bundler 4.0.21 → 4.1.0.beta1

data/lib/bundler/runtime.rb

@@ -4,6 +4,8 @@ module Bundler
   class Runtime
     include SharedHelpers
 
+    PRUNE_CATEGORIES = [:cache, :git].freeze
+
     def initialize(root, definition)
       @root = root
       @definition = definition
@@ -146,7 +148,7 @@ module Bundler
         FileUtils.touch(File.expand_path("../.bundlecache", git_dir))
       end
 
-      prune_cache(cache_path) unless Bundler.settings[:no_prune]
+      prune_cache(cache_path) unless Bundler.settings[:keep_outdated_cache]
     end
 
     def prune_cache(cache_path)
@@ -164,7 +166,9 @@ module Bundler
       git_cache_dirs       = SharedHelpers.glob_files_in_dir("cache/bundler/git/*", Gem.dir)
       gem_dirs             = SharedHelpers.glob_files_in_dir("gems/*", Gem.dir)
       gem_files            = SharedHelpers.glob_files_in_dir("cache/*.gem", Gem.dir)
-      gemspec_files        = SharedHelpers.glob_files_in_dir("specifications/*.gemspec", Gem.dir)
+      gemspec_files        = Gem::SpecificationRecord.dirs_from([Gem.dir]).flat_map do |dir|
+        SharedHelpers.glob_files_in_dir("*.gemspec", dir)
+      end
       extension_dirs       = SharedHelpers.glob_files_in_dir("extensions/*/*/*", Gem.dir) + SharedHelpers.glob_files_in_dir("bundler/gems/extensions/*/*/*", Gem.dir)
       spec_gem_paths       = []
       # need to keep git sources around
@@ -229,8 +233,71 @@ module Bundler
       output
     end
 
+    # Removes the artifacts Bundler keeps for its own bookkeeping and can rebuild
+    # from the lockfile. Gem contents are never touched.
+    def prune(categories)
+      categories = expand_prune_categories(categories)
+      return if categories.empty?
+
+      # Without a bundle path the cache is shared with RubyGems, so it holds gem
+      # files Bundler never put there.
+      if Bundler.use_system_gems?
+        Bundler.ui.warn "The `prune` setting was ignored because this bundle installs into the system gem " \
+                        "directory, which Bundler shares with RubyGems. Run " \
+                        "`bundle config set --local path vendor/bundle` to prune.", wrap: true
+        return
+      end
+
+      # Git metadata first, because resolving a checkout's install path can need
+      # the mirror that pruning the cache removes.
+      prune_git_metadata if categories.include?(:git)
+      prune_download_cache if categories.include?(:cache)
+    end
+
     private
 
+    # Anything that is not a category name is read as a boolean with Bundler's
+    # usual vocabulary, so `BUNDLE_PRUNE=1` selects every category and keeps
+    # doing so as categories are added. That way a tool can set the flag without
+    # tracking this list.
+    def expand_prune_categories(categories)
+      Array(categories).flat_map do |category|
+        name = category.to_s
+        next name.to_sym if PRUNE_CATEGORIES.include?(name.to_sym)
+
+        Settings.to_bool(name) ? PRUNE_CATEGORIES : []
+      end.uniq
+    end
+
+    def prune_download_cache
+      cache_path = File.join(Bundler.bundle_path, "cache")
+      return unless File.exist?(cache_path)
+
+      Bundler.ui.info "Removing the download cache at #{cache_path}"
+      SharedHelpers.filesystem_access(cache_path) do |p|
+        FileUtils.rm_rf(p)
+      end
+    end
+
+    def prune_git_metadata
+      owned = "#{Bundler.install_path}#{File::SEPARATOR}"
+      git_dirs = @definition.sources.git_sources.reject(&:local?).filter_map do |source|
+        install_path = source.install_path.to_s
+        next unless install_path.start_with?(owned)
+
+        git_dir = File.join(install_path, ".git")
+        git_dir if File.exist?(git_dir)
+      end
+      return if git_dirs.empty?
+
+      Bundler.ui.info "Removing git metadata from checked out git gems"
+      git_dirs.each do |git_dir|
+        SharedHelpers.filesystem_access(git_dir) do |p|
+          FileUtils.rm_rf(p)
+        end
+      end
+    end
+
     def prune_gem_cache(resolve, cache_path)
       cached = SharedHelpers.glob_files_in_dir("*.gem", cache_path.to_s)
 

data/lib/bundler/self_manager.rb

@@ -30,8 +30,8 @@ module Bundler
       install_and_restart_with(restart_version)
     end
 
