bundler 2.4.21 → 2.5.0

data/lib/bundler/lockfile_parser.rb

@@ -2,10 +2,41 @@
 
 module Bundler
   class LockfileParser
-    attr_reader :sources, :dependencies, :specs, :platforms, :bundler_version, :ruby_version
+    class Position
+      attr_reader :line, :column
+      def initialize(line, column)
+        @line = line
+        @column = column
+      end
+
+      def advance!(string)
+        lines = string.count("\n")
+        if lines > 0
+          @line += lines
+          @column = string.length - string.rindex("\n")
+        else
+          @column += string.length
+        end
+      end
+
+      def to_s
+        "#{line}:#{column}"
+      end
+    end
+
+    attr_reader(
+      :sources,
+      :dependencies,
+      :specs,
+      :platforms,
+      :bundler_version,
+      :ruby_version,
+      :checksums,
+    )
 
     BUNDLED      = "BUNDLED WITH"
     DEPENDENCIES = "DEPENDENCIES"
+    CHECKSUMS    = "CHECKSUMS"
     PLATFORMS    = "PLATFORMS"
     RUBY         = "RUBY VERSION"
     GIT          = "GIT"
@@ -13,7 +44,7 @@ module Bundler
     PATH         = "PATH"
     PLUGIN       = "PLUGIN SOURCE"
     SPECS        = "  specs:"
-    OPTIONS      = /^  ([a-z]+): (.*)$/i.freeze
+    OPTIONS      = /^  ([a-z]+): (.*)$/i
     SOURCE       = [GIT, GEM, PATH, PLUGIN].freeze
 
     SECTIONS_BY_VERSION_INTRODUCED = {
@@ -21,6 +52,7 @@ module Bundler
       Gem::Version.create("1.10") => [BUNDLED].freeze,
       Gem::Version.create("1.12") => [RUBY].freeze,
       Gem::Version.create("1.13") => [PLUGIN].freeze,
+      Gem::Version.create("2.5.0") => [CHECKSUMS].freeze,
     }.freeze
 
     KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten!.freeze
@@ -65,18 +97,32 @@ module Bundler
       @dependencies = {}
       @parse_method = nil
       @specs        = {}
+      @lockfile_path = begin
+        SharedHelpers.relative_lockfile_path
+      rescue GemfileNotFound
+        "Gemfile.lock"
+      end
+      @pos = Position.new(1, 1)
 
       if lockfile.match?(/<<<<<<<|=======|>>>>>>>|\|\|\|\|\|\|\|/)
-        raise LockfileError, "Your lockfile contains merge conflicts.\n" \
-          "Run `git checkout HEAD -- #{SharedHelpers.relative_lockfile_path}` first to get a clean lock."
+        raise LockfileError, "Your #{@lockfile_path} contains merge conflicts.\n" \
+          "Run `git checkout HEAD -- #{@lockfile_path}` first to get a clean lock."
       end
 
-      lockfile.split(/(?:\r?\n)+/) do |line|
+      lockfile.split(/((?:\r?\n)+)/) do |line|
+        # split alternates between the line and the following whitespace
+        next @pos.advance!(line) if line.match?(/^\s*$/)
+
         if SOURCE.include?(line)
           @parse_method = :parse_source
           parse_source(line)
         elsif line == DEPENDENCIES
           @parse_method = :parse_dependency
+        elsif line == CHECKSUMS
+          # This is a temporary solution to make this feature disabled by default
+          # for all gemfiles that don't already explicitly include the feature.
+          @checksums = true
+          @parse_method = :parse_checksum
         elsif line == PLATFORMS
           @parse_method = :parse_platform
         elsif line == RUBY
@@ -88,12 +134,14 @@ module Bundler
         elsif @parse_method
           send(@parse_method, line)
         end
+        @pos.advance!(line)
       end
       @specs = @specs.values.sort_by!(&:full_name)
     rescue ArgumentError => e
       Bundler.ui.debug(e)
-      raise LockfileError, "Your lockfile is unreadable. Run `rm #{SharedHelpers.relative_lockfile_path}` " \
-        "and then `bundle install` to generate a new lockfile."
+      raise LockfileError, "Your lockfile is unreadable. Run `rm #{@lockfile_path}` " \
+        "and then `bundle install` to generate a new lockfile. The error occurred while " \
+        "evaluating #{@lockfile_path}:#{@pos}"
     end
 
