bundler 4.0.22 → 4.1.0.beta2

data/lib/bundler/endpoint_specification.rb

@@ -5,24 +5,33 @@ module Bundler
   class EndpointSpecification < Gem::Specification
     include MatchRemoteMetadata
 
-    attr_reader :name, :version, :platform, :checksum, :created_at
+    attr_reader :name, :version, :platform, :checksum, :created_at, :content_address
     attr_writer :dependencies
     attr_accessor :remote, :locked_platform
 
-    def initialize(name, version, platform, spec_fetcher, dependencies, metadata = nil)
+    def initialize(name, version, suffix, spec_fetcher, dependencies, metadata = nil)
       super()
       @name         = name
       @version      = Gem::Version.create version
-      @platform     = Gem::Platform.new(platform)
       @spec_fetcher = spec_fetcher
       @dependencies = nil
       @unbuilt_dependencies = dependencies
+      @content_address = nil
+      @required_platform = nil
 
       @loaded_from          = nil
       @remote_specification = nil
       @locked_platform = nil
 
       parse_metadata(metadata)
+
+      if Gem::ContentAddress.content_addressed_row?(suffix, @required_platform, @required_ruby_version)
+        @content_address = suffix
+        @platform = @required_platform
+        @required_rubygems_version ||= Gem::Requirement.default
+      else
+        @platform = Gem::Platform.new(suffix)
+      end
     end
 
     def insecurely_materialized?
@@ -147,18 +156,21 @@ module Bundler
     private
 
     def _remote_specification
-      @_remote_specification ||= @spec_fetcher.fetch_spec([@name, @version, @platform])
+      suffix = @content_address || @platform
+      @_remote_specification ||= @spec_fetcher.fetch_spec([@name, @version, suffix])
     end
 
     def local_specification_path
-      "#{base_dir}/specifications/#{full_name}.gemspec"
+      File.join(Gem::SpecificationRecord.specification_dir_for(self, base_dir),
+                "#{full_name}.gemspec")
     end
 
     def parse_metadata(data)
+      @created_at = nil
+
       unless data
         @required_ruby_version = nil
         @required_rubygems_version = nil
-        @created_at = nil
         return
       end
 
@@ -181,22 +193,47 @@ module Bundler
         when "ruby"
           @required_ruby_version = Gem::Requirement.new(v)
         when "created_at"
-          value = v.is_a?(Array) ? v.last : v
-          if value.is_a?(String)
-            @created_at = begin
-              Time.new(value)
-            rescue ArgumentError
-              nil
-            end
-          end
+          @created_at = parse_created_at(v.is_a?(Array) ? v.last : v)&.freeze
+        when "platform"
+          @required_platform = required_platform_from(Array(v).last)
         end
       end
     rescue StandardError => e
       raise GemspecError, "There was an error parsing the metadata for the gem #{name} (#{version}): #{e.class}\n#{e}\nThe metadata was #{data.inspect}"
     end
 
+    # Matches an ISO 8601 time zone designator at the end of a timestamp.
+    TIME_ZONE_SUFFIX = /(?:Z|z|[+-]\d{2}(?::?\d{2})?)\z/
+    private_constant :TIME_ZONE_SUFFIX
+
+    # See Gem::Cooldown::FOUR_DIGIT_YEAR.
+    FOUR_DIGIT_YEAR = /\A\d{4}-/
+    private_constant :FOUR_DIGIT_YEAR
+
+    # A timestamp without a time zone offset is read as UTC, because reading
+    # it as local time would shift the cooldown window by the environment's
+    # offset. Unparsable values and years outside four digits become nil so
+    # the cooldown fails open.
+    def parse_created_at(value)
+      return unless value.is_a?(String) && value.match?(FOUR_DIGIT_YEAR)
+
+      require "time"
+      begin
+        Time.iso8601(value.match?(TIME_ZONE_SUFFIX) ? value : "#{value}Z")
+      rescue ArgumentError
+        nil
+      end
+    end
+
     def build_dependency(name, requirements)
       Dependency.new(name, requirements)
     end
+
+    def required_platform_from(value)
+      value = value.to_s
+      return if value.empty?
+
+      Gem::Platform.new(value)
+    end
   end
 end

data/lib/bundler/env.rb

@@ -17,9 +17,11 @@ module Bundler
       append_formatted_table("Environment", environment, out)
       append_formatted_table("Bundler Build Metadata", BuildMetadata.to_h, out)
 