-    def update_bundler_and_restart_with_it_if_needed(target, pre: false)
-      spec = resolve_update_version_from(target, pre: pre)
+    def update_bundler_and_restart_with_it_if_needed(target)
+      spec = resolve_update_version_from(target)
       return unless spec
 
       version = spec.version
@@ -108,9 +108,9 @@ module Bundler
         lockfile_version
     end
 
-    def resolve_update_version_from(target, pre: false)
+    def resolve_update_version_from(target)
       requirement = Gem::Requirement.new(target)
-      update_candidate = find_latest_matching_spec(requirement, pre: pre)
+      update_candidate = find_latest_matching_spec(requirement)
 
       if update_candidate.nil?
         raise InvalidOption, "The `bundle update --bundler` target version (#{target}) does not exist"
@@ -137,24 +137,18 @@ module Bundler
       end
     end
 
-    def find_latest_matching_spec(requirement, pre: false)
+    def find_latest_matching_spec(requirement)
       Bundler.configure
-      # A bare `bundle update --bundler` must stay on releases, like `gem update
-      # --system`, so only `--pre` or a prerelease requirement opts into one.
-      allow_prerelease = pre || requirement.prerelease?
-
-      local_result = find_latest_matching_spec_from_collection(local_specs, requirement, allow_prerelease)
+      local_result = find_latest_matching_spec_from_collection(local_specs, requirement)
       return local_result if local_result && requirement.specific?
 
-      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement, allow_prerelease)
+      remote_result = find_latest_matching_spec_from_collection(remote_specs, requirement)
       return remote_result if local_result.nil?
 
-      [local_result, remote_result].compact.max
+      [local_result, remote_result].max
     end
 
-    def find_latest_matching_spec_from_collection(specs, requirement, allow_prerelease)
-      specs = specs.reject {|spec| spec.version.prerelease? } unless allow_prerelease
-
+    def find_latest_matching_spec_from_collection(specs, requirement)
       specs.sort.reverse_each.find {|spec| requirement.satisfied_by?(spec.version) }
     end
 

data/lib/bundler/settings.rb

@@ -29,8 +29,11 @@ module Bundler
       ignore_messages
       init_gems_rb
       inline
+      keep_outdated_cache
       lockfile_checksums
+      no_build_extension
       no_install
+      no_install_plugin
       no_prune
       path.system
       plugins
@@ -52,6 +55,7 @@ module Bundler
 
     ARRAY_KEYS = %w[
       only
+      prune
       with
       without
     ].freeze
@@ -60,6 +64,7 @@ module Bundler
       bin
       cache_path
       console
+      credential_store
       default_cli_command
       gem.ci
       gem.github_username
@@ -91,6 +96,14 @@ module Bundler
       "BUNDLE_UPDATE_REQUIRES_ALL_FLAG" => false,
     }.freeze
 
+    ##
+    # Settings renamed in Bundler 4, mapping the current name to the one it
+    # replaced. The old name is still read, and goes away in Bundler 5.
+
+    RENAMED_KEYS = {
+      "keep_outdated_cache" => "no_prune",
+    }.freeze
+
     def initialize(root = nil)
       @root            = root
       @local_config    = load_config(local_config_file)
@@ -107,16 +120,7 @@ module Bundler
     end
 
     def [](name)
-      key = key_for(name)
-
-      value = nil
-      configs.each do |_, config|
-        value = config[key]
-        next if value.nil?
-        break
-      end
-
-      converted_value(value, name)
+      converted_value(configured_value(name), name)
     end
 
     def set_command_option(key, value)
@@ -165,6 +169,29 @@ module Bundler
       keys
     end
 
