bundler 2.2.29 → 2.5.16

data/lib/bundler/lazy_specification.rb

@@ -1,55 +1,88 @@
 # frozen_string_literal: true
 
-require_relative "match_platform"
+require_relative "force_platform"
 
 module Bundler
   class LazySpecification
+    include MatchMetadata
     include MatchPlatform
+    include ForcePlatform
 
-    attr_reader :name, :version, :dependencies, :platform
-    attr_accessor :source, :remote
+    attr_reader :name, :version, :platform
+    attr_accessor :source, :remote, :force_ruby_platform, :dependencies, :required_ruby_version, :required_rubygems_version
+
+    alias_method :runtime_dependencies, :dependencies
+
+    def self.from_spec(s)
+      lazy_spec = new(s.name, s.version, s.platform, s.source)
+      lazy_spec.dependencies = s.dependencies
+      lazy_spec.required_ruby_version = s.required_ruby_version
+      lazy_spec.required_rubygems_version = s.required_rubygems_version
+      lazy_spec
+    end
 
     def initialize(name, version, platform, source = nil)
       @name          = name
       @version       = version
       @dependencies  = []
+      @required_ruby_version = Gem::Requirement.default
+      @required_rubygems_version = Gem::Requirement.default
       @platform      = platform || Gem::Platform::RUBY
       @source        = source
-      @specification = nil
+      @force_ruby_platform = default_force_ruby_platform
     end
 
     def full_name
-      if platform == Gem::Platform::RUBY || platform.nil?
+      @full_name ||= if platform == Gem::Platform::RUBY
         "#{@name}-#{@version}"
       else
         "#{@name}-#{@version}-#{platform}"
       end
     end
 
+    def lock_name
+      @lock_name ||= name_tuple.lock_name
+    end
+
+    def name_tuple
+      Gem::NameTuple.new(@name, @version, @platform)
+    end
+
     def ==(other)
-      identifier == other.identifier
+      full_name == other.full_name
     end
 
     def eql?(other)
-      identifier.eql?(other.identifier)
+      full_name.eql?(other.full_name)
     end
 
     def hash
-      identifier.hash
+      full_name.hash
     end
 
+    ##
+    # Does this locked specification satisfy +dependency+?
+    #
+    # NOTE: Rubygems default requirement is ">= 0", which doesn't match
+    # prereleases of 0 versions, like "0.0.0.dev" or "0.0.0.SNAPSHOT". However,
+    # bundler users expect those to work. We need to make sure that Gemfile
+    # dependencies without explicit requirements (which use ">= 0" under the
+    # hood by default) are still valid for locked specs using this kind of
+    # versions. The method implements an ad-hoc fix for that. A better solution
+    # might be to change default rubygems requirement of dependencies to be ">=
+    # 0.A" but that's a major refactoring likely to break things. Hopefully we
+    # can attempt it in the future.
+    #
+
     def satisfies?(dependency)
-      @name == dependency.name && dependency.requirement.satisfied_by?(Gem::Version.new(@version))
+      effective_requirement = dependency.requirement == Gem::Requirement.default ? Gem::Requirement.new(">= 0.A") : dependency.requirement
+
+      @name == dependency.name && effective_requirement.satisfied_by?(Gem::Version.new(@version))
     end
 
     def to_lock
       out = String.new
-
-      if platform == Gem::Platform::RUBY || platform.nil?
-        out << "    #{name} (#{version})\n"
-      else
-        out << "    #{name} (#{version}-#{platform})\n"
-      end
+      out << "    #{lock_name}\n"
 
       dependencies.sort_by(&:to_s).uniq.each do |dep|
         next if dep.type == :development
@@ -59,45 +92,51 @@ module Bundler
       out
     end
 