-      unless Bundler.settings.all.empty?
+      settings = Bundler.settings.all_including_stored_credentials
+
+      unless settings.empty?
         out << "\n## Bundler settings\n\n```\n"
-        Bundler.settings.all.each do |setting|
+        settings.each do |setting|
           out << setting << "\n"
           Bundler.settings.pretty_values_for(setting).each do |line|
             out << "  " << line << "\n"
@@ -78,17 +80,6 @@ module Bundler
       "not installed"
     end
 
-    def self.version_of(script)
-      return "not installed" unless Bundler.which(script)
-      `#{script} --version`.chomp
-    end
-
-    def self.chruby_version
-      return "not installed" unless Bundler.which("chruby-exec")
-      `chruby-exec -- chruby --version`.
-        sub(/.*^chruby: (#{Gem::Version::VERSION_PATTERN}).*/m, '\1')
-    end
-
     def self.environment
       out = []
 
@@ -110,16 +101,8 @@ module Bundler
         out << ["  Cert File", OpenSSL::X509::DEFAULT_CERT_FILE] if defined?(OpenSSL::X509::DEFAULT_CERT_FILE)
         out << ["  Cert Dir", OpenSSL::X509::DEFAULT_CERT_DIR] if defined?(OpenSSL::X509::DEFAULT_CERT_DIR)
       end
-      out << ["Tools"]
-      out << ["  Git", git_version]
-      out << ["  RVM", ENV.fetch("rvm_version") { version_of("rvm") }]
-      out << ["  rbenv", version_of("rbenv")]
-      out << ["  chruby", chruby_version]
-
-      %w[rubygems-bundler open_gem].each do |name|
-        specs = Bundler.rubygems.find_name(name)
-        out << ["  #{name}", "(#{specs.map(&:version).join(",")})"] unless specs.empty?
-      end
+      out << ["Git", git_version]
+
       if (exe = caller_locations.last.absolute_path)&.match? %r{(exe|bin)/bundler?\z}
         shebang = File.read(exe).lines.first
         shebang.sub!(/^#!\s*/, "")
@@ -143,6 +126,6 @@ module Bundler
       out << "```\n"
     end
 
-    private_class_method :read_file, :ruby_version, :git_version, :append_formatted_table, :version_of, :chruby_version
+    private_class_method :read_file, :ruby_version, :git_version, :append_formatted_table
   end
 end

data/lib/bundler/errors.rb

@@ -131,7 +131,8 @@ module Bundler
     attr_reader :orig_exception
 
     def initialize(orig_exception, msg)
-      full_message = msg + "\nGem Load Error is: #{orig_exception.message}\n"\
+      full_message = msg + "\nGem Load Error is:
+                      #{orig_exception.full_message(highlight: false)}\n"\
                       "Backtrace for gem load error is:\n"\
                       "#{orig_exception.backtrace.join("\n")}\n"\
                       "Bundler Error Backtrace:\n"
@@ -221,7 +222,9 @@ module Bundler
   class DirectoryRemovalError < BundlerError
     def initialize(orig_exception, msg)
       full_message = "#{msg}.\n" \
-                     "The underlying error was #{orig_exception.class}: #{orig_exception.message}, with backtrace:\n" \
+                     "The underlying error was #{orig_exception.class}:
+                     #{orig_exception.full_message(highlight: false)},
+                     with backtrace:\n" \
                      "  #{orig_exception.backtrace.join("\n  ")}\n\n" \
                      "Bundler Error Backtrace:"
       super(full_message)
@@ -262,14 +265,40 @@ module Bundler
   class InvalidArgumentError < BundlerError; status_code(40); end
 
   class IncorrectLockfileDependencies < BundlerError
-    attr_reader :spec
+    attr_reader :spec, :actual_dependencies, :lockfile_dependencies
 
