bundler 2.5.23 → 2.6.0

data/lib/bundler/source/git.rb

@@ -102,7 +102,7 @@ module Bundler
       end
 
       def identifier
-        uri_with_specifiers([humanized_ref, cached_revision, glob_for_display])
+        uri_with_specifiers([humanized_ref, locked_revision, glob_for_display])
       end
 
       def uri_with_specifiers(specifiers)
@@ -176,10 +176,10 @@ module Bundler
             "#{current_branch} but Gemfile specifies #{branch}"
         end
 
-        changed = cached_revision && cached_revision != revision
+        changed = locked_revision && locked_revision != revision
 
-        if !Bundler.settings[:disable_local_revision_check] && changed && !@unlocked && !git_proxy.contains?(cached_revision)
-          raise GitError, "The Gemfile lock is pointing to revision #{shortref_for_display(cached_revision)} " \
+        if !Bundler.settings[:disable_local_revision_check] && changed && !@unlocked && !git_proxy.contains?(locked_revision)
+          raise GitError, "The Gemfile lock is pointing to revision #{shortref_for_display(locked_revision)} " \
             "but the current branch in your local override for #{name} does not contain such commit. " \
             "Please make sure your branch is up to date."
         end
@@ -188,12 +188,10 @@ module Bundler
       end
 
       def specs(*)
-        set_up_app_cache!(app_cache_path) if use_app_cache?
+        set_cache_path!(app_cache_path) if use_app_cache?
 
         if requires_checkout? && !@copied
-          FileUtils.rm_rf(app_cache_path) if use_app_cache? && git_proxy.not_a_repository?
-
-          fetch
+          fetch unless use_app_cache?
           checkout
         end
 
@@ -216,17 +214,16 @@ module Bundler
         requires_checkout? ? spec.post_install_message : nil
       end
 
+      def migrate_cache(custom_path = nil, local: false)
+        if local
+          cache_to(custom_path, try_migrate: false)
+        else
+          cache_to(custom_path, try_migrate: true)
+        end
+      end
+
       def cache(spec, custom_path = nil)
-        app_cache_path = app_cache_path(custom_path)
-        return unless Bundler.feature_flag.cache_all?
-        return if install_path == app_cache_path
-        return if cache_path == app_cache_path
-        cached!
-        FileUtils.rm_rf(app_cache_path)
-        git_proxy.checkout if requires_checkout?
-        FileUtils.cp_r("#{cache_path}/.", app_cache_path)
-        FileUtils.touch(app_cache_path.join(".bundlecache"))
-        FileUtils.rm_rf(Dir.glob(app_cache_path.join("hooks/*.sample")))
+        cache_to(custom_path, try_migrate: false)
       end
 
       def load_spec_files
@@ -249,7 +246,7 @@ module Bundler
       end
 
       def app_cache_dirname
-        "#{base_name}-#{shortref_for_path(cached_revision || revision)}"
+        "#{base_name}-#{shortref_for_path(locked_revision || revision)}"
       end
 
       def revision
@@ -270,9 +267,38 @@ module Bundler
 
       private
 
+      def cache_to(custom_path, try_migrate: false)
+        return unless Bundler.feature_flag.cache_all?
+
+        app_cache_path = app_cache_path(custom_path)
+
+        migrate = try_migrate ? bare_repo?(app_cache_path) : false
+
+        set_cache_path!(nil) if migrate
+
+        return if cache_path == app_cache_path
+
+        cached!
+        FileUtils.rm_rf(app_cache_path)
+        git_proxy.checkout if migrate || requires_checkout?
+        git_proxy.copy_to(app_cache_path, @submodules)
+      end
+
       def checkout
         Bundler.ui.debug "  * Checking out revision: #{ref}"
-        git_proxy.copy_to(install_path, submodules)
+        if use_app_cache? && !bare_repo?(app_cache_path)
+          SharedHelpers.filesystem_access(install_path.dirname) do |p|
+            FileUtils.mkdir_p(p)
+          end
+          FileUtils.cp_r("#{app_cache_path}/.", install_path)
+        else
+          if use_app_cache? && bare_repo?(app_cache_path)
+            Bundler.ui.warn "Installing from cache in old \"bare repository\" format for compatibility. " \
+                            "Please run `bundle cache` and commit the updated cache to migrate to the new format and get rid of this warning."
+          end
+
+          git_proxy.copy_to(install_path, submodules)
+        end
         serialize_gemspecs_in(install_path)
         @copied = true
       end
@@ -320,13 +346,8 @@ module Bundler
         @install_path = path
       end
 