+    ##
+    # #all plus the keys whose credential lives in the credential store. Kept
+    # apart from #all because that one is on the hot path (it is read per gem
+    # source and per download, and its keys are advertised in the User-Agent),
+    # while this one is for the commands that display settings.
+
+    def all_including_stored_credentials
+      keys = stored_credential_keys.map do |key|
+        key = key.delete_prefix("BUNDLE_")
+        key.gsub!("___", "-")
+        key.gsub!("__", ".")
+        key.downcase!
+        key
+      end
+
+      # The listing comes from the globally selected store, but a host can name
+      # its own, so keep only the keys the per-host lookup agrees are set.
+      keys.select! {|key| credential_stored?(key) }
+      keys << "cooldown" if gemrc_cooldown_days
+
+      all.union(keys).sort
+    end
+
     def local_overrides
       repos = {}
       all.each do |k|
@@ -183,6 +210,9 @@ module Bundler
     end
 
     def credentials_for(uri)
+      stored = credentials_from_store(uri)
+      return credentials_from_env(uri) || stored if stored
+
       self[uri.to_s] || self[uri.host]
     end
 
@@ -219,14 +249,62 @@ module Bundler
         locations << "Set via #{key}: #{printable_value(value, exposed_key).inspect}"
       end
 
+      if credential_stored?(exposed_key)
+        # The heading calls this a priority order, but a stored credential sits
+        # outside it and is used ahead of every config file.
+        locations << "Set in the credential store, which is used ahead of the config files"
+      end
+
       if value = @global_config[key]
         locations << "Set for the current user (#{global_config_file}): #{printable_value(value, exposed_key).inspect}"
       end
 
+      # The gemrc cooldown sits outside the priority order too. It is not one
+      # of the layers, it raises whatever they resolve to. See #cooldown_for.
+      if key == key_for(:cooldown) && (days = gemrc_cooldown_days)
+        line = "Set in the RubyGems configuration as `:cooldown:`: #{days}"
+        line += ". The longer of that and the top value applies" unless locations.empty?
+        locations << line
+      end
+
       return ["You have not configured a value for `#{exposed_key}`"] if locations.empty?
       locations
     end
 
+    ##
+    # True when +name+ has a configured value Settings#[] cannot see. A
+    # credential in the store is one, and so is the RubyGems `:cooldown:`
+    # setting that #cooldown_for raises the config layers to.
+
+    def stored_outside_config_files?(name)
+      credential_stored?(name) || (key_for(name) == key_for(:cooldown) && !gemrc_cooldown_days.nil?)
+    end
+
+    ##
+    # True when +name+'s credential lives in the credential store. The secret
+    # itself is never returned: callers only need to know the setting exists,
+    # since Settings#[] cannot see past the config files.
+
+    def credential_stored?(name)
+      raw_key = self.class.key_to_s(name)
+      return false unless credential_store_key?(raw_key)
+      return false unless store = active_credential_store(credential_host(raw_key))
+
+      !store.get(credential_account(raw_key)).nil?
+    end
+
+    ##
+    # The keys credentials are stored under, in the same encoding the config
+    # hashes use, so #all can fold them in. Empty when no store is enabled or
+    # when the backend cannot enumerate its entries, which is why
+    # bundle-config(1) warns that a third-party backend may not list.
+
+    def stored_credential_keys
+      return [] unless store = active_credential_store
+
+      Array(store.list)
+    end
+
     def processor_count
       require "etc"
       Etc.nprocessors
@@ -309,6 +387,50 @@ module Bundler
       self[:jobs] || processor_count
     end
 
+    ##
+    # The cooldown that applies to a source whose Gemfile declaration asks for
+    # +source_cooldown+ days.
+    #
+    # `--cooldown` is set as a command line option, and it wins outright so
+    # that `--cooldown 0` bypasses the cooldown however the two tools are
+    # configured. Otherwise this setting, or the per-source value when this
+    # setting is unset, is raised to RubyGems' own `:cooldown:` setting, so a
+    # cooldown configured for only one of the two tools covers both.
+
+    def cooldown_for(source_cooldown = nil)
+      command_line = @temporary[key_for(:cooldown)]
+      return converted_value(command_line, :cooldown) unless command_line.nil?
+
+      # Read raw rather than through #[], whose `to_i` would turn a value that
+      # is not a number into a 0 that suppresses `source_cooldown`.
+      configured = cooldown_settings.days(configured_value(:cooldown))
+
+      cooldown_settings.combine(configured || source_cooldown, rubygems_cooldown)
+    end
+
+    ##
+    # RubyGems' `:cooldown:` gemrc setting, read from the loaded gemrc rather
+    # than from `Gem.configuration.cooldown`, which only exists on RubyGems
+    # versions that know the setting. A value assigned to that accessor from
+    # Ruby after startup is therefore not seen here.
+    #
+    # Reading it builds Gem::ConfigFile, which costs a command that never
+    # resolves against a remote around 30ms it has no use for, so the setting
+    # is validated here, at the point of use, rather than when the command
+    # starts.
+
+    def rubygems_cooldown
+      return @rubygems_cooldown if defined?(@rubygems_cooldown)
+
+      @rubygems_cooldown = gemrc_cooldown
+
+      if cooldown_settings.invalid?(@rubygems_cooldown)
+        Bundler.ui.warn cooldown_settings.invalid_message(@rubygems_cooldown, "the gemrc file")
+      end
+
+      @rubygems_cooldown
+    end
+
     def validate!
       all.each do |raw_key|
         [@local_config, @env_config, @global_config].each do |settings|
@@ -324,6 +446,27 @@ module Bundler
 
