bundler 4.0.21 → 4.1.0.beta1

data/lib/bundler/plugin.rb

@@ -18,6 +18,14 @@ module Bundler
 
     PLUGIN_FILE_NAME = "plugins.rb"
 
+    # Module-level flag set while .gemfile_install parses the Gemfile and
+    # consulted by .from_lock to substitute plugin sources with
+    # UnloadedSource. It relies on definitions being built one at a time in
+    # a single thread; if they are ever built concurrently or reentrantly,
+    # this needs to be replaced by explicit state passed down to the
+    # lockfile parser.
+    @gemfile_parse = false
+
     module_function
 
     def reset!
@@ -27,6 +35,7 @@ module Bundler
       @commands = {}
       @hooks_by_event = Hash.new {|h, k| h[k] = [] }
       @loaded_plugin_names = []
+      @index = nil
     end
 
     reset!
@@ -41,7 +50,7 @@ module Bundler
 
       specs = Installer.new.install(names, options)
 
-      save_plugins names, specs
+      save_plugins specs.slice(*names)
     rescue PluginError
       specs_to_delete = specs.select {|k, _v| names.include?(k) && !index.commands.values.include?(k) }
       specs_to_delete.each_value {|spec| Bundler.rm_rf(spec.full_gem_path) }
@@ -101,29 +110,44 @@ module Bundler
     #
     # @param [Pathname] gemfile path
     # @param [Proc] block that can be evaluated for (inline) Gemfile
-    def gemfile_install(gemfile = nil, &inline)
-      Bundler.settings.temporary(frozen: false, deployment: false) do
-        builder = DSL.new
-        if block_given?
-          builder.instance_eval(&inline)
-        else
-          builder.eval_gemfile(gemfile)
-        end
-        builder.check_primary_source_safety
-        definition = builder.to_definition(nil, true)
-
-        return if definition.dependencies.empty?
+    def gemfile_install(gemfile = nil, lockfile = nil, unlock = {}, &inline)
+      @gemfile_parse = true
+      Bundler.configure
+      builder = DSL.new
+      if block_given?
+        builder.instance_eval(&inline)
+      else
+        builder.eval_gemfile(gemfile)
+      end
+      builder.check_primary_source_safety
 
-        plugins = definition.dependencies.map(&:name)
-        installed_specs = Installer.new.install_definition(definition)
+      plugins = builder.dependencies.map(&:name)
+      return if plugins.empty?
 
-        save_plugins plugins, installed_specs, builder.inferred_plugins
+      # skip the update if unlocking specific gems, but none of them are plugins
+      # declared in the Gemfile
+      if unlock.is_a?(Hash) && unlock[:gems] && !unlock[:gems].empty? &&
+         (unlock[:gems] & plugins).empty?
+        unlock = {}
       end
+
+      # resolve remotely when unlocking, so that plugins can be updated.
+      # Definition#initialize consumes the unlock hash, so this must be decided
+      # before building the definition.
+      updating = unlock == true || (unlock.is_a?(Hash) && !unlock.empty?)
+
+      definition = builder.to_definition(lockfile, unlock)
+
+      installed_specs = Installer.new.install_definition(definition, updating)
+
+      save_plugins installed_specs.slice(*plugins), builder.inferred_plugins
     rescue RuntimeError => e
       unless e.is_a?(GemfileError)
         Bundler.ui.error "Failed to install plugin: #{e.message}\n  #{e.backtrace[0]}"
       end
       raise
+    ensure
+      @gemfile_parse = false
     end
 
     # The index object used to store the details about the plugin
@@ -184,12 +208,17 @@ module Bundler
 
     # Checks if any plugin declares the source
     def source?(name)
-      !index.source_plugin(name.to_s).nil?
+      !!source_plugin(name)
+    end
+
+    # Returns the plugin that handles the source +name+ if any
+    def source_plugin(name)
+      index.source_plugin(name.to_s)
     end
 