-    def __materialize__
-      @specification = if source.is_a?(Source::Gemspec) && source.gemspec.name == name
-        source.gemspec.tap {|s| s.source = source }
+    def materialize_for_installation
+      source.local!
+
+      matching_specs = source.specs.search(use_exact_resolved_specifications? ? self : [name, version])
+      return self if matching_specs.empty?
+
+      candidates = if use_exact_resolved_specifications?
+        matching_specs
       else
-        search_object = if source.is_a?(Source::Path)
-          Dependency.new(name, version)
-        else
-          ruby_platform_materializes_to_ruby_platform? ? self : Dependency.new(name, version)
-        end
-        platform_object = Gem::Platform.new(platform)
-        candidates = source.specs.search(search_object)
-        same_platform_candidates = candidates.select do |spec|
-          MatchPlatform.platforms_match?(spec.platform, platform_object)
-        end
-        installable_candidates = same_platform_candidates.select do |spec|
-          !spec.is_a?(EndpointSpecification) ||
-            (spec.required_ruby_version.satisfied_by?(Gem.ruby_version) &&
-              spec.required_rubygems_version.satisfied_by?(Gem.rubygems_version))
+        target_platform = ruby_platform_materializes_to_ruby_platform? ? platform : local_platform
+
+        installable_candidates = GemHelpers.select_best_platform_match(matching_specs, target_platform)
+
+        specification = __materialize__(installable_candidates, fallback_to_non_installable: false)
+        return specification unless specification.nil?
+
+        if target_platform != platform
+          installable_candidates = GemHelpers.select_best_platform_match(matching_specs, platform)
         end
-        search = installable_candidates.last || same_platform_candidates.last
-        search.dependencies = dependencies if search && (search.is_a?(RemoteSpecification) || search.is_a?(EndpointSpecification))
-        search
+
+        installable_candidates
       end
-    end
 
-    def respond_to?(*args)
-      super || @specification ? @specification.respond_to?(*args) : nil
+      __materialize__(candidates)
     end
 
-    def to_s
-      @__to_s ||= if platform == Gem::Platform::RUBY || platform.nil?
-        "#{name} (#{version})"
+    # If in frozen mode, we fallback to a non-installable candidate because by
+    # doing this we avoid re-resolving and potentially end up changing the
+    # lock file, which is not allowed. In that case, we will give a proper error
+    # about the mismatch higher up the stack, right before trying to install the
+    # bad gem.
+    def __materialize__(candidates, fallback_to_non_installable: Bundler.frozen_bundle?)
+      search = candidates.reverse.find do |spec|
+        spec.is_a?(StubSpecification) || spec.matches_current_metadata?
+      end
+      if search.nil? && fallback_to_non_installable
+        search = candidates.last
       else
-        "#{name} (#{version}-#{platform})"
+        search.dependencies = dependencies if search && search.full_name == full_name && (search.is_a?(RemoteSpecification) || search.is_a?(EndpointSpecification))
       end
+      search
     end
 
-    def identifier
-      @__identifier ||= [name, version, platform_string]
+    def to_s
+      lock_name
     end
 
     def git_version
@@ -105,30 +144,20 @@ module Bundler
       " #{source.revision[0..6]}"
     end
 
-    protected
-
-    def platform_string
-      platform_string = platform.to_s
-      platform_string == Index::RUBY ? Index::NULL : platform_string
+    def force_ruby_platform!
+      @force_ruby_platform = true
     end
 
     private
 
-    def to_ary
-      nil
-    end
-
-    def method_missing(method, *args, &blk)
-      raise "LazySpecification has not been materialized yet (calling :#{method} #{args.inspect})" unless @specification
-
-      return super unless respond_to?(method)
-
-      @specification.send(method, *args, &blk)
+    def use_exact_resolved_specifications?
+      @use_exact_resolved_specifications ||= !source.is_a?(Source::Path) && ruby_platform_materializes_to_ruby_platform?
     end
 
     #
     # For backwards compatibility with existing lockfiles, if the most specific
-    # locked platform is RUBY, we keep the previous behaviour of resolving the
+    # locked platform is not a specific platform like x86_64-linux or
+    # universal-java-11, then we keep the previous behaviour of resolving the
     # best platform variant at materiliazation time. For previous bundler
     # versions (before 2.2.0) this was always the case (except when the lockfile
     # only included non-ruby platforms), but we're also keeping this behaviour
@@ -136,7 +165,9 @@ module Bundler
     # explicitly add a more specific platform.
     #
     def ruby_platform_materializes_to_ruby_platform?
-      !Bundler.most_specific_locked_platform?(Gem::Platform::RUBY) || Bundler.settings[:force_ruby_platform]
+      generic_platform = generic_local_platform == Gem::Platform::JAVA ? Gem::Platform::JAVA : Gem::Platform::RUBY
+
+      !Bundler.most_specific_locked_platform?(generic_platform) || force_ruby_platform || Bundler.settings[:force_ruby_platform]
     end
   end
 end