     private
 
+    def cooldown_settings
+      require "rubygems/cooldown_settings"
+      Gem::CooldownSettings
+    end
+
+    # Scanned rather than looked up, because ConfigFile#[] stringifies the key
+    # on RubyGems 3.4 and a `:cooldown:` gemrc entry is stored under a Symbol.
+
+    def gemrc_cooldown
+      Gem.configuration.each {|key, value| return value if key.to_s == "cooldown" }
+      nil
+    end
+
+    # The gemrc cooldown as a usable number of days, or nil. A value that is
+    # not one takes no part in the resolution, so nothing reports it as
+    # configured either.
+
+    def gemrc_cooldown_days
+      cooldown_settings.days(rubygems_cooldown)
+    end
+
     def configs
       @configs ||= {
         temporary: @temporary,
@@ -338,12 +481,37 @@ module Bundler
       converted_value(config[key_for(name)], name)
     end
 
-    def parent_setting_for(name)
-      split_specific_setting_for(name)[0]
+    ##
+    # A renamed setting is resolved one level at a time rather than by looking
+    # for the current name everywhere first, so that the old name keeps the
+    # documented priority order: an old name set locally still beats a current
+    # name set globally.
+
+    def configured_value(name)
+      key = key_for(name)
+      old_name = RENAMED_KEYS[self.class.key_to_s(name)]
+      old_key = key_for(old_name) if old_name
+
+      configs.each do |_, config|
+        value = config[key]
+        return value unless value.nil?
+
+        next if old_key.nil?
+
+        value = config[old_key]
+        next if value.nil?
+
+        SharedHelpers.feature_deprecated! "The `#{old_name}` setting has been renamed to `#{name}` and will be " \
+                                          "removed in Bundler 5. Use `#{name}` instead."
+
+        return value
+      end
+
+      nil
     end
 
-    def specific_gem_for(name)
-      split_specific_setting_for(name)[1]
+    def parent_setting_for(name)
+      split_specific_setting_for(name)[0]
     end
 
     def split_specific_setting_for(name)
@@ -357,18 +525,11 @@ module Bundler
 
     def is_string(name)
       name = self.class.key_to_s(name)
-      STRING_KEYS.include?(name) || name.start_with?("local.") || name.start_with?("mirror.") || name.start_with?("build.")
+      STRING_KEYS.include?(name) || name.start_with?("local.") || name.start_with?("mirror.") || name.start_with?("build.") || name.start_with?("credential_store.")
     end
 
     def to_bool(value)
-      case value
-      when String
-        value.match?(/\A(false|f|no|n|0|)\z/i) ? false : true
-      when nil, false
-        false
-      else
-        true
-      end
+      self.class.to_bool(value)
     end
 
     def is_num(key)
@@ -387,6 +548,145 @@ module Bundler
       value.include?(":")
     end
 
