bundler 4.0.22 → 4.1.0.beta2

data/lib/bundler/plugin/events.rb

@@ -30,6 +30,54 @@ module Bundler
         @events.key?(event)
       end
 
+      # @!parse
+      #   A hook called before the Gemfile is evaluated
+      #   Includes the Gemfile path and the Lockfile path
+      #   GEM_BEFORE_EVAL = "before-eval"
+      define :GEM_BEFORE_EVAL, "before-eval"
+
+      # @!parse
+      #   A hook called after the Gemfile is evaluated
+      #   Includes a Bundler::Definition
+      #   GEM_AFTER_EVAL = "after-eval"
+      define :GEM_AFTER_EVAL, "after-eval"
+
+      # @!parse
+      #   A hook called before any gems install
+      #   Includes an Array of Bundler::Dependency objects
+      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
+      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
+
+      # @!parse
+      #   A hook called before each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_BEFORE_FETCH = "before-fetch"
+      define :GEM_BEFORE_FETCH, "before-fetch"
+
+      # @!parse
+      #   A hook called after each individual gem is downloaded from a remote source.
+      #   Includes a spec-like object responding to the Gem::Specification API
+      #   (for example, a Bundler spec proxy such as Bundler::EndpointSpecification
+      #   or Bundler::RemoteSpecification). Does not fire when the gem is already
+      #   present at the initial download-cache check.
+      #   GEM_AFTER_FETCH = "after-fetch"
+      define :GEM_AFTER_FETCH, "after-fetch"
+
+      # @!parse
+      #   A hook called before a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_BEFORE_FETCH = "before-git-fetch"
+      define :GIT_BEFORE_FETCH, "before-git-fetch"
+
+      # @!parse
+      #   A hook called after a git source is fetched or checked out.
+      #   Includes a Bundler::Source::Git reference.
+      #   GIT_AFTER_FETCH = "after-git-fetch"
+      define :GIT_AFTER_FETCH, "after-git-fetch"
+
       # @!parse
       #   A hook called before each individual gem is installed
       #   Includes a Bundler::ParallelInstaller::SpecInstallation.
@@ -45,18 +93,18 @@ module Bundler
       #   GEM_AFTER_INSTALL = "after-install"
       define :GEM_AFTER_INSTALL,  "after-install"
 
-      # @!parse
-      #   A hook called before any gems install
-      #   Includes an Array of Bundler::Dependency objects
-      #   GEM_BEFORE_INSTALL_ALL = "before-install-all"
-      define :GEM_BEFORE_INSTALL_ALL, "before-install-all"
-
       # @!parse
       #   A hook called after any gems install
       #   Includes an Array of Bundler::Dependency objects
       #   GEM_AFTER_INSTALL_ALL = "after-install-all"
       define :GEM_AFTER_INSTALL_ALL,  "after-install-all"
 
+      # @!parse
+      #   A hook called before any gems require
+      #   Includes an Array of Bundler::Dependency objects.
+      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
+      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
+
       # @!parse
       #   A hook called before each individual gem is required
       #   Includes a Bundler::Dependency.
@@ -69,17 +117,11 @@ module Bundler
       #   GEM_AFTER_REQUIRE = "after-require"
       define :GEM_AFTER_REQUIRE,  "after-require"
 
-      # @!parse
-      #   A hook called before any gems require
-      #   Includes an Array of Bundler::Dependency objects.
-      #   GEM_BEFORE_REQUIRE_ALL = "before-require-all"
-      define :GEM_BEFORE_REQUIRE_ALL, "before-require-all"
-
       # @!parse
       #   A hook called after all gems required
       #   Includes an Array of Bundler::Dependency objects.
       #   GEM_AFTER_REQUIRE_ALL = "after-require-all"
-      define :GEM_AFTER_REQUIRE_ALL,  "after-require-all"
+      define :GEM_AFTER_REQUIRE_ALL, "after-require-all"
     end
   end
 end