     # @return [Class] that handles the source. The class includes API::Source
     def source(name)
-      raise UnknownSourceError, "Source #{name} not found" unless source? name
+      raise UnknownSourceError, "Source #{name} not found" unless source_plugin(name)
 
       load_plugin(index.source_plugin(name)) unless @sources.key? name
 
@@ -201,6 +230,9 @@ module Bundler
     #                       type passed in locked_opts
     def from_lock(locked_opts)
       opts = locked_opts.merge("uri" => locked_opts["remote"])
+      # when reading the lockfile while doing the plugin-install-from-gemfile phase,
+      # we need to ignore any plugin sources
+      return UnloadedSource.new(opts) if @gemfile_parse
       # use an inert placeholder when the plugin handling this source is not
       # installed, so that the lockfile can still be parsed
       return UnloadedSource.new(opts) unless source?(locked_opts["type"])
@@ -243,7 +275,9 @@ module Bundler
     #
     # @return [String, nil] installed path
     def installed?(plugin)
-      Index.new.installed?(plugin)
+      (path = index.installed?(plugin)) &&
+        index.plugin_path(plugin).join(PLUGIN_FILE_NAME).file? &&
+        path
     end
 
     # @return [true, false] whether the plugin is loaded
@@ -253,19 +287,11 @@ module Bundler
 
     # Post installation processing and registering with index
     #
-    # @param [Array<String>] plugins list to be installed
     # @param [Hash] specs of plugins mapped to installation path (currently they
     #               contain all the installed specs, including plugins)
     # @param [Array<String>] names of inferred source plugins that can be ignored
-    def save_plugins(plugins, specs, optional_plugins = [])
-      plugins.each do |name|
-        spec = specs[name]
-
-        # It's possible that the `plugin` found in the Gemfile don't appear in the specs. For instance when
-        # calling `BUNDLE_WITHOUT=default bundle install`, the plugins will not get installed.
-        next if spec.nil?
-        next if index.up_to_date?(spec)
-
+    def save_plugins(specs, optional_plugins = [])
+      specs.each do |name, spec|
         save_plugin(name, spec, optional_plugins.include?(name))
       end
     end
@@ -290,6 +316,8 @@ module Bundler
     #
     # @raise [PluginInstallError] if validation or registration raises any error
     def save_plugin(name, spec, optional_plugin = false)
+      return if index.up_to_date?(spec)
+
       validate_plugin! Pathname.new(spec.full_gem_path)
       installed = register_plugin(name, spec, optional_plugin)
       Bundler.ui.info "Installed plugin #{name}" if installed
@@ -325,7 +353,7 @@ module Bundler
         raise MalformattedPlugin, "#{e.class}: #{e.message}"
       end
 
-      if optional_plugin && @sources.keys.any? {|s| source? s }
+      if optional_plugin && @sources.keys.any? {|s| source_plugin(s) }
         Bundler.rm_rf(path)
         false
       else

data/lib/bundler/remote_specification.rb

@@ -10,11 +10,11 @@ module Bundler
     include MatchPlatform
     include Comparable
 
-    attr_reader :name, :version, :platform
+    attr_reader :name, :version, :platform, :content_address
     attr_writer :dependencies
     attr_accessor :source, :remote, :locked_platform, :created_at
 
-    def initialize(name, version, platform, spec_fetcher)
+    def initialize(name, version, platform, spec_fetcher, content_address: nil)
       @name         = name
       @version      = Gem::Version.create version
       @original_platform = platform || Gem::Platform::RUBY
@@ -22,6 +22,7 @@ module Bundler
       @spec_fetcher = spec_fetcher
       @dependencies = nil
       @locked_platform = nil
+      @content_address = content_address
     end
 
     def insecurely_materialized?
@@ -35,7 +36,9 @@ module Bundler
     end
 
     def full_name
-      @full_name ||= if @platform == Gem::Platform::RUBY
+      @full_name ||= if Gem::ContentAddress.content_addressed?(self, validate_ruby_abi: false)
+        "#{@name}-#{@version}-#{@content_address}"
+      elsif @platform == Gem::Platform::RUBY
         "#{@name}-#{@version}"
       else
         "#{@name}-#{@version}-#{@platform}"

data/lib/bundler/resolver/base.rb

@@ -5,9 +5,10 @@ require_relative "package"
 module Bundler
   class Resolver
     class Base
-      attr_reader :packages, :requirements, :source_requirements, :locked_specs
+      attr_reader :packages, :requirements, :source_requirements, :locked_specs, :overrides
 
       def initialize(source_requirements, dependencies, base, platforms, options)
+        @overrides = options.delete(:overrides) || []
         @explicit_unlocks = options.delete(:explicit_unlocks) || []
         @source_requirements = source_requirements
         @locked_specs = options[:locked_specs]