+    # Kept separate from RubyGems so gem signout does not remove Bundler's
+    # host credentials.
+    CREDENTIAL_STORE_SERVICE = "bundler"
+
+    ##
+    # The Gem::CredentialStore for the spec #credential_store_spec returns,
+    # or nil when the setting is off or this RubyGems has no credential store.
+    # Guarded by a cheap lookup so reading and writing settings costs nothing
+    # extra when the setting is disabled.
+
+    def active_credential_store(host = nil)
+      spec = credential_store_spec(host)
+      return nil unless spec
+
+      store_class = credential_store_class
+      return nil unless store_class
+
+      store_class.for(spec, service: CREDENTIAL_STORE_SERVICE)
+    end
+
+    # A `credential_store.<host>` setting overrides the global one for that
+    # host only. There is no chain between backends.
+    def credential_store_spec(host = nil)
+      value = self["credential_store.#{host}"] if host
+      value = self[:credential_store] if value.nil?
+
+      # An environment variable can carry bytes String#downcase would reject.
+      normalized = value.to_s.b.downcase
+
+      # Tri-state, unlike a BOOL_KEYS setting, so #to_bool is only consulted
+      # for the false half.
+      return nil unless to_bool(normalized)
+
+      case normalized
+      when "true", "1", "yes", "on", "t", "y" then true
+      else value.to_s
+      end
+    end
+
+    def credential_store_class
+      return @credential_store_class if defined?(@credential_store_class)
+
+      @credential_store_class =
+        begin
+          require "rubygems/credential_store"
+          Gem::CredentialStore if Gem::CredentialStore.respond_to?(:for)
+        rescue LoadError
+          nil
+        end
+
+      if @credential_store_class.nil?
+        Bundler.ui.warn "The `credential_store` setting is set but this RubyGems does not provide a credential store. Falling back to the Bundler config file."
+      elsif @credential_store_class.respond_to?(:warn_handler=)
+        # Bundler replaces Gem.ui with a Gem::SilentUI subclass, which drops
+        # alert_warning, so every store warning would be lost.
+        @credential_store_class.warn_handler = ->(message) { Bundler.ui.warn(message) }
+      end
+
+      @credential_store_class
+    end
+
+    CREDENTIAL_URL_KEY = %r{\Ahttps?://}i
+    CREDENTIAL_HOST_KEY = /\A[a-z0-9-]+(\.[a-z0-9-]+)+(:\d+)?\z/i
+
+    ##
+    # True for keys that name a host and can therefore hold a credential,
+    # like the ones set via `bundle config set gems.example.com user:pass`.
+    # Deliberately a positive test: a key this version does not recognize
+    # stays in the config file, where Settings#[] can read it back. Matching
+    # everything not on the known-settings lists would send values such as
+    # `ssl_client_cert` to the credential store, and they would then read
+    # back as nil because only #credentials_for consults the store.
+
+    def credential_store_key?(raw_key)
+      return false if is_bool(raw_key) || is_num(raw_key) || is_array(raw_key) || is_string(raw_key) || is_credential(raw_key)
+
+      CREDENTIAL_URL_KEY.match?(raw_key) || CREDENTIAL_HOST_KEY.match?(raw_key)
+    end
+
+    def remove_from_store(store, key)
+      unless store.available?
+        Bundler.ui.warn "The credential store is enabled but unavailable, so any credential it holds was left in place."
+        return true
+      end
+
+      store.delete(key)
+    end
+
+    # A write clears the plaintext only from the config file it targets, so a
+    # copy in the other scope comes back into use once the setting is off.
+    def warn_plaintext_in_other_scope(raw_key, key, hash)
+      other, other_file =
+        if hash.equal?(@local_config)
+          [@global_config, global_config_file]
+        else
+          [@local_config, @local_root.join("config")]
+        end
+
+      return unless other.key?(key)
+
+      # Deliberately not `bundle config unset`, which would clear the store as
+      # well and throw away the credential this write moved into it.
+      safe_key = self.class.remove_userinfo(raw_key)
+      Bundler.ui.warn "The credential for #{safe_key} moved into the credential store, but a plain text copy" \
+                      " remains in #{other_file}. Delete the #{key_for(safe_key)} entry from that file to finish the move."
+    end
+
+    def warn_unremoved_credential(raw_key)
+      Bundler.ui.warn "Could not remove the credential for #{self.class.remove_userinfo(raw_key)} from the credential store." \
+                      " It is still there. Remove it with your platform's credential manager."
+    end
+
+    # See Gem::ConfigFile.credential_store_account for why userinfo is dropped.
+    def credential_account(raw_key)
+      key_for(self.class.remove_userinfo(raw_key))
+    end
+
+    def credential_host(raw_key)
+      return raw_key unless CREDENTIAL_URL_KEY.match?(raw_key)
+
+      require_relative "vendored_uri"
+      Gem::URI(raw_key).host || raw_key
+    rescue Gem::URI::Error
+      raw_key
+    end
+
+    # The store stands in for the config file, so it must not override the
+    # environment, which already overrides that file. Consulted only when the
+    # store answered, so the layer order without a store is unchanged.
+    def credentials_from_env(uri)
+      @env_config[key_for(uri.to_s)] || @env_config[key_for(uri.host)]
+    end
+
+    def credentials_from_store(uri)
+      return nil unless store = active_credential_store(uri.host)
+
+      store.get(credential_account(uri.to_s)) || store.get(credential_account(uri.host))
+    end
+
     def to_array(value)
       return [] unless value
       value.tr(" ", ":").split(":").map(&:to_sym)
@@ -400,9 +700,29 @@ module Bundler
 