     def may_include_redundant_platform_specific_gems?
@@ -144,8 +192,9 @@ module Bundler
       (?:#{space}\(([^-]*)                               # Space, followed by version
       (?:-(.*))?\))?                                     # Optional platform
       (!)?                                               # Optional pinned marker
+      (?:#{space}([^ ]+))?                               # Optional checksum
       $                                                  # Line end
-    /xo.freeze
+    /xo
 
     def parse_dependency(line)
       return unless line =~ NAME_VERSION
@@ -176,6 +225,29 @@ module Bundler
       @dependencies[dep.name] = dep
     end
 
+    def parse_checksum(line)
+      return unless line =~ NAME_VERSION
+
+      spaces = $1
+      return unless spaces.size == 2
+      checksums = $6
+      return unless checksums
+      name = $2
+      version = $3
+      platform = $4
+
+      version = Gem::Version.new(version)
+      platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
+      full_name = Gem::NameTuple.new(name, version, platform).full_name
+      return unless spec = @specs[full_name]
+
+      checksums.split(",") do |lock_checksum|
+        column = line.index(lock_checksum) + 1
+        checksum = Checksum.from_lock(lock_checksum, "#{@lockfile_path}:#{@pos.line}:#{column}")
+        spec.source.checksum_store.register(spec, checksum)
+      end
+    end
+
     def parse_spec(line)
       return unless line =~ NAME_VERSION
       spaces = $1
@@ -188,8 +260,7 @@ module Bundler
 
         version = Gem::Version.new(version)
         platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
-        @current_spec = LazySpecification.new(name, version, platform)
-        @current_spec.source = @current_source
+        @current_spec = LazySpecification.new(name, version, platform, @current_source)
         @current_source.add_dependency_names(name)
 
         @specs[@current_spec.full_name] = @current_spec

data/lib/bundler/man/bundle-add.1

@@ -1,81 +1,58 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-ADD" "1" "October 2023" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-ADD" "1" "December 2023" ""
 .SH "NAME"
 \fBbundle\-add\fR \- Add gem to the Gemfile and run bundle install
-.
 .SH "SYNOPSIS"
 \fBbundle add\fR \fIGEM_NAME\fR [\-\-group=GROUP] [\-\-version=VERSION] [\-\-source=SOURCE] [\-\-path=PATH] [\-\-git=GIT] [\-\-github=GITHUB] [\-\-branch=BRANCH] [\-\-ref=REF] [\-\-skip\-install] [\-\-strict] [\-\-optimistic]
-.
 .SH "DESCRIPTION"
 Adds the named gem to the Gemfile and run \fBbundle install\fR\. \fBbundle install\fR can be avoided by using the flag \fB\-\-skip\-install\fR\.
-.
 .P
 Example:
-.
 .P
 bundle add rails
-.
 .P
 bundle add rails \-\-version "< 3\.0, > 1\.1"
-.
 .P
 bundle add rails \-\-version "~> 5\.0\.0" \-\-source "https://gems\.example\.com" \-\-group "development"
-.
 .P
 bundle add rails \-\-skip\-install
-.
 .P
 bundle add rails \-\-group "development, test"
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-\-version\fR, \fB\-v\fR
 Specify version requirements(s) for the added gem\.
-.
 .TP
 \fB\-\-group\fR, \fB\-g\fR
 Specify the group(s) for the added gem\. Multiple groups should be separated by commas\.
-.
 .TP
 \fB\-\-source\fR, \fB\-s\fR
 Specify the source for the added gem\.
-.
 .TP
 \fB\-\-require\fR, \fB\-r\fR
 Adds require path to gem\. Provide false, or a path as a string\.
-.
 .TP
 \fB\-\-path\fR
 Specify the file system path for the added gem\.
-.
 .TP
 \fB\-\-git\fR
 Specify the git source for the added gem\.
-.
 .TP
 \fB\-\-github\fR
 Specify the github source for the added gem\.
-.
 .TP
 \fB\-\-branch\fR
 Specify the git branch for the added gem\.
-.
 .TP
 \fB\-\-ref\fR
 Specify the git ref for the added gem\.
-.
 .TP
 \fB\-\-skip\-install\fR
 Adds the gem to the Gemfile but does not install it\.
-.
 .TP
 \fB\-\-optimistic\fR
 Adds optimistic declaration of version\.
-.
 .TP
 \fB\-\-strict\fR
 Adds strict declaration of version\.