data/lib/bundler/resolver/incompatibility.rb

@@ -2,7 +2,7 @@
 
 module Bundler
   class Resolver
-    class Incompatibility < PubGrub::Incompatibility
+    class Incompatibility < Gem::PubGrub::Incompatibility
       attr_reader :extended_explanation
 
       def initialize(terms, cause:, custom_explanation: nil, extended_explanation: nil)

data/lib/bundler/resolver.rb

@@ -70,7 +70,9 @@ module Bundler
 
       @cached_dependencies = Hash.new do |dependencies, package|
         dependencies[package] = Hash.new do |versions, version|
-          versions[version] = to_dependency_hash(version.dependencies.reject {|d| d.name == package.name }, @packages)
+          deps = version.dependencies.reject {|d| d.name == package.name }
+          deps = apply_metadata_overrides(deps, package.name)
+          versions[version] = to_dependency_hash(deps, @packages)
         end
       end
 
@@ -83,13 +85,14 @@ module Bundler
     end
 
     def solve_versions(root:, logger:)
-      solver = PubGrub::VersionSolver.new(source: self, root: root, strategy: Strategy.new(self), logger: logger)
+      solver = Gem::PubGrub::VersionSolver.new(source: self, root: root, strategy: Strategy.new(self), logger: logger)
       result = solver.solve
       resolved_specs = result.flat_map {|package, version| version.to_specs(package, @most_specific_locked_platform) }
+      Override.attach(resolved_specs, @base.overrides)
       spec_set = SpecSet.new(resolved_specs).specs_with_additional_variants_from(@base.locked_specs)
       @cooldown_skipped = cooldown_skipped_summary(spec_set)
       spec_set
-    rescue PubGrub::SolveFailure => e
+    rescue Gem::PubGrub::SolveFailure => e
       incompatibility = e.incompatibility
 
       names_to_unlock, names_to_allow_prereleases_for, names_to_allow_remote_specs_for, extended_explanation = find_names_to_relax(incompatibility)
@@ -128,9 +131,25 @@ module Bundler
         explanation << extended_explanation
       end
 
+      override_summary = override_diagnostic_summary
+      explanation << override_summary if override_summary
+
       raise SolveFailure.new(explanation)
     end
 
+    def override_diagnostic_summary
+      return nil if @base.overrides.empty?
+
+      lines = ["Bundler applied the following overrides while resolving:"]
+      @base.overrides.each do |override|
+        target = override.target == :all ? ":all" : override.target.inspect
+        location = override.source_location_label
+        lines << "  override #{target}, #{override.field}: #{override.operation.inspect}" \
+          "#{location ? " (declared at #{location})" : ""}"
+      end
+      "\n\n#{lines.join("\n")}"
+    end
+
     def find_names_to_relax(incompatibility)
       names_to_unlock = []
       names_to_allow_prereleases_for = []
@@ -153,7 +172,7 @@ module Bundler
             names_to_allow_remote_specs_for << name
           end
 
-          no_versions_incompat = [cause.incompatibility, cause.satisfier].find {|incompat| incompat.cause.is_a?(PubGrub::Incompatibility::NoVersions) }
+          no_versions_incompat = [cause.incompatibility, cause.satisfier].find {|incompat| incompat.cause.is_a?(Gem::PubGrub::Incompatibility::NoVersions) }
           next unless no_versions_incompat
 
           extended_explanation = no_versions_incompat.extended_explanation
@@ -165,12 +184,12 @@ module Bundler
 
     def parse_dependency(package, dependency)
       range = if repository_for(package).is_a?(Source::Gemspec)
-        PubGrub::VersionRange.any
+        Gem::PubGrub::VersionRange.any
       else
         requirement_to_range(dependency)
       end
 
-      PubGrub::VersionConstraint.new(package, range: range)
+      Gem::PubGrub::VersionConstraint.new(package, range: range)
     end
 
     def versions_for(package, range = VersionRange.any)
@@ -178,7 +197,7 @@ module Bundler
     end
 
     def no_versions_incompatibility_for(package, unsatisfied_term)
-      cause = PubGrub::Incompatibility::NoVersions.new(unsatisfied_term)
+      cause = Gem::PubGrub::Incompatibility::NoVersions.new(unsatisfied_term)
       name = package.name
       constraint = unsatisfied_term.constraint
       constraint_string = constraint.constraint_string
@@ -239,24 +258,24 @@ module Bundler
             sorted_versions[high]
           end
 
-        range = PubGrub::VersionRange.new(min: low, max: high, include_min: !low.nil?)
+        range = Gem::PubGrub::VersionRange.new(min: low, max: high, include_min: !low.nil?)
 