data/lib/bundler/lockfile_generator.rb

@@ -19,6 +19,7 @@ module Bundler
       add_sources
       add_platforms
       add_dependencies
+      add_checksums
       add_locked_ruby_version
       add_bundled_with
 
@@ -45,7 +46,7 @@ module Bundler
       # gems with the same name, but different platform
       # are ordered consistently
       specs.sort_by(&:full_name).each do |spec|
-        next if spec.name == "bundler".freeze
+        next if spec.name == "bundler"
         out << spec.to_lock
       end
     end
@@ -60,18 +61,26 @@ module Bundler
       handled = []
       definition.dependencies.sort_by(&:to_s).each do |dep|
         next if handled.include?(dep.name)
-        out << dep.to_lock
+        out << dep.to_lock << "\n"
         handled << dep.name
       end
     end
 
+    def add_checksums
+      return unless definition.locked_checksums
+      checksums = definition.resolve.map do |spec|
+        spec.source.checksum_store.to_lock(spec)
+      end
+      add_section("CHECKSUMS", checksums)
+    end
+
     def add_locked_ruby_version
       return unless locked_ruby_version = definition.locked_ruby_version
       add_section("RUBY VERSION", locked_ruby_version.to_s)
     end
 
     def add_bundled_with
-      add_section("BUNDLED WITH", definition.locked_bundler_version.to_s)
+      add_section("BUNDLED WITH", definition.bundler_version_to_lock.to_s)
     end
 
     def add_section(name, value)

data/lib/bundler/lockfile_parser.rb

@@ -2,18 +2,49 @@
 
 module Bundler
   class LockfileParser
-    attr_reader :sources, :dependencies, :specs, :platforms, :bundler_version, :ruby_version
-
-    BUNDLED      = "BUNDLED WITH".freeze
-    DEPENDENCIES = "DEPENDENCIES".freeze
-    PLATFORMS    = "PLATFORMS".freeze
-    RUBY         = "RUBY VERSION".freeze
-    GIT          = "GIT".freeze
-    GEM          = "GEM".freeze
-    PATH         = "PATH".freeze
-    PLUGIN       = "PLUGIN SOURCE".freeze
-    SPECS        = "  specs:".freeze
-    OPTIONS      = /^  ([a-z]+): (.*)$/i.freeze
+    class Position
+      attr_reader :line, :column
+      def initialize(line, column)
+        @line = line
+        @column = column
+      end
+
+      def advance!(string)
+        lines = string.count("\n")
+        if lines > 0
+          @line += lines
+          @column = string.length - string.rindex("\n")
+        else
+          @column += string.length
+        end
+      end
+
+      def to_s
+        "#{line}:#{column}"
+      end
+    end
+
+    attr_reader(
+      :sources,
+      :dependencies,
+      :specs,
+      :platforms,
+      :bundler_version,
+      :ruby_version,
+      :checksums,
+    )
+
+    BUNDLED      = "BUNDLED WITH"
+    DEPENDENCIES = "DEPENDENCIES"
+    CHECKSUMS    = "CHECKSUMS"
+    PLATFORMS    = "PLATFORMS"
+    RUBY         = "RUBY VERSION"
+    GIT          = "GIT"
+    GEM          = "GEM"
+    PATH         = "PATH"
+    PLUGIN       = "PLUGIN SOURCE"
+    SPECS        = "  specs:"
+    OPTIONS      = /^  ([a-z]+): (.*)$/i
     SOURCE       = [GIT, GEM, PATH, PLUGIN].freeze
 
     SECTIONS_BY_VERSION_INTRODUCED = {
@@ -21,14 +52,18 @@ module Bundler
       Gem::Version.create("1.10") => [BUNDLED].freeze,
       Gem::Version.create("1.12") => [RUBY].freeze,
       Gem::Version.create("1.13") => [PLUGIN].freeze,
+      Gem::Version.create("2.5.0") => [CHECKSUMS].freeze,
     }.freeze
 