-      def set_up_app_cache!(path)
-        FileUtils.mkdir_p(path.join("refs"))
-        set_cache_path!(path)
-      end
-
       def has_app_cache?
-        cached_revision && super
+        locked_revision && super
       end
 
       def use_app_cache?
@@ -334,11 +355,11 @@ module Bundler
       end
 
       def requires_checkout?
-        allow_git_ops? && !local? && !cached_revision_checked_out?
+        allow_git_ops? && !local? && !locked_revision_checked_out?
       end
 
-      def cached_revision_checked_out?
-        cached_revision && cached_revision == revision && install_path.exist?
+      def locked_revision_checked_out?
+        locked_revision && locked_revision == revision && install_path.exist?
       end
 
       def base_name
@@ -375,7 +396,7 @@ module Bundler
         Bundler::Digest.sha1(input)
       end
 
-      def cached_revision
+      def locked_revision
         options["revision"]
       end
 
@@ -384,7 +405,7 @@ module Bundler
       end
 
       def git_proxy
-        @git_proxy ||= GitProxy.new(cache_path, uri, options, cached_revision, self)
+        @git_proxy ||= GitProxy.new(cache_path, uri, options, locked_revision, self)
       end
 
       def fetch
@@ -417,6 +438,10 @@ module Bundler
       def override_for(path)
         Bundler.settings.local_overrides.key(path)
       end
+
+      def bare_repo?(path)
+        File.exist?(path.join("objects")) && File.exist?(path.join("HEAD"))
+      end
     end
   end
 end

data/lib/bundler/source/path.rb

@@ -214,7 +214,7 @@ module Bundler
 
         # Some gem authors put absolute paths in their gemspec
         # and we have to save them from themselves
-        spec.files = spec.files.map do |path|
+        spec.files = spec.files.filter_map do |path|
           next path unless /\A#{Pathname::SEPARATOR_PAT}/o.match?(path)
           next if File.directory?(path)
           begin
@@ -222,7 +222,7 @@ module Bundler
           rescue ArgumentError
             path
           end
-        end.compact
+        end
 
         installer = Path::Installer.new(
           spec,

data/lib/bundler/source_list.rb

@@ -91,7 +91,7 @@ module Bundler
     end
 
     def rubygems_remotes
-      rubygems_sources.map(&:remotes).flatten.uniq
+      rubygems_sources.flat_map(&:remotes).uniq
     end
 
     def all_sources

data/lib/bundler/spec_set.rb

@@ -7,49 +7,44 @@ module Bundler
     include Enumerable
     include TSort
 
-    attr_reader :incomplete_specs
-
-    def initialize(specs, incomplete_specs = [])
+    def initialize(specs)
       @specs = specs
-      @incomplete_specs = incomplete_specs
     end
 
-    def for(dependencies, check = false, platforms = [nil])
-      handled = ["bundler"].product(platforms).map {|k| [k, true] }.to_h
-      deps = dependencies.product(platforms)
-      specs = []
+    def for(dependencies, platforms_or_legacy_check = [nil], legacy_platforms = [nil], skips: [])
+      platforms = if [true, false].include?(platforms_or_legacy_check)
+        Bundler::SharedHelpers.major_deprecation 2,
+          "SpecSet#for received a `check` parameter, but that's no longer used and deprecated. " \
+          "SpecSet#for always implicitly performs validation. Please remove this parameter",
+          print_caller_location: true
 
-      loop do
-        break unless dep = deps.shift
+        legacy_platforms
+      else
+        platforms_or_legacy_check
+      end
 
-        name = dep[0].name
-        platform = dep[1]
-        incomplete = false
+      materialize_dependencies(dependencies, platforms, skips: skips)
 
-        key = [name, platform]
-        next if handled.key?(key)
+      @materializations.flat_map(&:specs).uniq
+    end
 
-        handled[key] = true
+    def normalize_platforms!(deps, platforms)
+      complete_platforms = add_extra_platforms!(platforms)
 
-        specs_for_dep = specs_for_dependency(*dep)
-        if specs_for_dep.any?
-          specs.concat(specs_for_dep)
+      complete_platforms.map do |platform|
+        next platform if platform == Gem::Platform::RUBY
 