data/lib/bundler/man/bundle-binstubs.1

@@ -1,41 +1,29 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-BINSTUBS" "1" "October 2023" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-BINSTUBS" "1" "December 2023" ""
 .SH "NAME"
 \fBbundle\-binstubs\fR \- Install the binstubs of the listed gems
-.
 .SH "SYNOPSIS"
 \fBbundle binstubs\fR \fIGEM_NAME\fR [\-\-force] [\-\-path PATH] [\-\-standalone]
-.
 .SH "DESCRIPTION"
 Binstubs are scripts that wrap around executables\. Bundler creates a small Ruby file (a binstub) that loads Bundler, runs the command, and puts it into \fBbin/\fR\. Binstubs are a shortcut\-or alternative\- to always using \fBbundle exec\fR\. This gives you a file that can be run directly, and one that will always run the correct gem version used by the application\.
-.
 .P
 For example, if you run \fBbundle binstubs rspec\-core\fR, Bundler will create the file \fBbin/rspec\fR\. That file will contain enough code to load Bundler, tell it to load the bundled gems, and then run rspec\.
-.
 .P
 This command generates binstubs for executables in \fBGEM_NAME\fR\. Binstubs are put into \fBbin\fR, or the \fB\-\-path\fR directory if one has been set\. Calling binstubs with [GEM [GEM]] will create binstubs for all given gems\.
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-\-force\fR
 Overwrite existing binstubs if they exist\.
-.
 .TP
 \fB\-\-path\fR
 The location to install the specified binstubs to\. This defaults to \fBbin\fR\.
-.
 .TP
 \fB\-\-standalone\fR
 Makes binstubs that can work without depending on Rubygems or Bundler at runtime\.
-.
 .TP
 \fB\-\-shebang\fR
-Specify a different shebang executable name than the default (default \'ruby\')
-.
+Specify a different shebang executable name than the default (default 'ruby')
 .TP
 \fB\-\-all\fR
 Create binstubs for all gems in the bundle\.

data/lib/bundler/man/bundle-cache.1

@@ -1,61 +1,40 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-CACHE" "1" "October 2023" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-CACHE" "1" "December 2023" ""
 .SH "NAME"
 \fBbundle\-cache\fR \- Package your needed \fB\.gem\fR files into your application
-.
 .SH "SYNOPSIS"
 \fBbundle cache\fR
-.
 .P
 alias: \fBpackage\fR, \fBpack\fR
-.
 .SH "DESCRIPTION"
 Copy all of the \fB\.gem\fR files needed to run the application into the \fBvendor/cache\fR directory\. In the future, when running \fBbundle install(1)\fR \fIbundle\-install\.1\.html\fR, use the gems in the cache in preference to the ones on \fBrubygems\.org\fR\.
-.
 .SH "GIT AND PATH GEMS"
 The \fBbundle cache\fR command can also package \fB:git\fR and \fB:path\fR dependencies besides \.gem files\. This needs to be explicitly enabled via the \fB\-\-all\fR option\. Once used, the \fB\-\-all\fR option will be remembered\.
-.
 .SH "SUPPORT FOR MULTIPLE PLATFORMS"
 When using gems that have different packages for different platforms, Bundler supports caching of gems for other platforms where the Gemfile has been resolved (i\.e\. present in the lockfile) in \fBvendor/cache\fR\. This needs to be enabled via the \fB\-\-all\-platforms\fR option\. This setting will be remembered in your local bundler configuration\.
-.
 .SH "REMOTE FETCHING"
 By default, if you run \fBbundle install(1)\fR \fIbundle\-install\.1\.html\fR after running bundle cache(1) \fIbundle\-cache\.1\.html\fR, bundler will still connect to \fBrubygems\.org\fR to check whether a platform\-specific gem exists for any of the gems in \fBvendor/cache\fR\.
-.
 .P
 For instance, consider this Gemfile(5):
-.
 .IP "" 4
-.
 .nf
-
 source "https://rubygems\.org"
 