-        self_constraint = PubGrub::VersionConstraint.new(package, range: range)
+        self_constraint = Gem::PubGrub::VersionConstraint.new(package, range: range)
 
-        dep_term = PubGrub::Term.new(dep_constraint, false)
-        self_term = PubGrub::Term.new(self_constraint, true)
+        dep_term = Gem::PubGrub::Term.new(dep_constraint, false)
+        self_term = Gem::PubGrub::Term.new(self_constraint, true)
 
         custom_explanation = if dep_package.meta? && package.root?
           "current #{dep_package} version is #{dep_constraint.constraint_string}"
         end
 
-        PubGrub::Incompatibility.new([self_term, dep_term], cause: :dependency, custom_explanation: custom_explanation)
+        Gem::PubGrub::Incompatibility.new([self_term, dep_term], cause: :dependency, custom_explanation: custom_explanation)
       end
     end
 
     def all_versions_for(package)
       name = package.name
-      results = (@base[name] + filter_specs(@all_specs[name], package)).uniq {|spec| [spec.version.hash, spec.platform] }
+      results = (@base[name] + filter_specs(@all_specs[name], package)).uniq {|spec| [spec.version.hash, spec.platform, spec.content_address] }
 
       if name == "bundler" && !bundler_pinned_to_current_version?
         bundler_spec = Gem.loaded_specs["bundler"]
@@ -294,11 +313,15 @@ module Bundler
           next groups if package.force_ruby_platform?
         end
 
-        platform_group = Resolver::SpecGroup.new(platform_specs.flatten.uniq)
+        platform_specs = platform_specs.flatten.uniq
+        platform_group = Resolver::SpecGroup.new((platform_specs + ruby_specs).uniq)
         next groups if platform_group == ruby_group
 
         groups << Resolver::Candidate.new(version, group: platform_group, priority: 1)
 
+        platform_only_group = Resolver::SpecGroup.new(platform_specs)
+        groups << Resolver::Candidate.new(version, group: platform_only_group, priority: 0) unless platform_only_group == platform_group
+
         groups
       end
     end
@@ -446,9 +469,9 @@ module Bundler
     def cooldown_excluded?(spec)
       return false unless spec.respond_to?(:created_at) && spec.created_at
       return false unless spec.respond_to?(:remote) && spec.remote
-      return false if locked_by_lockfile?(spec)
       days = spec.remote.effective_cooldown
       return false if days.nil? || days <= 0
+      return false if locked_by_lockfile?(spec)
       (cooldown_now - spec.created_at) < (days * 86_400)
     end
 
@@ -602,19 +625,19 @@ module Bundler
         when "~>"
           name = "~> #{ver}"
           bump = Resolver::Candidate.new(version.bump.to_s + ".A")
-          PubGrub::VersionRange.new(name: name, min: ver, max: bump, include_min: true)
+          Gem::PubGrub::VersionRange.new(name: name, min: ver, max: bump, include_min: true)
         when ">"
-          PubGrub::VersionRange.new(min: platform_ver)
+          Gem::PubGrub::VersionRange.new(min: platform_ver)
         when ">="
-          PubGrub::VersionRange.new(min: ver, include_min: true)
+          Gem::PubGrub::VersionRange.new(min: ver, include_min: true)
         when "<"
-          PubGrub::VersionRange.new(max: ver)
+          Gem::PubGrub::VersionRange.new(max: ver)
         when "<="
-          PubGrub::VersionRange.new(max: platform_ver, include_max: true)
+          Gem::PubGrub::VersionRange.new(max: platform_ver, include_max: true)
         when "="
-          PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true)
+          Gem::PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true)
         when "!="
-          PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true).invert
+          Gem::PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true).invert
         else
           raise "bad version specifier: #{op}"
         end
@@ -624,7 +647,7 @@ module Bundler
     end
 
     def to_dependency_hash(dependencies, packages)
-      dependencies.inject({}) do |deps, dep|
+      apply_overrides(dependencies).inject({}) do |deps, dep|
         package = packages[dep.name]
 
         current_req = deps[package]
@@ -640,6 +663,33 @@ module Bundler
       end
     end
 