-    def initialize(spec)
+    def initialize(spec, actual_dependencies = nil, lockfile_dependencies = nil)
       @spec = spec
+      @actual_dependencies = actual_dependencies
+      @lockfile_dependencies = lockfile_dependencies
     end
 
     def message
-      "Bundler found incorrect dependencies in the lockfile for #{spec.full_name}"
+      lines = ["Bundler found incorrect dependencies in the lockfile for #{spec.full_name}", ""]
+
+      if @actual_dependencies && @lockfile_dependencies
+        actual_by_name = @actual_dependencies.each_with_object({}) {|d, h| h[d.name] = d }
+        lockfile_by_name = @lockfile_dependencies.each_with_object({}) {|d, h| h[d.name] = d }
+
+        (actual_by_name.keys | lockfile_by_name.keys).sort.each do |name|
+          actual = actual_by_name[name]
+          lockfile = lockfile_by_name[name]
+          next if actual && lockfile && actual.requirement == lockfile.requirement
+
+          if actual && lockfile
+            lines << "  #{name}: gemspec specifies #{actual.requirement}, lockfile has #{lockfile.requirement}"
+          elsif actual
+            lines << "  #{name}: gemspec specifies #{actual.requirement}, not in lockfile"
+          else
+            lines << "  #{name}: not in gemspec, lockfile has #{lockfile.requirement}"
+          end
+        end
+
+        lines << ""
+      end
+
+      lines << "Please run `bundle install` to regenerate the lockfile."
+      lines.join("\n")
     end
 
     status_code(41)

data/lib/bundler/fetcher/compact_index.rb

@@ -2,6 +2,15 @@
 
 require_relative "base"
 require_relative "../worker"
+require "rubygems/compact_index_client"
+
+# Route the client's filesystem access through Bundler's helper so
+# permission problems raise friendly Bundler errors. The respond_to?
+# check covers a host RubyGems that already loaded its own copy of the
+# client from before the hook existed.
+if Gem::CompactIndexClient.respond_to?(:filesystem_access=)
+  Gem::CompactIndexClient.filesystem_access = Bundler::SharedHelpers.method(:filesystem_access)
+end
 
 module Bundler
   class Fetcher
@@ -11,12 +20,12 @@ module Bundler
         undef_method(method_name)
         define_method(method_name) do |*args, &blk|
           method.bind_call(self, *args, &blk)
-        rescue NetworkDownError, CompactIndexClient::Updater::MismatchedChecksumError => e
+        rescue NetworkDownError, Gem::CompactIndexClient::Updater::MismatchedChecksumError => e
           raise HTTPError, e.message
         rescue AuthenticationRequiredError, BadAuthenticationError
           # Fail since we got a 401 from the server.
           raise
-        rescue HTTPError => e
+        rescue HTTPError, Gem::CompactIndexClient::Error => e
           Bundler.ui.trace(e)
           nil
         end
@@ -35,7 +44,7 @@ module Bundler
         until remaining_gems.empty?
           log_specs { "Looking up gems #{remaining_gems.inspect}" }
           deps = fetch_gem_infos(remaining_gems).flatten(1)
-          next_gems = deps.flat_map {|d| d[CompactIndexClient::INFO_DEPS].flat_map(&:first) }.uniq
+          next_gems = deps.flat_map {|d| d[Gem::CompactIndexClient::INFO_DEPS].flat_map(&:first) }.uniq
           deps.each {|dep| gem_info << dep }
           complete_gems.concat(deps.map(&:first)).uniq!
           remaining_gems = next_gems - complete_gems
@@ -53,7 +62,7 @@ module Bundler
         end
         # Read info file checksums out of /versions, so we can know if gems are up to date
         compact_index_client.available?
-      rescue CompactIndexClient::Updater::MismatchedChecksumError => e
+      rescue Gem::CompactIndexClient::Updater::MismatchedChecksumError => e
         Bundler.ui.debug(e.message)
         nil
       end
@@ -75,7 +84,7 @@ module Bundler
       def compact_index_client
         @compact_index_client ||=
           SharedHelpers.filesystem_access(cache_path) do
-            CompactIndexClient.new(cache_path, client_fetcher)
+            Gem::CompactIndexClient.new(cache_path, client_fetcher)
           end
       end
 

