
+          platform.nil? ||
+            local_platform == platform ||
+            (local_platform != Gem::Platform::RUBY && local_platform =~ platform)
+        end
+      end
     end
+  end
 
-    undef_method :eql? if method_defined? :eql?
-    alias_method :eql?, :==
+  require "rubygems/util"
+
+  Util.singleton_class.module_eval do
+    if Util.singleton_methods.include?(:glob_files_in_dir) # since 3.0.0.beta.2
+      remove_method :glob_files_in_dir
+    end
+
+    def glob_files_in_dir(glob, base_path)
+      if RUBY_VERSION >= "2.5"
+        Dir.glob(glob, :base => base_path).map! {|f| File.expand_path(f, base_path) }
+      else
+        Dir.glob(File.join(base_path.to_s.gsub(/[\[\]]/, '\\\\\\&'), glob)).map! {|f| File.expand_path(f) }
+      end
+    end
   end
 end
 

data/lib/bundler/rubygems_gem_installer.rb

@@ -4,14 +4,60 @@ require "rubygems/installer"
 
 module Bundler
   class RubyGemsGemInstaller < Gem::Installer
-    unless respond_to?(:at)
-      def self.at(*args)
-        new(*args)
+    def check_executable_overwrite(filename)
+      # Bundler needs to install gems regardless of binstub overwriting
+    end
+
+    def install
+      pre_install_checks
+
+      run_pre_install_hooks
+
+      spec.loaded_from = spec_file
+
+      # Completely remove any previous gem files
+      strict_rm_rf gem_dir
+      strict_rm_rf spec.extension_dir
+
+      SharedHelpers.filesystem_access(gem_dir, :create) do
+        FileUtils.mkdir_p gem_dir, :mode => 0o755
+      end
+
+      extract_files
+
+      build_extensions
+      write_build_info_file
+      run_post_build_hooks
+
+      generate_bin
+      generate_plugins
+
+      write_spec
+
+      SharedHelpers.filesystem_access("#{gem_home}/cache", :write) do
+        write_cache_file
       end
+
+      say spec.post_install_message unless spec.post_install_message.nil?
+
+      run_post_install_hooks
+
+      spec
     end
 
-    def check_executable_overwrite(filename)
-      # Bundler needs to install gems regardless of binstub overwriting
+    def generate_plugins
+      return unless Gem::Installer.instance_methods(false).include?(:generate_plugins)
+
+      latest = Gem::Specification.stubs_for(spec.name).first
+      return if latest && latest.version > spec.version
+
+      ensure_writable_dir @plugins_dir
+
+      if spec.plugins.empty?
+        remove_plugins_for(spec, @plugins_dir)
+      else
+        regenerate_plugins_for(spec, @plugins_dir)
+      end
     end
 
     def pre_install_checks
@@ -20,7 +66,10 @@ module Bundler
 
     def build_extensions
       extension_cache_path = options[:bundler_extension_cache_path]
-      return super unless extension_cache_path && extension_dir = Bundler.rubygems.spec_extension_dir(spec)
+      unless extension_cache_path && extension_dir = spec.extension_dir
+        require "shellwords" # compensate missing require in rubygems before version 3.2.25
+        return super
+      end
 
       extension_dir = Pathname.new(extension_dir)
       build_complete = SharedHelpers.filesystem_access(extension_cache_path.join("gem.build_complete"), :read, &:file?)
@@ -30,6 +79,7 @@ module Bundler
           FileUtils.cp_r extension_cache_path, spec.extension_dir
         end
       else
+        require "shellwords" # compensate missing require in rubygems before version 3.2.25
         super
         if extension_dir.directory? # not made for gems without extensions
           SharedHelpers.filesystem_access(extension_cache_path.parent, &:mkpath)
@@ -40,7 +90,18 @@ module Bundler
       end
     end
 
-  private
+    private
+
+    def strict_rm_rf(dir)
+      # FileUtils.rm_rf should probably rise in case of permission issues like
+      # `rm -rf` does. However, it fails to delete the folder silently due to
+      # https://github.com/ruby/fileutils/issues/57. It should probably be fixed
+      # inside `fileutils` but for now I`m checking whether the folder was
+      # removed after it completes, and raising otherwise.
+      FileUtils.rm_rf dir
+
+      raise PermissionError.new(dir, :delete) if File.directory?(dir)
+    end
 
     def validate_bundler_checksum(checksum)
       return true if Bundler.settings[:disable_checksum_validation]
@@ -66,7 +127,7 @@ module Bundler
 
           If you wish to continue installing the downloaded gem, and are certain it does not pose a \
           security issue despite the mismatching checksum, do the following:
-          1. run `bundle config set disable_checksum_validation true` to turn off checksum verification
+          1. run `bundle config set --local disable_checksum_validation true` to turn off checksum verification
           2. run `bundle install`
 
           (More info: The expected SHA256 checksum was #{checksum.inspect}, but the \