     def set_key(raw_key, value, hash, file)
       raw_key = self.class.key_to_s(raw_key)
-      value = array_to_s(value) if is_array(raw_key)
-
       key = key_for(raw_key)
+      account = credential_account(raw_key)
+
+      # #temporary passes a nil file, and storing its value would outlive the
+      # block while its restore pass deleted the real entry.
+      if file && credential_store_key?(raw_key) && (store = active_credential_store(credential_host(raw_key)))
+        if value.nil?
+          warn_unremoved_credential(raw_key) unless remove_from_store(store, account)
+        elsif value.is_a?(String) && is_userinfo(value)
+          if store.set(account, value)
+            value = nil
+            warn_plaintext_in_other_scope(raw_key, key, hash)
+          else
+            warn_unremoved_credential(raw_key) if store.available? && !store.delete(account)
+            Bundler.ui.warn "Could not write the credential for #{self.class.remove_userinfo(raw_key)} to the credential store," \
+                            " so it was written to #{file} in plain text."
+          end
+        else
+          warn_unremoved_credential(raw_key) unless remove_from_store(store, account)
+        end
+      end
+
+      value = array_to_s(value) if is_array(raw_key)
 
       return if hash[key] == value
 
@@ -482,7 +802,7 @@ module Bundler
       SharedHelpers.filesystem_access(config_file, :read) do |file|
         valid_file = file.exist? && !file.size.zero?
         return {} unless valid_file
-        serializer_class.load(file.read).inject({}) do |config, (k, v)|
+        (serializer_class.load(file.read) || {}).inject({}) do |config, (k, v)|
           k = k.dup
           k << "/" if /https?:/i.match?(k) && !k.end_with?("/", "__#{FALLBACK_TIMEOUT_URI_OPTION.upcase}")
           k.gsub!(".", "__")
@@ -506,12 +826,10 @@ module Bundler
     end
 
     def serializer_class
+      # The Bundler gem ships its own copy of Gem::YAMLSerializer, so this
+      # resolves even on RubyGems versions that predate it.
       require "rubygems/yaml_serializer"
       Gem::YAMLSerializer
-    rescue LoadError
-      # TODO: Remove this when RubyGems 3.4 is EOL
-      require_relative "yaml_serializer"
-      YAMLSerializer
     end
 
     FALLBACK_TIMEOUT_URI_OPTION = "fallback_timeout"
@@ -525,6 +843,17 @@ module Bundler
         \z
       /ix
 
+    def self.to_bool(value)
+      case value
+      when String
+        value.match?(/\A(false|f|no|n|0|)\z/i) ? false : true
+      when nil, false
+        false
+      else
+        true
+      end
+    end
+
     def self.key_for(key)
       key = key_to_s(key)
       key = normalize_uri(key) if key.start_with?("http", "mirror.http")
@@ -535,6 +864,20 @@ module Bundler
       key.gsub(/\A([ #]*)/, '\1BUNDLE_')
     end
 
+    def self.remove_userinfo(key)
+      return key unless CREDENTIAL_URL_KEY.match?(key)
+
+      require_relative "vendored_uri"
+      uri = Gem::URI(key)
+      return key unless uri.userinfo
+
+      uri = uri.dup
+      uri.user = uri.password = nil
+      uri.to_s
+    rescue Gem::URI::Error
+      key
+    end
+
     # TODO: duplicates Rubygems#normalize_uri
     # TODO: is this the correct place to validate mirror URIs?
     def self.normalize_uri(uri)

data/lib/bundler/shared_helpers.rb

@@ -105,7 +105,8 @@ module Bundler
     def filesystem_access(path, action = :write, &block)
       yield(path.dup)
     rescue Errno::EACCES => e
-      raise unless e.message.include?(path.to_s) || action == :create
+      path_basename = File.basename(path.to_s)
+      raise unless e.message.include?(path_basename) || action == :create
 
       raise PermissionError.new(path, action)
     rescue Errno::EAGAIN