-          specs_for_dep.first.dependencies.each do |d|
-            next if d.type == :development
-            incomplete = true if d.name != "bundler" && lookup[d.name].nil?
-            deps << [d, dep[1]]
-          end
-        else
-          incomplete = true
+        begin
+          Integer(platform.version)
+        rescue ArgumentError, TypeError
+          next platform
         end
 
-        if incomplete && check
-          @incomplete_specs += lookup[name] || [LazySpecification.new(name, nil, nil)]
-        end
-      end
+        less_specific_platform = Gem::Platform.new([platform.cpu, platform.os, nil])
+        next platform if incomplete_for_platform?(deps, less_specific_platform)
 
-      specs.uniq
+        less_specific_platform
+      end.uniq
     end
 
     def add_extra_platforms!(platforms)
@@ -112,19 +107,18 @@ module Bundler
     end
 
     def materialize(deps)
-      materialized = self.for(deps, true)
+      materialize_dependencies(deps)
 
-      SpecSet.new(materialized, incomplete_specs)
+      SpecSet.new(materialized_specs)
     end
 
     # Materialize for all the specs in the spec set, regardless of what platform they're for
-    # This is in contrast to how for does platform filtering (and specifically different from how `materialize` calls `for` only for the current platform)
     # @return [Array<Gem::Specification>]
     def materialized_for_all_platforms
       @specs.map do |s|
         next s unless s.is_a?(LazySpecification)
         s.source.remote!
-        spec = s.materialize_for_installation
+        spec = s.materialize_strictly
         raise GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
         spec
       end
@@ -133,15 +127,32 @@ module Bundler
     def incomplete_for_platform?(deps, platform)
       return false if @specs.empty?
 
-      @incomplete_specs = []
+      validation_set = self.class.new(@specs)
+      validation_set.for(deps, [platform])
+
+      validation_set.incomplete_specs.any?
+    end
 
-      self.for(deps, true, [platform])
+    def missing_specs_for(dependencies)
+      materialize_dependencies(dependencies)
 
-      @incomplete_specs.any?
+      missing_specs
     end
 
     def missing_specs
-      @specs.select {|s| s.is_a?(LazySpecification) }
+      @materializations.flat_map(&:completely_missing_specs)
+    end
+
+    def partially_missing_specs
+      @materializations.flat_map(&:partially_missing_specs)
+    end
+
+    def incomplete_specs
+      @materializations.flat_map(&:incomplete_specs)
+    end
+
+    def insecurely_materialized_specs
+      materialized_specs.select(&:insecurely_materialized?)
     end
 
     def -(other)
@@ -152,12 +163,6 @@ module Bundler
       @specs.detect {|spec| spec.name == name && spec.match_platform(platform) }
     end
 
-    def specs_compatible_with(other)
-      select do |spec|
-        other.valid?(spec)
-      end
-    end
-
     def delete_by_name(name)
       @specs.reject! {|spec| spec.name == name }
 
@@ -201,6 +206,37 @@ module Bundler
 
     private
 
+    def materialize_dependencies(dependencies, platforms = [nil], skips: [])
+      handled = ["bundler"].product(platforms).map {|k| [k, true] }.to_h
+      deps = dependencies.product(platforms)
+      @materializations = []
+
+      loop do
+        break unless dep = deps.shift
+
+        dependency = dep[0]
+        platform = dep[1]
+        name = dependency.name
+
+        key = [name, platform]
+        next if handled.key?(key)
+
+        handled[key] = true
+
+        materialization = Materialization.new(dependency, platform, candidates: lookup[name])
+
+        deps.concat(materialization.dependencies) if materialization.complete?
+
+        @materializations << materialization unless skips.include?(name)
+      end
+
+      @materializations
+    end
+
+    def materialized_specs
+      @materializations.filter_map(&:materialized_spec)
+    end
+
     def reset!
       @sorted = nil
       @lookup = nil
@@ -273,17 +309,6 @@ module Bundler
       @specs.sort_by(&:name).each {|s| yield s }
     end
 