data/lib/bundler/plugin/index.rb

@@ -163,20 +163,28 @@ module Bundler
       # @param [Pathname] index file path
       # @param [Boolean] is the index file global index
       def load_index(index_file, global = false)
+        base = base_for_index(global)
+
         SharedHelpers.filesystem_access(index_file, :read) do |index_f|
           valid_file = index_f&.exist? && !index_f.size.zero?
           break unless valid_file
 
           data = index_f.read
 
-          require_relative "../yaml_serializer"
-          index = YAMLSerializer.load(data)
+          require "rubygems/yaml_serializer"
+          # Empty sections load as nil, e.g. from index files written by
+          # older Bundler versions, which dumped empty hashes as a bare key.
+          index = Gem::YAMLSerializer.load(data) || {}
+
+          escaping = escaping_plugins(index, base)
+          hooks = (index["hooks"] || {}).transform_values {|names| Array(names) - escaping }
 
-          @commands.merge!(index["commands"])
-          @hooks.merge!(index["hooks"])
-          @load_paths.merge!(index["load_paths"])
-          @plugin_paths.merge!(index["plugin_paths"])
-          @sources.merge!(index["sources"]) unless global
+          @commands.merge!(owned_by(index["commands"] || {}, escaping))
+          # An event whose plugins all escaped is left out rather than merged in empty.
+          @hooks.merge!(hooks.reject {|_, names| names.empty? })
+          @load_paths.merge!(named(transform_index_paths(index["load_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @plugin_paths.merge!(named(transform_index_paths(index["plugin_paths"]) {|p| absolutize_path(p, base) }, escaping))
+          @sources.merge!(owned_by(index["sources"] || {}, escaping)) unless global
         end
       end
 
@@ -184,20 +192,88 @@ module Bundler
       # instance variables in YAML format. (The instance variables are supposed
       # to be only String key value pairs)
       def save_index
+        base = base_for_index(false)
+
         index = {
           "commands" => @commands,
           "hooks" => @hooks,
-          "load_paths" => @load_paths,
-          "plugin_paths" => @plugin_paths,
+          "load_paths" => transform_index_paths(@load_paths) {|p| relativize_path(p, base) },
+          "plugin_paths" => transform_index_paths(@plugin_paths) {|p| relativize_path(p, base) },
           "sources" => @sources,
         }
 
-        require_relative "../yaml_serializer"
+        require "rubygems/yaml_serializer"
         SharedHelpers.filesystem_access(index_file) do |index_f|
           FileUtils.mkdir_p(index_f.dirname)
-          File.open(index_f, "w") {|f| f.puts YAMLSerializer.dump(index) }
+          File.open(index_f, "w") {|f| f.puts Gem::YAMLSerializer.dump(index) }
+        end
+      end
+
+      def base_for_index(global)
+        global ? Plugin.global_root : Plugin.root
+      end
+
+      # A relative path only means anything inside the root, so an entry that escapes is not one Bundler installed.
+      def escaping_plugins(index, base)
+        names = []
+
+        %w[load_paths plugin_paths].each do |key|
+          (index[key] || {}).each do |name, value|
+            escapes = Array(value).any? do |path|
+              !Pathname.new(path).absolute? && !contained_in?(absolutize_path(path, base), base)
+            end
+
+            names << name if escapes
+          end
+        end
+
+        names.uniq
+      end
+
+      # Expanded here, not by the caller: what gets stored stays joined, because
+      # #installed_in_plugin_root? matches it against Plugin.root as written.
+      def contained_in?(path, base)
+        path = File.expand_path(path)
+        base = File.expand_path(base)
+
+        path == base || path.start_with?("#{base}#{File::SEPARATOR}")
+      end
+
+      # commands and sources are keyed by what they provide, load_paths and plugin_paths by the plugin.
+      def owned_by(mapping, names)
+        mapping.reject {|_, plugin| names.include?(plugin) }
+      end
+
+      def named(mapping, names)
+        mapping.reject {|plugin, _| names.include?(plugin) }
+      end
+
+      def transform_index_paths(paths)
+        return {} unless paths
+
+        paths.transform_values do |value|
+          if value.is_a?(Array)
+            value.map {|path| yield path }
+          else
+            yield value
+          end
         end
       end
+
+      def relativize_path(path, base)
+        pathname = Pathname.new(path)
+        return path unless pathname.absolute?
+
+        return path unless contained_in?(pathname.to_s, base)
+
+        pathname.relative_path_from(Pathname.new(base)).to_s
+      end
+
+      def absolutize_path(path, base)
+        pathname = Pathname.new(path)
+        pathname = Pathname.new(base).join(pathname) unless pathname.absolute?
+        pathname.to_s
+      end
     end
   end
 end