data/lib/bundler/fetcher/connection_pools.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "rubygems/request"
+require "rubygems/remote_fetcher"
+
+module Bundler
+  class Fetcher
+    # Hands out pools of configured Gem::Net::HTTP connections, compatible
+    # with the checkout/checkin interface that Gem::Request expects.
+    # Connection policy (proxy, SSL, timeouts) follows Bundler settings
+    # first, falling back to RubyGems configuration.
+    class ConnectionPools
+      # A fixed-size pool of connections to a single host, sharing the
+      # interface of Gem::Request::HTTPPool.
+      class Pool
+        attr_reader :cert_files, :proxy_uri
+
+        def initialize(connections, uri, proxy_uri, size)
+          @connections = connections
+          @uri = uri
+          @proxy_uri = proxy_uri
+          @cert_files = connections.cert_files
+          @queue = Thread::SizedQueue.new(size)
+          size.times { @queue.push(nil) }
+        end
+
+        def checkout
+          @queue.pop || @connections.build_connection(@uri, @proxy_uri)
+        end
+
+        def checkin(connection)
+          @queue.push(connection)
+        end
+      end
+
+      attr_reader :override_headers, :cert_files
+
+      def initialize(size:, timeout:)
+        @size = size
+        @timeout = timeout
+        @override_headers = {}
+        @cert_files = Gem::Request.get_cert_files
+        @pools = {}
+        @pool_mutex = Thread::Mutex.new
+      end
+
+      # Performs a GET request through Gem::Request, which handles resetting
+      # and retrying stale connections, and returns the raw response.
+      def request(uri, headers = nil)
+        Gem::Request.new(uri, Gem::Net::HTTP::Get, nil, pool_for(uri)).fetch do |request|
+          @override_headers.each {|key, value| request[key] = value }
+          headers&.each {|key, value| request[key] = value }
+        end
+      end
+
+      def pool_for(uri)
+        key = [uri.scheme, uri.hostname, uri.port]
+        @pool_mutex.synchronize do
+          @pools[key] ||= Pool.new(self, uri, proxy_for(uri), @size)
+        end
+      end
+
+      # The proxy that will be used for +uri+, or nil. RubyGems configuration
+      # takes precedence over the environment, like Gem::RemoteFetcher.
+      # Unlike Gem::Request, an https URI falls back to `http_proxy` when no
+      # https-specific proxy is set, which is what the previous
+      # net-http-persistent based transport did.
+      def proxy_for(uri)
+        proxy = if config_proxy = Gem.configuration[:http_proxy]
+          Gem::Request.proxy_uri(config_proxy)
+        else
+          env_proxy_for(uri)
+        end
+        return unless proxy
+        # NO_PROXY="*" bypasses the proxy for every host, which