+    def apply_overrides(dependencies)
+      return dependencies if @base.overrides.empty?
+
+      dependencies.map do |dep|
+        override = Override.find_for(@base.overrides, dep.name, :version)
+        next dep unless override
+        Gem::Dependency.new(dep.name, override.apply_to(dep.requirement))
+      end
+    end
+
+    METADATA_DEP_FIELD = {
+      "Ruby\0" => :required_ruby_version,
+      "RubyGems\0" => :required_rubygems_version,
+    }.freeze
+
+    def apply_metadata_overrides(dependencies, name)
+      return dependencies if @base.overrides.empty?
+
+      dependencies.map do |dep|
+        field = METADATA_DEP_FIELD[dep.name]
+        next dep unless field
+        override = Override.find_for(@base.overrides, name, field)
+        next dep unless override
+        Gem::Dependency.new(dep.name, override.apply_to(dep.requirement))
+      end
+    end
+
     def bundler_not_found_message(conflict_dependencies)
       candidate_specs = filter_matching_specs(default_bundler_source.specs.search("bundler"), conflict_dependencies)
 

data/lib/bundler/ruby_version.rb

@@ -96,8 +96,6 @@ module Bundler
         [:version, versions_string(versions), versions_string(other.versions)]
       elsif @input_engine && !matches?(engine_versions, other.engine_gem_version)
         [:engine_version, versions_string(engine_versions), versions_string(other.engine_versions)]
-      elsif patchlevel && (!patchlevel.is_a?(String) || !other.patchlevel.is_a?(String) || !matches?(patchlevel, other.patchlevel))
-        [:patchlevel, patchlevel, other.patchlevel]
       end
     end
 

data/lib/bundler/rubygems_ext.rb

@@ -13,7 +13,53 @@ require "rubygems" unless defined?(Gem)
 # `Gem::Source` from the redefined `Gem::Specification#source`.
 require "rubygems/source"
 
+# Can be removed once RubyGems 4.0.0 support is dropped
+unless Gem::BasicSpecification.method_defined?(:content_address)
+  Gem::BasicSpecification.attr_accessor :content_address
+end
+
+# Can be removed once RubyGems 4.0.0 support is dropped
+unless Gem::NameTuple.method_defined?(:content_address)
+  Gem::NameTuple.attr_reader :content_address
+end
+
 module Gem
+  # Can be removed once RubyGems 4.0.0 support is dropped
+  unless defined?(Gem::ContentAddress)
+    module ContentAddress
+      def self.match?(token)
+        false
+      end
+
+      def self.eligible?(spec, validate_ruby_abi: true)
+        false
+      end
+
+      def self.content_addressed?(spec, validate_ruby_abi: true)
+        false
+      end
+
+      def self.content_addressed_row?(suffix, platform, required_ruby_version = nil, validate_ruby_abi: true)
+        false
+      end
+    end
+  end
+
+  # Can be removed once RubyGems 4.0.0 support is dropped
+  class SpecificationRecord
+    unless respond_to?(:specification_dir_for)
+      def self.specification_dir_for(spec, base_dir)
+        File.join(base_dir, "specifications")
+      end
+    end
+
+    unless respond_to?(:dirs_from)
+      def self.dirs_from(paths)
+        paths.map {|path| File.join(path, "specifications") }
+      end
+    end
+  end
+
   # Can be removed once RubyGems 3.5.11 support is dropped
   unless Gem.respond_to?(:freebsd_platform?)
     def self.freebsd_platform?
@@ -235,6 +281,20 @@ module Gem
       end
     end
 
+    alias_method :rg_build_info_dir, :build_info_dir
+    def build_info_dir
+      # A git checkout's build logs belong with that checkout's extension build.
+      # base_dir points at the directory holding every checkout, so logs keyed by
+      # full_name would collide between revisions of the same gem and would sit
+      # outside anything `bundle clean` prunes. extension_dir is unique per
+      # revision and goes away with the checkout.
+      if source.respond_to?(:extension_dir_name)
+        extension_dir
+      else
+        rg_build_info_dir
+      end
+    end
+
     # Can be removed once RubyGems 3.5.21 support is dropped
     remove_method :gem_dir if method_defined?(:gem_dir, false)
 