data/lib/bundler/plugin/installer/path.rb

@@ -5,7 +5,7 @@ module Bundler
     class Installer
       class Path < Bundler::Source::Path
         def root
-          SharedHelpers.in_bundle? ? Bundler.root : Plugin.root
+          Plugin.root
         end
 
         def eql?(other)

data/lib/bundler/plugin/installer.rb

@@ -32,12 +32,18 @@ module Bundler
       #
       # @param [Definition] definition object
       # @return [Hash] map of names to their specs they are installed with
-      def install_definition(definition)
+      def install_definition(definition, latest = false)
         def definition.lock(*); end
-        definition.remotely!
+
+        if latest || definition.missing_specs?
+          definition.remotely!
+        else
+          definition.with_cache!
+        end
+
         specs = definition.specs
 
-        install_from_specs specs
+        install_from_specs(specs)
       end
 
       private
@@ -89,14 +95,14 @@ module Bundler
       end
 
       def install_all_sources(names, version, source_list, source = nil)
-        deps = names.map {|name| Dependency.new(name, version, { "source" => source }) }
+        deps = names.map {|name| Dependency.new(name, version, { "source" => source, "plugin" => true }) }
 
         Bundler.configure_gem_home_and_path(Plugin.root)
 
         Bundler.settings.temporary(deployment: false, frozen: false) do
           definition = Definition.new(nil, deps, source_list, true)
 
-          install_definition(definition)
+          install_definition(definition, true)
         end
       end
 
@@ -110,6 +116,8 @@ module Bundler
         paths = {}
 
         specs.each do |spec|
+          next if spec.name == "bundler"
+
           spec.source.download(spec)
           spec.source.install(spec)
 

data/lib/bundler/plugin.rb

@@ -18,6 +18,14 @@ module Bundler
 
     PLUGIN_FILE_NAME = "plugins.rb"
 
+    # Module-level flag set while .gemfile_install parses the Gemfile and
+    # consulted by .from_lock to substitute plugin sources with
+    # UnloadedSource. It relies on definitions being built one at a time in
+    # a single thread; if they are ever built concurrently or reentrantly,
+    # this needs to be replaced by explicit state passed down to the
+    # lockfile parser.
+    @gemfile_parse = false
+
     module_function
 
     def reset!
@@ -27,6 +35,7 @@ module Bundler
       @commands = {}
       @hooks_by_event = Hash.new {|h, k| h[k] = [] }
       @loaded_plugin_names = []
+      @index = nil
     end
 
     reset!
@@ -41,7 +50,7 @@ module Bundler
 
       specs = Installer.new.install(names, options)
 