+        # Gem::URI::Generic.use_proxy? does not understand.
+        return if no_proxy_env.strip == "*"
+        return unless Gem::URI::Generic.use_proxy?(uri.hostname, nil, uri.port, no_proxy_env)
+        proxy
+      end
+
+      def build_connection(uri, proxy_uri) # :nodoc:
+        args = [uri.hostname, uri.port]
+        args += if proxy_uri
+          [proxy_uri.hostname, proxy_uri.port,
+           Gem::UriFormatter.new(proxy_uri.user).unescape,
+           Gem::UriFormatter.new(proxy_uri.password).unescape]
+        else
+          [nil, nil]
+        end
+
+        connection = Gem::Request::ConnectionPools.client.new(*args)
+        configure_ssl(connection) if uri.scheme == "https"
+        connection.open_timeout = @timeout
+        connection.read_timeout = @timeout
+        # Stale connections are already resent by Gem::Request#perform_request,
+        # and Bundler::Retry retries whole requests, so the Gem::Net::HTTP
+        # level retry would only multiply the time spent on a timing out host.
+        connection.max_retries = 0
+        connection.start
+        connection
+      end
+
+      private
+
+      def env_proxy_for(uri)
+        proxy = Gem::Request.get_proxy_from_env(uri.scheme)
+        proxy = Gem::Request.get_proxy_from_env("http") if proxy == :no_proxy && uri.scheme == "https"
+        proxy == :no_proxy ? nil : proxy
+      end
+
+      def no_proxy_env
+        ENV["no_proxy"] || ENV["NO_PROXY"] || ""
+      end
+
+      def configure_ssl(connection)
+        connection.use_ssl = true
+        connection.verify_mode = Bundler.settings[:ssl_verify_mode] || OpenSSL::SSL::VERIFY_PEER
+        connection.cert_store = bundler_cert_store
+
+        ssl_client_cert = Bundler.settings[:ssl_client_cert] ||
+                          (Gem.configuration.ssl_client_cert if
+                            Gem.configuration.respond_to?(:ssl_client_cert))
+        return unless ssl_client_cert
+
+        pem = File.read(ssl_client_cert)
+        connection.cert = OpenSSL::X509::Certificate.new(pem)
+        connection.key  = OpenSSL::PKey.read(pem)
+      end
+
+      def bundler_cert_store
+        store = OpenSSL::X509::Store.new
+        ssl_ca_cert = Bundler.settings[:ssl_ca_cert] ||
+                      (Gem.configuration.ssl_ca_cert if
+                        Gem.configuration.respond_to?(:ssl_ca_cert))
+        if ssl_ca_cert
+          if File.directory? ssl_ca_cert
+            store.add_path ssl_ca_cert
+          else
+            store.add_file ssl_ca_cert
+          end
+        else
+          store.set_default_paths
+          cert_files.each {|c| store.add_file c }
+        end
+        store
+      end
+    end
+  end
+end