-    def specs_for_dependency(dep, platform)
-      specs_for_name = lookup[dep.name]
-      return [] unless specs_for_name
-
-      if platform
-        GemHelpers.select_best_platform_match(specs_for_name, platform, force_ruby: dep.force_ruby_platform)
-      else
-        GemHelpers.select_best_local_platform_match(specs_for_name, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
-      end
-    end
-
     def tsort_each_child(s)
       s.dependencies.sort_by(&:name).each do |d|
         next if d.type == :development

data/lib/bundler/stub_specification.rb

@@ -9,6 +9,10 @@ module Bundler
       spec
     end
 
+    def insecurely_materialized?
+      false
+    end
+
     attr_reader :checksum
     attr_accessor :stub, :ignored
 
@@ -112,6 +116,10 @@ module Bundler
       stub.raw_require_paths
     end
 
+    def inspect
+      "#<#{self.class} @name=\"#{name}\" (#{full_name.delete_prefix("#{name}-")})>"
+    end
+
     private
 
     def _remote_specification

data/lib/bundler/templates/newgem/README.md.tt

@@ -26,7 +26,7 @@ TODO: Write usage instructions here
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies.<% if config[:test] %> Then, run `rake <%= config[:test].sub('mini', '').sub('rspec', 'spec') %>` to run the tests.<% end %> You can also run `bin/console` for an interactive prompt that will allow you to experiment.<% if config[:bin] %> Run `bundle exec <%= config[:name] %>` to use the gem in this directory, ignoring other installed copies of this gem.<% end %>
+After checking out the repo, run `bin/setup` to install dependencies.<% if config[:test] %> Then, run `rake <%= config[:test_task] %>` to run the tests.<% end %> You can also run `bin/console` for an interactive prompt that will allow you to experiment.<% if config[:bin] %> Run `bundle exec <%= config[:name] %>` to use the gem in this directory, ignoring other installed copies of this gem.<% end %>
 
 To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 <% if config[:git] -%>

data/lib/bundler/uri_credentials_filter.rb

@@ -16,7 +16,7 @@ module Bundler
 
       if uri.userinfo
         # oauth authentication
-        if uri.password == "x-oauth-basic" || uri.password == "x"
+        if uri.password == "x-oauth-basic" || uri.password == "x" || uri.password.nil?
           # URI as string does not display with password if no user is set
           oauth_designation = uri.password
           uri.user = oauth_designation

data/lib/bundler/vendor/fileutils/COPYING

@@ -0,0 +1,56 @@
+Ruby is copyrighted free software by Yukihiro Matsumoto <matz@netlab.jp>.
+You can redistribute it and/or modify it under either the terms of the
+2-clause BSDL (see the file BSDL), or the conditions below:
+
+1. You may make and give away verbatim copies of the source form of the
+   software without restriction, provided that you duplicate all of the
+   original copyright notices and associated disclaimers.
+
+2. You may modify your copy of the software in any way, provided that
+   you do at least ONE of the following:
+
+   a. place your modifications in the Public Domain or otherwise
+      make them Freely Available, such as by posting said
+      modifications to Usenet or an equivalent medium, or by allowing
+      the author to include your modifications in the software.
+
+   b. use the modified software only within your corporation or
+      organization.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+3. You may distribute the software in object code or binary form,
+   provided that you do at least ONE of the following:
+
+   a. distribute the binaries and library files of the software,
+      together with instructions (in the manual page or equivalent)
+      on where to get the original distribution.
+
+   b. accompany the distribution with the machine-readable source of
+      the software.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+4. You may modify and include the part of the software into any other
+   software (possibly commercial).  But some files in the distribution
+   are not written by the author, so that they are not under these terms.
+
+   For the list of those files and their copying conditions, see the
+   file LEGAL.
+
+5. The scripts and library files supplied as input to or produced as
+   output from the software do not automatically fall under the
+   copyright of the software, but belong to whomever generated them,
+   and may be sold commercially, and may be aggregated with this
+   software.
+
+6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
+   IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+   WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+   PURPOSE.

data/lib/bundler/vendor/fileutils/lib/fileutils.rb

@@ -180,7 +180,8 @@ end
 # - {CVE-2004-0452}[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452].
 #
 module Bundler::FileUtils
-  VERSION = "1.7.2"
+  # The version number.
+  VERSION = "1.7.3"
 
   def self.private_module_function(name)   #:nodoc:
     module_function name
@@ -1651,7 +1652,7 @@ module Bundler::FileUtils
       when "a"
         mask | 07777
       else
-        raise ArgumentError, "invalid `who' symbol in file mode: #{chr}"
+        raise ArgumentError, "invalid 'who' symbol in file mode: #{chr}"
       end
     end
   end
@@ -1705,7 +1706,7 @@ module Bundler::FileUtils
             copy_mask = user_mask(chr)
             (current_mode & copy_mask) / (copy_mask & 0111) * (user_mask & 0111)
           else
-            raise ArgumentError, "invalid `perm' symbol in file mode: #{chr}"
+            raise ArgumentError, "invalid 'perm' symbol in file mode: #{chr}"
           end
         end
 