 gem "nokogiri"
-.
 .fi
-.
 .IP "" 0
-.
 .P
 If you run \fBbundle cache\fR under C Ruby, bundler will retrieve the version of \fBnokogiri\fR for the \fB"ruby"\fR platform\. If you deploy to JRuby and run \fBbundle install\fR, bundler is forced to check to see whether a \fB"java"\fR platformed \fBnokogiri\fR exists\.
-.
 .P
 Even though the \fBnokogiri\fR gem for the Ruby platform is \fItechnically\fR acceptable on JRuby, it has a C extension that does not run on JRuby\. As a result, bundler will, by default, still connect to \fBrubygems\.org\fR to check whether it has a version of one of your gems more specific to your platform\.
-.
 .P
 This problem is also not limited to the \fB"java"\fR platform\. A similar (common) problem can happen when developing on Windows and deploying to Linux, or even when developing on OSX and deploying to Linux\.
-.
 .P
 If you know for sure that the gems packaged in \fBvendor/cache\fR are appropriate for the platform you are on, you can run \fBbundle install \-\-local\fR to skip checking for more appropriate gems, and use the ones in \fBvendor/cache\fR\.
-.
 .P
 One way to be sure that you have the right platformed versions of all your gems is to run \fBbundle cache\fR on an identical machine and check in the gems\. For instance, you can run \fBbundle cache\fR on an identical staging box during your staging process, and check in the \fBvendor/cache\fR before deploying to production\.
-.
 .P
 By default, bundle cache(1) \fIbundle\-cache\.1\.html\fR fetches and also installs the gems to the default location\. To package the dependencies to \fBvendor/cache\fR without installing them to the local install location, you can run \fBbundle cache \-\-no\-install\fR\.
-.
 .SH "HISTORY"
 In Bundler 2\.1, \fBcache\fR took in the functionalities of \fBpackage\fR and now \fBpackage\fR and \fBpack\fR are aliases of \fBcache\fR\.

data/lib/bundler/man/bundle-check.1

@@ -1,30 +1,21 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-CHECK" "1" "October 2023" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-CHECK" "1" "December 2023" ""
 .SH "NAME"
 \fBbundle\-check\fR \- Verifies if dependencies are satisfied by installed gems
-.
 .SH "SYNOPSIS"
 \fBbundle check\fR [\-\-dry\-run] [\-\-gemfile=FILE] [\-\-path=PATH]
-.
 .SH "DESCRIPTION"
 \fBcheck\fR searches the local machine for each of the gems requested in the Gemfile\. If all gems are found, Bundler prints a success message and exits with a status of 0\.
-.
 .P
 If not, the first missing gem is listed and Bundler exits status 1\.
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-\-dry\-run\fR
 Locks the [\fBGemfile(5)\fR][Gemfile(5)] before running the command\.
-.
 .TP
 \fB\-\-gemfile\fR
 Use the specified gemfile instead of the [\fBGemfile(5)\fR][Gemfile(5)]\.
-.
 .TP
 \fB\-\-path\fR
 Specify a different path than the system default (\fB$BUNDLE_PATH\fR or \fB$GEM_HOME\fR)\. Bundler will remember this value for future installs on this machine\.

data/lib/bundler/man/bundle-clean.1

@@ -1,23 +1,16 @@
-.\" generated with Ronn/v0.7.3
-.\" http://github.com/rtomayko/ronn/tree/0.7.3
-.
-.TH "BUNDLE\-CLEAN" "1" "October 2023" "" ""
-.
+.\" generated with nRonn/v0.11.1
+.\" https://github.com/n-ronn/nronn/tree/0.11.1
+.TH "BUNDLE\-CLEAN" "1" "December 2023" ""
 .SH "NAME"
 \fBbundle\-clean\fR \- Cleans up unused gems in your bundler directory
-.
 .SH "SYNOPSIS"
 \fBbundle clean\fR [\-\-dry\-run] [\-\-force]
-.
 .SH "DESCRIPTION"
 This command will remove all unused gems in your bundler directory\. This is useful when you have made many changes to your gem dependencies\.
-.
 .SH "OPTIONS"
-.
 .TP
 \fB\-\-dry\-run\fR
 Print the changes, but do not clean the unused gems\.
-.
 .TP
 \fB\-\-force\fR
 Forces cleaning up unused gems even if Bundler is configured to use globally installed gems\. As a consequence, removes all system gems except for the ones in the current application\.