data/lib/bundler/fetcher/downloader.rb

@@ -6,14 +6,19 @@ module Bundler
       HTTP_NON_RETRYABLE_ERRORS = [
         SocketError,
         Errno::EADDRNOTAVAIL,
+        Errno::ECONNREFUSED,
+        Errno::EHOSTDOWN,
+        Errno::EHOSTUNREACH,
         Errno::ENETDOWN,
         Errno::ENETUNREACH,
-        Gem::Net::HTTP::Persistent::Error,
-        Errno::EHOSTUNREACH,
       ].freeze
 
+      # The vendored net-http raises Gem::Timeout::Error, but when Gem::Net is
+      # the real Net (hosts without a vendored net-http), timeouts are plain
+      # Timeout::Error subclasses instead.
       HTTP_RETRYABLE_ERRORS = [
         Gem::Timeout::Error,
+        *(::Timeout::Error if defined?(::Timeout::Error)),
         EOFError,
         Errno::EINVAL,
         Errno::ECONNRESET,
@@ -25,11 +30,11 @@ module Bundler
         Zlib::BufError,
       ].freeze
 
-      attr_reader :connection
+      attr_reader :connections
       attr_reader :redirect_limit
 
-      def initialize(connection, redirect_limit)
-        @connection = connection
+      def initialize(connections, redirect_limit)
+        @connections = connections
         @redirect_limit = redirect_limit
       end
 
@@ -54,6 +59,10 @@ module Bundler
           if [new_uri.scheme, new_uri.host, new_uri.port] == [uri.scheme, uri.host, uri.port]
             new_uri.user = uri.user
             new_uri.password = uri.password
+          else
+            # see Gem::RemoteFetcher#fetch_http. A nil value removes the header
+            # that ConnectionPools adds from its override_headers.
+            headers = headers.merge("X-Gemfile-Source" => nil)
           end
           fetch(new_uri, headers, counter + 1)
         when Gem::Net::HTTPRequestedRangeNotSatisfiable
@@ -84,23 +93,25 @@ module Bundler
         filtered_uri = URICredentialsFilter.credential_filtered_uri(uri)
 
         Bundler.ui.debug "HTTP GET #{filtered_uri}"
-        req = Gem::Net::HTTP::Get.new uri.request_uri, headers
-        if uri.user
-          user = CGI.unescape(uri.user)
-          password = uri.password ? CGI.unescape(uri.password) : nil
-          req.basic_auth(user, password)
+        connections.request(uri, headers)
+      rescue Gem::RemoteFetcher::FetchError => e
+        Bundler.ui.trace e
+
+        case e.message
+        when /certificate verify failed/
+          raise CertificateFailureError.new(uri)
+        when /host is down|host down/i
+          raise network_down_error(uri, filtered_uri)
+        else
+          raise HTTPError, "Network error while fetching #{filtered_uri}" \
+              " (#{e})"
         end
-        connection.request(uri, req)
       rescue OpenSSL::SSL::SSLError
         raise CertificateFailureError.new(uri)
       rescue *HTTP_NON_RETRYABLE_ERRORS => e
         Bundler.ui.trace e
 
-        host = uri.host
-        host_port = "#{host}:#{uri.port}"
-        host = host_port if filtered_uri.to_s.include?(host_port)
-        raise NetworkDownError, "Could not reach host #{host}. Check your network " \
-          "connection and try again."
+        raise network_down_error(uri, filtered_uri)
       rescue *HTTP_RETRYABLE_ERRORS => e
         Bundler.ui.trace e
 
@@ -110,6 +121,14 @@ module Bundler
 
       private
 
+      def network_down_error(uri, filtered_uri)
+        host = uri.host
+        host_port = "#{host}:#{uri.port}"
+        host = host_port if filtered_uri.to_s.include?(host_port)
+        NetworkDownError.new("Could not reach host #{host}. Check your network " \
+          "connection and try again.")
+      end
+
       def https?(uri)
         uri.scheme&.casecmp("https")&.zero?
       end

data/lib/bundler/fetcher.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "vendored_persistent"
+require_relative "vendored_net_http"
 require_relative "vendored_timeout"
 require_relative "vendored_securerandom"
 require "zlib"
@@ -10,6 +10,7 @@ module Bundler
   class Fetcher
     autoload :Base, File.expand_path("fetcher/base", __dir__)
     autoload :CompactIndex, File.expand_path("fetcher/compact_index", __dir__)
+    autoload :ConnectionPools, File.expand_path("fetcher/connection_pools", __dir__)
     autoload :Downloader, File.expand_path("fetcher/downloader", __dir__)
     autoload :Dependency, File.expand_path("fetcher/dependency", __dir__)
     autoload :Index, File.expand_path("fetcher/index", __dir__)
@@ -137,7 +138,7 @@ module Bundler
       @remote = remote
 
       Socket.do_not_reverse_lookup = true
-      connection # create persistent connection
+      connection # set up the connection pools eagerly so SSL support is checked upfront
     end
 
     def uri
@@ -176,13 +177,13 @@ module Bundler
     def specs(gem_names, source)
       index = Bundler::Index.new
 