-    KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten.freeze
+    KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten!.freeze
 
     ENVIRONMENT_VERSION_SECTIONS = [BUNDLED, RUBY].freeze
+    deprecate_constant(:ENVIRONMENT_VERSION_SECTIONS)
 
     def self.sections_in_lockfile(lockfile_contents)
-      lockfile_contents.scan(/^\w[\w ]*$/).uniq
+      sections = lockfile_contents.scan(/^\w[\w ]*$/)
+      sections.uniq!
+      sections
     end
 
     def self.unknown_sections_in_lockfile(lockfile_contents)
@@ -37,7 +72,7 @@ module Bundler
 
     def self.sections_to_ignore(base_version = nil)
       base_version &&= base_version.release
-      base_version ||= Gem::Version.create("1.0".dup)
+      base_version ||= Gem::Version.create("1.0")
       attributes = []
       SECTIONS_BY_VERSION_INTRODUCED.each do |version, introduced|
         next if version <= base_version
@@ -46,82 +81,88 @@ module Bundler
       attributes
     end
 
+    def self.bundled_with
+      lockfile = Bundler.default_lockfile
+      return unless lockfile.file?
+
+      lockfile_contents = Bundler.read_file(lockfile)
+      return unless lockfile_contents.include?(BUNDLED)
+
+      lockfile_contents.split(BUNDLED).last.strip
+    end
+
     def initialize(lockfile)
       @platforms    = []
       @sources      = []
       @dependencies = {}
-      @state        = nil
+      @parse_method = nil
       @specs        = {}
+      @lockfile_path = begin
+        SharedHelpers.relative_lockfile_path
+      rescue GemfileNotFound
+        "Gemfile.lock"
+      end
+      @pos = Position.new(1, 1)
 
-      if lockfile.match(/<<<<<<<|=======|>>>>>>>|\|\|\|\|\|\|\|/)
-        raise LockfileError, "Your #{Bundler.default_lockfile.relative_path_from(SharedHelpers.pwd)} contains merge conflicts.\n" \
-          "Run `git checkout HEAD -- #{Bundler.default_lockfile.relative_path_from(SharedHelpers.pwd)}` first to get a clean lock."
+      if lockfile.match?(/<<<<<<<|=======|>>>>>>>|\|\|\|\|\|\|\|/)
+        raise LockfileError, "Your #{@lockfile_path} contains merge conflicts.\n" \
+          "Run `git checkout HEAD -- #{@lockfile_path}` first to get a clean lock."
       end
 
-      lockfile.split(/(?:\r?\n)+/).each do |line|
+      lockfile.split(/((?:\r?\n)+)/) do |line|
+        # split alternates between the line and the following whitespace
+        next @pos.advance!(line) if line.match?(/^\s*$/)
+
         if SOURCE.include?(line)
-          @state = :source
+          @parse_method = :parse_source
           parse_source(line)
         elsif line == DEPENDENCIES
-          @state = :dependency
+          @parse_method = :parse_dependency
+        elsif line == CHECKSUMS
+          # This is a temporary solution to make this feature disabled by default
+          # for all gemfiles that don't already explicitly include the feature.
+          @checksums = true
+          @parse_method = :parse_checksum
         elsif line == PLATFORMS
-          @state = :platform
+          @parse_method = :parse_platform
         elsif line == RUBY
-          @state = :ruby
+          @parse_method = :parse_ruby
         elsif line == BUNDLED
-          @state = :bundled_with
-        elsif line =~ /^[^\s]/
-          @state = nil
-        elsif @state
-          send("parse_#{@state}", line)
+          @parse_method = :parse_bundled_with
+        elsif /^[^\s]/.match?(line)
+          @parse_method = nil
+        elsif @parse_method
+          send(@parse_method, line)
         end
+        @pos.advance!(line)
       end
-      @specs = @specs.values.sort_by(&:identifier)
-      warn_for_outdated_bundler_version
+      @specs = @specs.values.sort_by!(&:full_name)
     rescue ArgumentError => e
       Bundler.ui.debug(e)
-      raise LockfileError, "Your lockfile is unreadable. Run `rm #{Bundler.default_lockfile.relative_path_from(SharedHelpers.pwd)}` " \
-        "and then `bundle install` to generate a new lockfile."
+      raise LockfileError, "Your lockfile is unreadable. Run `rm #{@lockfile_path}` " \
+        "and then `bundle install` to generate a new lockfile. The error occurred while " \
+        "evaluating #{@lockfile_path}:#{@pos}"
     end
 