-      save_plugins names, specs
+      save_plugins specs.slice(*names)
     rescue PluginError
       specs_to_delete = specs.select {|k, _v| names.include?(k) && !index.commands.values.include?(k) }
       specs_to_delete.each_value {|spec| Bundler.rm_rf(spec.full_gem_path) }
@@ -101,29 +110,44 @@ module Bundler
     #
     # @param [Pathname] gemfile path
     # @param [Proc] block that can be evaluated for (inline) Gemfile
-    def gemfile_install(gemfile = nil, &inline)
-      Bundler.settings.temporary(frozen: false, deployment: false) do
-        builder = DSL.new
-        if block_given?
-          builder.instance_eval(&inline)
-        else
-          builder.eval_gemfile(gemfile)
-        end
-        builder.check_primary_source_safety
-        definition = builder.to_definition(nil, true)
-
-        return if definition.dependencies.empty?
+    def gemfile_install(gemfile = nil, lockfile = nil, unlock = {}, &inline)
+      @gemfile_parse = true
+      Bundler.configure
+      builder = DSL.new
+      if block_given?
+        builder.instance_eval(&inline)
+      else
+        builder.eval_gemfile(gemfile)
+      end
+      builder.check_primary_source_safety
 
-        plugins = definition.dependencies.map(&:name)
-        installed_specs = Installer.new.install_definition(definition)
+      plugins = builder.dependencies.map(&:name)
+      return if plugins.empty?
 
-        save_plugins plugins, installed_specs, builder.inferred_plugins
+      # skip the update if unlocking specific gems, but none of them are plugins
+      # declared in the Gemfile
+      if unlock.is_a?(Hash) && unlock[:gems] && !unlock[:gems].empty? &&
+         (unlock[:gems] & plugins).empty?
+        unlock = {}
       end
+
+      # resolve remotely when unlocking, so that plugins can be updated.
+      # Definition#initialize consumes the unlock hash, so this must be decided
+      # before building the definition.
+      updating = unlock == true || (unlock.is_a?(Hash) && !unlock.empty?)
+
+      definition = builder.to_definition(lockfile, unlock)
+
+      installed_specs = Installer.new.install_definition(definition, updating)
+
+      save_plugins installed_specs.slice(*plugins), builder.inferred_plugins
     rescue RuntimeError => e
       unless e.is_a?(GemfileError)
         Bundler.ui.error "Failed to install plugin: #{e.message}\n  #{e.backtrace[0]}"
       end
       raise
+    ensure
+      @gemfile_parse = false
     end
 
     # The index object used to store the details about the plugin
@@ -184,12 +208,17 @@ module Bundler
 
     # Checks if any plugin declares the source
     def source?(name)
-      !index.source_plugin(name.to_s).nil?
+      !!source_plugin(name)
+    end
+
+    # Returns the plugin that handles the source +name+ if any
+    def source_plugin(name)
+      index.source_plugin(name.to_s)
     end
 
     # @return [Class] that handles the source. The class includes API::Source
     def source(name)
-      raise UnknownSourceError, "Source #{name} not found" unless source? name
+      raise UnknownSourceError, "Source #{name} not found" unless source_plugin(name)
 
       load_plugin(index.source_plugin(name)) unless @sources.key? name
 
@@ -201,6 +230,9 @@ module Bundler
     #                       type passed in locked_opts
     def from_lock(locked_opts)
       opts = locked_opts.merge("uri" => locked_opts["remote"])
+      # when reading the lockfile while doing the plugin-install-from-gemfile phase,
+      # we need to ignore any plugin sources
+      return UnloadedSource.new(opts) if @gemfile_parse
       # use an inert placeholder when the plugin handling this source is not
       # installed, so that the lockfile can still be parsed
       return UnloadedSource.new(opts) unless source?(locked_opts["type"])
@@ -243,7 +275,9 @@ module Bundler
     #
     # @return [String, nil] installed path
     def installed?(plugin)
-      Index.new.installed?(plugin)
+      (path = index.installed?(plugin)) &&
+        index.plugin_path(plugin).join(PLUGIN_FILE_NAME).file? &&
+        path
     end
 