@@ -2028,21 +2029,22 @@ module Bundler::FileUtils
 
   private
 
-  module StreamUtils_
+  module StreamUtils_ # :nodoc:
+
     private
 
     case (defined?(::RbConfig) ? ::RbConfig::CONFIG['host_os'] : ::RUBY_PLATFORM)
     when /mswin|mingw/
-      def fu_windows?; true end
+      def fu_windows?; true end #:nodoc:
     else
-      def fu_windows?; false end
+      def fu_windows?; false end #:nodoc:
     end
 
     def fu_copy_stream0(src, dest, blksize = nil)   #:nodoc:
       IO.copy_stream(src, dest)
     end
 
-    def fu_stream_blksize(*streams)
+    def fu_stream_blksize(*streams) #:nodoc:
       streams.each do |s|
         next unless s.respond_to?(:stat)
         size = fu_blksize(s.stat)
@@ -2051,14 +2053,14 @@ module Bundler::FileUtils
       fu_default_blksize()
     end
 
-    def fu_blksize(st)
+    def fu_blksize(st) #:nodoc:
       s = st.blksize
       return nil unless s
       return nil if s == 0
       s
     end
 
-    def fu_default_blksize
+    def fu_default_blksize #:nodoc:
       1024
     end
   end
@@ -2503,7 +2505,7 @@ module Bundler::FileUtils
   end
   private_module_function :fu_output_message
 
-  def fu_split_path(path)
+  def fu_split_path(path) #:nodoc:
     path = File.path(path)
     list = []
     until (parent, base = File.split(path); parent == path or parent == ".")
@@ -2524,7 +2526,7 @@ module Bundler::FileUtils
   end
   private_module_function :fu_relative_components_from
 
-  def fu_clean_components(*comp)
+  def fu_clean_components(*comp) #:nodoc:
     comp.shift while comp.first == "."
     return comp if comp.empty?
     clean = [comp.shift]
@@ -2543,11 +2545,11 @@ module Bundler::FileUtils
   private_module_function :fu_clean_components
 
   if fu_windows?
-    def fu_starting_path?(path)
+    def fu_starting_path?(path) #:nodoc:
       path&.start_with?(%r(\w:|/))
     end
   else
-    def fu_starting_path?(path)
+    def fu_starting_path?(path) #:nodoc:
       path&.start_with?("/")
     end
   end

data/lib/bundler/vendor/securerandom/COPYING

@@ -0,0 +1,56 @@
+Ruby is copyrighted free software by Yukihiro Matsumoto <matz@netlab.jp>.
+You can redistribute it and/or modify it under either the terms of the
+2-clause BSDL (see the file BSDL), or the conditions below:
+
+1. You may make and give away verbatim copies of the source form of the
+   software without restriction, provided that you duplicate all of the
+   original copyright notices and associated disclaimers.
+
+2. You may modify your copy of the software in any way, provided that
+   you do at least ONE of the following:
+
+   a. place your modifications in the Public Domain or otherwise
+      make them Freely Available, such as by posting said
+      modifications to Usenet or an equivalent medium, or by allowing
+      the author to include your modifications in the software.
+
+   b. use the modified software only within your corporation or
+      organization.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+3. You may distribute the software in object code or binary form,
+   provided that you do at least ONE of the following:
+
+   a. distribute the binaries and library files of the software,
+      together with instructions (in the manual page or equivalent)
+      on where to get the original distribution.
+
+   b. accompany the distribution with the machine-readable source of
+      the software.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+4. You may modify and include the part of the software into any other
+   software (possibly commercial).  But some files in the distribution
+   are not written by the author, so that they are not under these terms.
+
+   For the list of those files and their copying conditions, see the
+   file LEGAL.
+
+5. The scripts and library files supplied as input to or produced as
+   output from the software do not automatically fall under the
+   copyright of the software, but belong to whomever generated them,
+   and may be sold commercially, and may be aggregated with this
+   software.
+
+6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
+   IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+   WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+   PURPOSE.