-    def warn_for_outdated_bundler_version
-      return unless bundler_version
-      prerelease_text = bundler_version.prerelease? ? " --pre" : ""
-      current_version = Gem::Version.create(Bundler::VERSION)
-      return unless current_version < bundler_version
-      Bundler.ui.warn "Warning: the running version of Bundler (#{current_version}) is older " \
-           "than the version that created the lockfile (#{bundler_version}). We suggest you to " \
-           "upgrade to the version that created the lockfile by running `gem install " \
-           "bundler:#{bundler_version}#{prerelease_text}`.\n"
+    def may_include_redundant_platform_specific_gems?
+      bundler_version.nil? || bundler_version < Gem::Version.new("1.16.2")
     end
 
     private
 
     TYPES = {
-      GIT    => Bundler::Source::Git,
-      GEM    => Bundler::Source::Rubygems,
-      PATH   => Bundler::Source::Path,
+      GIT => Bundler::Source::Git,
+      GEM => Bundler::Source::Rubygems,
+      PATH => Bundler::Source::Path,
       PLUGIN => Bundler::Plugin,
     }.freeze
 
     def parse_source(line)
       case line
       when SPECS
-        case @type
-        when PATH
-          @current_source = TYPES[@type].from_lock(@opts)
-          @sources << @current_source
-        when GIT
-          @current_source = TYPES[@type].from_lock(@opts)
-          @sources << @current_source
-        when GEM
-          @opts["remotes"] = Array(@opts.delete("remote")).reverse
-          @current_source = TYPES[@type].from_lock(@opts)
-          @sources << @current_source
-        when PLUGIN
-          @current_source = Plugin.source_from_lock(@opts)
-          @sources << @current_source
-        end
+        return unless TYPES.key?(@type)
+        @current_source = TYPES[@type].from_lock(@opts)
+        @sources << @current_source
       when OPTIONS
         value = $2
         value = true if value == "true"
@@ -151,18 +192,19 @@ module Bundler
       (?:#{space}\(([^-]*)                               # Space, followed by version
       (?:-(.*))?\))?                                     # Optional platform
       (!)?                                               # Optional pinned marker
+      (?:#{space}([^ ]+))?                               # Optional checksum
       $                                                  # Line end
-    /xo.freeze
+    /xo
 
     def parse_dependency(line)
       return unless line =~ NAME_VERSION
       spaces = $1
       return unless spaces.size == 2
-      name = $2
+      name = -$2
       version = $3
       pinned = $5
 
-      version = version.split(",").map(&:strip) if version
+      version = version.split(",").each(&:strip!) if version
 
       dep = Bundler::Dependency.new(name, version)
 
@@ -183,23 +225,47 @@ module Bundler
       @dependencies[dep.name] = dep
     end
 
-    def parse_spec(line)
+    def parse_checksum(line)
       return unless line =~ NAME_VERSION
+
       spaces = $1
+      return unless spaces.size == 2
+      checksums = $6
+      return unless checksums
       name = $2
       version = $3
       platform = $4
 
+      version = Gem::Version.new(version)
+      platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
+      full_name = Gem::NameTuple.new(name, version, platform).full_name
+      return unless spec = @specs[full_name]
+
+      checksums.split(",") do |lock_checksum|
+        column = line.index(lock_checksum) + 1
+        checksum = Checksum.from_lock(lock_checksum, "#{@lockfile_path}:#{@pos.line}:#{column}")
+        spec.source.checksum_store.register(spec, checksum)
+      end
+    end
+
+    def parse_spec(line)
+      return unless line =~ NAME_VERSION
+      spaces = $1
+      name = -$2
+      version = $3
+
       if spaces.size == 4
+        # only load platform for non-dependency (spec) line
+        platform = $4
+
         version = Gem::Version.new(version)
         platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
-        @current_spec = LazySpecification.new(name, version, platform)
-        @current_spec.source = @current_source
+        @current_spec = LazySpecification.new(name, version, platform, @current_source)
         @current_source.add_dependency_names(name)
 