     # @return [true, false] whether the plugin is loaded
@@ -253,19 +287,11 @@ module Bundler
 
     # Post installation processing and registering with index
     #
-    # @param [Array<String>] plugins list to be installed
     # @param [Hash] specs of plugins mapped to installation path (currently they
     #               contain all the installed specs, including plugins)
     # @param [Array<String>] names of inferred source plugins that can be ignored
-    def save_plugins(plugins, specs, optional_plugins = [])
-      plugins.each do |name|
-        spec = specs[name]
-
-        # It's possible that the `plugin` found in the Gemfile don't appear in the specs. For instance when
-        # calling `BUNDLE_WITHOUT=default bundle install`, the plugins will not get installed.
-        next if spec.nil?
-        next if index.up_to_date?(spec)
-
+    def save_plugins(specs, optional_plugins = [])
+      specs.each do |name, spec|
         save_plugin(name, spec, optional_plugins.include?(name))
       end
     end
@@ -290,6 +316,8 @@ module Bundler
     #
     # @raise [PluginInstallError] if validation or registration raises any error
     def save_plugin(name, spec, optional_plugin = false)
+      return if index.up_to_date?(spec)
+
       validate_plugin! Pathname.new(spec.full_gem_path)
       installed = register_plugin(name, spec, optional_plugin)
       Bundler.ui.info "Installed plugin #{name}" if installed
@@ -325,7 +353,7 @@ module Bundler
         raise MalformattedPlugin, "#{e.class}: #{e.message}"
       end
 
-      if optional_plugin && @sources.keys.any? {|s| source? s }
+      if optional_plugin && @sources.keys.any? {|s| source_plugin(s) }
         Bundler.rm_rf(path)
         false
       else

data/lib/bundler/remote_specification.rb

@@ -10,11 +10,11 @@ module Bundler
     include MatchPlatform
     include Comparable
 
-    attr_reader :name, :version, :platform
+    attr_reader :name, :version, :platform, :content_address
     attr_writer :dependencies
     attr_accessor :source, :remote, :locked_platform, :created_at
 
-    def initialize(name, version, platform, spec_fetcher)
+    def initialize(name, version, platform, spec_fetcher, content_address: nil)
       @name         = name
       @version      = Gem::Version.create version
       @original_platform = platform || Gem::Platform::RUBY
@@ -22,6 +22,7 @@ module Bundler
       @spec_fetcher = spec_fetcher
       @dependencies = nil
       @locked_platform = nil
+      @content_address = content_address
     end
 
     def insecurely_materialized?
@@ -35,7 +36,9 @@ module Bundler
     end
 
     def full_name
-      @full_name ||= if @platform == Gem::Platform::RUBY
+      @full_name ||= if Gem::ContentAddress.content_addressed?(self, validate_ruby_abi: false)
+        "#{@name}-#{@version}-#{@content_address}"
+      elsif @platform == Gem::Platform::RUBY
         "#{@name}-#{@version}"
       else
         "#{@name}-#{@version}-#{@platform}"

data/lib/bundler/resolver/base.rb

@@ -5,9 +5,10 @@ require_relative "package"
 module Bundler
   class Resolver
     class Base
-      attr_reader :packages, :requirements, :source_requirements, :locked_specs
+      attr_reader :packages, :requirements, :source_requirements, :locked_specs, :overrides
 
       def initialize(source_requirements, dependencies, base, platforms, options)
+        @overrides = options.delete(:overrides) || []
         @explicit_unlocks = options.delete(:explicit_unlocks) || []
         @source_requirements = source_requirements
         @locked_specs = options[:locked_specs]

data/lib/bundler/resolver/incompatibility.rb

@@ -2,7 +2,7 @@
 
 module Bundler
   class Resolver
-    class Incompatibility < PubGrub::Incompatibility
+    class Incompatibility < Gem::PubGrub::Incompatibility
       attr_reader :extended_explanation
 
       def initialize(terms, cause:, custom_explanation: nil, extended_explanation: nil)