@@ -417,7 +477,8 @@ module Gem
     unless Gem::NameTuple.new("a", Gem::Version.new("1"), Gem::Platform.new("x86_64-linux")).platform.is_a?(String)
       alias_method :initialize_with_platform, :initialize
 
-      def initialize(name, version, platform = Gem::Platform::RUBY)
+      def initialize(name, version, platform = Gem::Platform::RUBY, content_address = nil)
+        @content_address = content_address
         if Gem::Platform === platform
           initialize_with_platform(name, version, platform.to_s)
         else
@@ -426,6 +487,15 @@ module Gem
       end
     end
 
+    unless instance_method(:initialize).parameters.any? {|kind, name| kind == :key && name == :content_address }
+      alias_method :initialize_without_content_address, :initialize
+
+      def initialize(name, version, platform = Gem::Platform::RUBY, content_address: nil)
+        initialize_without_content_address(name, version, platform)
+        @content_address = content_address
+      end
+    end
+
     def lock_name
       if platform == Gem::Platform::RUBY
         "#{name} (#{version})"

data/lib/bundler/rubygems_gem_installer.rb

@@ -4,6 +4,11 @@ require "rubygems/installer"
 
 module Bundler
   class RubyGemsGemInstaller < Gem::Installer
+    # Can be removed once RubyGems 4.0.0 support is dropped
+    unless private_method_defined?(:assign_content_address)
+      private def assign_content_address; end
+    end
+
     # Cap how many jobserver slots a single gem's `make` may grab so that one
     # gem with many recipes doesn't starve the others sharing the pool. Beyond
     # a handful of jobs the extra parallelism rarely pays off in practice.
@@ -14,6 +19,8 @@ module Bundler
     end
 
     def install
+      assign_content_address
+
       pre_install_checks
 
       run_pre_install_hooks
@@ -32,7 +39,11 @@ module Bundler
         extract_files
       end
 
-      build_extensions if spec.extensions.any?
+      if options[:build_extension] == false
+        warn_skipped_extensions
+      elsif spec.extensions.any?
+        build_extensions
+      end
       write_build_info_file
       run_post_build_hooks
 
@@ -40,7 +51,12 @@ module Bundler
         generate_bin
       end
 
-      generate_plugins
+      if options[:install_plugin] == false
+        remove_stale_plugins
+        warn_skipped_plugins
+      else
+        generate_plugins
+      end
 
       write_spec
 
@@ -85,6 +101,29 @@ module Bundler
       end
     end
 
+    # Reimplemented from RubyGems, since RubyGems older than 4.1 doesn't
+    # provide it
+    def remove_stale_plugins
+      return unless spec.plugins.empty?
+
+      ensure_writable_dir @plugins_dir
+      remove_plugins_for(spec, @plugins_dir)
+    end
+
+    def warn_skipped_extensions
+      return if spec.extensions.empty?
+
+      Bundler.ui.warn "#{spec.full_name} contains native extensions that were not built.\n" \
+                      "To build extensions, unset no_build_extension and run `bundle pristine #{spec.name}`."
+    end
+
+    def warn_skipped_plugins
+      return if spec.plugins.empty?
+
+      Bundler.ui.warn "#{spec.full_name} contains plugins that were not installed.\n" \
+                      "To install plugins, unset no_install_plugin and run `bundle pristine #{spec.name}`."
+    end
+
     if Bundler.rubygems.provides?("< 3.5.19")
       def generate_bin_script(filename, bindir)
         bin_script_path = File.join bindir, formatted_program_filename(filename)

data/lib/bundler/rubygems_integration.rb

@@ -111,7 +111,7 @@ module Bundler
 
     def spec_cache_dirs
       @spec_cache_dirs ||= begin
-        dirs = gem_path.map {|dir| File.join(dir, "specifications") }
+        dirs = gem_path.flat_map {|dir| Gem::SpecificationRecord.dirs_from([dir]) }
         dirs << Gem.spec_cache_dir
         dirs.uniq.select {|dir| File.directory? dir }
       end
@@ -144,7 +144,12 @@ module Bundler
 
     def spec_from_gem(path)
       require "rubygems/package"
-      Gem::Package.new(path).spec
+      package = Gem::Package.new(path)
+      spec = package.spec
+      if package.respond_to?(:content_address)
+        spec.content_address = package.content_address
+      end
+      spec
     end
 
     def build_gem(gem_dir, spec)