-      fetch_specs(gem_names).each do |name, version, platform, dependencies, metadata|
+      fetch_specs(gem_names).each do |name, version, suffix, dependencies, metadata|
         spec = if dependencies
-          EndpointSpecification.new(name, version, platform, self, dependencies, metadata).tap do |es|
+          EndpointSpecification.new(name, version, suffix, self, dependencies, metadata).tap do |es|
             source.checksum_store.replace(es, es.checksum)
           end
         else
-          RemoteSpecification.new(name, version, platform, self)
+          RemoteSpecification.new(name, version, suffix, self)
         end
         spec.source = source
         spec.remote = @remote
@@ -237,7 +238,7 @@ module Bundler
     end
 
     def http_proxy
-      return unless uri = connection.proxy_uri
+      return unless uri = connection.proxy_for(remote_uri)
       uri.to_s
     end
 
@@ -307,28 +308,7 @@ module Bundler
           end
         end
 
-        con = Gem::Net::HTTP::Persistent.new name: "bundler", proxy: :ENV
-        if gem_proxy = Gem.configuration[:http_proxy]
-          con.proxy = Gem::URI.parse(gem_proxy) if gem_proxy != :no_proxy
-        end
-
-        if remote_uri.scheme == "https"
-          con.verify_mode = (Bundler.settings[:ssl_verify_mode] ||
-            OpenSSL::SSL::VERIFY_PEER)
-          con.cert_store = bundler_cert_store
-        end
-
-        ssl_client_cert = Bundler.settings[:ssl_client_cert] ||
-                          (Gem.configuration.ssl_client_cert if
-                            Gem.configuration.respond_to?(:ssl_client_cert))
-        if ssl_client_cert
-          pem = File.read(ssl_client_cert)
-          con.cert = OpenSSL::X509::Certificate.new(pem)
-          con.key  = OpenSSL::PKey.read(pem)
-        end
-
-        con.read_timeout = Fetcher.api_timeout
-        con.open_timeout = Fetcher.api_timeout
+        con = ConnectionPools.new(size: Bundler.settings.processor_count, timeout: Fetcher.api_timeout)
         con.override_headers["User-Agent"] = user_agent
         con.override_headers["X-Gemfile-Source"] = @remote.original_uri.to_s if @remote.original_uri
         con
@@ -341,25 +321,6 @@ module Bundler
       paths.find {|path| File.file? path }
     end
 
-    def bundler_cert_store
-      store = OpenSSL::X509::Store.new
-      ssl_ca_cert = Bundler.settings[:ssl_ca_cert] ||
-                    (Gem.configuration.ssl_ca_cert if
-                      Gem.configuration.respond_to?(:ssl_ca_cert))
-      if ssl_ca_cert
-        if File.directory? ssl_ca_cert
-          store.add_path ssl_ca_cert
-        else
-          store.add_file ssl_ca_cert
-        end
-      else
-        store.set_default_paths
-        require "rubygems/request"
-        Gem::Request.get_cert_files.each {|c| store.add_file c }
-      end
-      store
-    end
-
     def remote_uri
       @remote.uri
     end

data/lib/bundler/gem_helper.rb

@@ -216,7 +216,7 @@ module Bundler
       Bundler.ui.debug(cmd)
       SharedHelpers.chdir(base) do
         outbuf = IO.popen(cmd, err: [:child, :out], &:read)
-        status = $?
+        status = Process.last_status
         block&.call(outbuf) if status.success?
         [outbuf, status]
       end

data/lib/bundler/injector.rb

@@ -89,10 +89,10 @@ module Bundler
     def version_prefix
       if @options[:strict]
         "= "
-      elsif @options[:optimistic]
-        ">= "
-      else
+      elsif @options[:pessimistic]
         "~> "
+      else
+        ">= "
       end
     end