-        @specs[@current_spec.identifier] = @current_spec
+        @specs[@current_spec.full_name] = @current_spec
       elsif spaces.size == 6
-        version = version.split(",").map(&:strip) if version
+        version = version.split(",").each(&:strip!) if version
         dep = Gem::Dependency.new(name, version)
         @current_spec.dependencies << dep
       end
@@ -210,13 +276,14 @@ module Bundler
     end
 
     def parse_bundled_with(line)
-      line = line.strip
+      line.strip!
       return unless Gem::Version.correct?(line)
       @bundler_version = Gem::Version.create(line)
     end
 
     def parse_ruby(line)
-      @ruby_version = line.strip
+      line.strip!
+      @ruby_version = line
     end
   end
 end

data/lib/bundler/man/bundle-add.1

@@ -1,66 +1,59 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-ADD" "1" "June 2021" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-ADD" "1" "June 2024" ""
 .SH "NAME"
 \fBbundle\-add\fR \- Add gem to the Gemfile and run bundle install
-.
 .SH "SYNOPSIS"
-\fBbundle add\fR \fIGEM_NAME\fR [\-\-group=GROUP] [\-\-version=VERSION] [\-\-source=SOURCE] [\-\-git=GIT] [\-\-branch=BRANCH] [\-\-skip\-install] [\-\-strict] [\-\-optimistic]
-.
+\fBbundle add\fR \fIGEM_NAME\fR [\-\-group=GROUP] [\-\-version=VERSION] [\-\-source=SOURCE] [\-\-path=PATH] [\-\-git=GIT] [\-\-github=GITHUB] [\-\-branch=BRANCH] [\-\-ref=REF] [\-\-skip\-install] [\-\-strict] [\-\-optimistic]
 .SH "DESCRIPTION"
 Adds the named gem to the Gemfile and run \fBbundle install\fR\. \fBbundle install\fR can be avoided by using the flag \fB\-\-skip\-install\fR\.
-.
 .P
 Example:
-.
 .P
 bundle add rails
-.
 .P
 bundle add rails \-\-version "< 3\.0, > 1\.1"
-.
 .P
 bundle add rails \-\-version "~> 5\.0\.0" \-\-source "https://gems\.example\.com" \-\-group "development"
-.
 .P
 bundle add rails \-\-skip\-install
-.
 .P
 bundle add rails \-\-group "development, test"
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-\-version\fR, \fB\-v\fR
 Specify version requirements(s) for the added gem\.
-.
 .TP
 \fB\-\-group\fR, \fB\-g\fR
 Specify the group(s) for the added gem\. Multiple groups should be separated by commas\.
-.
 .TP
-\fB\-\-source\fR, , \fB\-s\fR
+\fB\-\-source\fR, \fB\-s\fR
 Specify the source for the added gem\.
-.
+.TP
+\fB\-\-require\fR, \fB\-r\fR
+Adds require path to gem\. Provide false, or a path as a string\.
+.TP
+\fB\-\-path\fR
+Specify the file system path for the added gem\.
 .TP
 \fB\-\-git\fR
 Specify the git source for the added gem\.
-.
+.TP
+\fB\-\-github\fR
+Specify the github source for the added gem\.
 .TP
 \fB\-\-branch\fR
 Specify the git branch for the added gem\.
-.
+.TP
+\fB\-\-ref\fR
+Specify the git ref for the added gem\.
 .TP
 \fB\-\-skip\-install\fR
 Adds the gem to the Gemfile but does not install it\.
-.
 .TP
 \fB\-\-optimistic\fR
-Adds optimistic declaration of version
-.
+Adds optimistic declaration of version\.
 .TP
 \fB\-\-strict\fR
-Adds strict declaration of version
+Adds strict declaration of version\.