bundler 1.7.11 → 1.7.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 304138ac8170f3f0cfded026f152c769c4bb82d3
-  data.tar.gz: 642559dbb36236fbfb914c040d50474b79e7740a
+  metadata.gz: f78506794e1236e20baeec03409bf31851b62ae8
+  data.tar.gz: 6235c60a7baa56c9d99ea70f5a86854c0cd37ffa
 SHA512:
-  metadata.gz: da5051ee98ba734e1d648979b5f873ba14a76861708bccd39338efd9c46292db9895eec567d585175b739af6056aa3f09dfa3202fd395fa7e1d9588343bf040f
-  data.tar.gz: 630ced150f60a3dc4851341215306114195c11aff3b0d1b275a81249d942920f823458c3e0308afd8447ed948ae0a30825b33e51ca45c2dbdcb7a25a0d5d10ed
+  metadata.gz: 5f23150e0c391c85c40af0e6e9c11aa372ccbdc3c7dc671b7258bbc622a721a6ce6de4700da3b817e5625ac30409c9e5265a4902a7f5240c07be3cb2f9ffee49
+  data.tar.gz: 1c906be004088ce34030dec90bc4aeebb48387b92386659c73125d3a670c75a2f0578b88a583555e7c0aa0b707259a112bf8bf52ade4838ec4740a347aab38d2

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.7.12 (2015-01-08)
+
+Bugfixes:
+
+  - Always send credentials for sources, fixing private Gemfury gems (#3342, @TimMoore)
+
 ## 1.7.11 (2015-01-04)
 
 Bugfixes:

data/lib/bundler/fetcher.rb

@@ -95,8 +95,7 @@ module Bundler
       @api_timeout    = 10 # How long to wait for each API call
       @max_retries    = 3  # How many retries for the API call
 
-      @remote_uri = Bundler::Source.mirror_for(remote_uri)
-      @anonymizable_uri = AnonymizableURI.new(@remote_uri.dup) unless @remote_uri.nil?
+      @anonymizable_uri = resolve_remote_uri(remote_uri)
 
       Socket.do_not_reverse_lookup = true
       connection # create persistent connection
@@ -104,14 +103,14 @@ module Bundler
 
     def connection
       @connection ||= begin
-        needs_ssl = @remote_uri.scheme == "https" ||
+        needs_ssl = remote_uri.scheme == "https" ||
           Bundler.settings[:ssl_verify_mode] ||
           Bundler.settings[:ssl_client_cert]
         raise SSLError if needs_ssl && !defined?(OpenSSL::SSL)
 
         con = Net::HTTP::Persistent.new 'bundler', :ENV
 
-        if @remote_uri.scheme == "https"
+        if remote_uri.scheme == "https"
           con.verify_mode = (Bundler.settings[:ssl_verify_mode] ||
             OpenSSL::SSL::VERIFY_PEER)
           con.cert_store = bundler_cert_store
@@ -130,7 +129,7 @@ module Bundler
     end
 
     def uri
-      @anonymizable_uri.without_credentials unless @anonymizable_uri.nil?
+      @anonymizable_uri.without_credentials
     end
 
     # fetch a gem specification
@@ -138,7 +137,7 @@ module Bundler
       spec = spec - [nil, 'ruby', '']
       spec_file_name = "#{spec.join '-'}.gemspec"
 
-      uri = URI.parse("#{@remote_uri}#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}.rz")
+      uri = URI.parse("#{remote_uri}#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}.rz")
       if uri.scheme == 'file'
         Bundler.load_marshal Gem.inflate(Gem.read_binary(uri.path))
       elsif cached_spec_path = gemspec_cached_path(spec_file_name)
@@ -176,7 +175,7 @@ module Bundler
         end
       end
 
-      specs[@remote_uri].each do |name, version, platform, dependencies|
+      specs[remote_uri].each do |name, version, platform, dependencies|
         next if name == 'bundler'
         spec = nil
         if dependencies
@@ -208,7 +207,7 @@ module Bundler
         Bundler.ui.info ".", false
       end
 
-      return {@remote_uri => last_spec_list} if query_list.empty?
+      return {remote_uri => last_spec_list} if query_list.empty?
 
       remote_specs = Bundler::Retry.new("dependency api", AUTH_ERRORS).attempts do
         fetch_dependency_remote_specs(query_list)
@@ -225,22 +224,16 @@ module Bundler
     end
 
     def use_api
-      _use_api(true)
-    rescue AuthenticationRequiredError
-      retry_with_auth{_use_api(false)}
-    end
-
-    def _use_api(reraise_auth_error = false)
       return @use_api if defined?(@use_api)
 
-      if @remote_uri.scheme == "file" || Bundler::Fetcher.disable_endpoint
+      if remote_uri.scheme == "file" || Bundler::Fetcher.disable_endpoint
         @use_api = false
       elsif fetch(dependency_api_uri)
         @use_api = true
       end
-    rescue AuthenticationRequiredError => e
-      raise e if reraise_auth_error
-      false
+    rescue AuthenticationRequiredError
+      # We got a 401 from the server. Don't fall back to the full index, just fail.
+      raise
     rescue HTTPError
       @use_api = false
     end
@@ -276,8 +269,8 @@ module Bundler
         response.body
       when Net::HTTPRequestEntityTooLarge
         raise FallbackError, response.body
-      when Net::HTTPUnauthorized, Net::HTTPForbidden
-        raise AuthenticationRequiredError, "#{response.class}: #{response.body}"
+      when Net::HTTPUnauthorized
+        raise AuthenticationRequiredError, remote_uri
       else
         raise HTTPError, "#{response.class}: #{response.body}"
       end
@@ -328,16 +321,20 @@ module Bundler
     # fetch from modern index: specs.4.8.gz
     def fetch_all_remote_specs
       old_sources = Bundler.rubygems.sources
-      Bundler.rubygems.sources = [@remote_uri.to_s]
+      Bundler.rubygems.sources = [remote_uri.to_s]
       Bundler.rubygems.fetch_all_remote_specs
     rescue Gem::RemoteFetcher::FetchError, OpenSSL::SSL::SSLError => e
       case e.message
       when /certificate verify failed/
         raise CertificateFailureError.new(uri)
-      when /401|403/
-        # Gemfury uses a 403 for unauthenticated requests instead of a 401, so retry auth
-        # on both.
-        retry_with_auth { fetch_all_remote_specs }
+      when /401/
+        raise AuthenticationRequiredError, remote_uri
+      when /403/
+        if remote_uri.userinfo
+          raise BadAuthenticationError, remote_uri
+        else
+          raise AuthenticationRequiredError, remote_uri
+        end
       else
         Bundler.ui.trace e
         raise HTTPError, "Could not fetch specs from #{uri}"
@@ -374,35 +371,35 @@ module Bundler
       store
     end
 
-    # Attempt to retry with HTTP authentication, if it's appropriate to do so. Yields to a block;
-    # the caller should use this to re-attempt the failing request with the altered `@remote_uri`.
-    def retry_with_auth
-      # Authentication has already been attempted and failed.
-      raise BadAuthenticationError.new(uri) if @remote_uri.user
-
-      auth = Bundler.settings[@remote_uri.to_s]
-
-      # Authentication isn't provided at all, by "bundle config" or in the URI.
-      raise AuthenticationRequiredError.new(uri) if auth.nil?
+  private
 
-      @remote_uri.user, @remote_uri.password = *auth.split(":", 2)
-      @anonymizable_uri = AnonymizableURI.new(@remote_uri.dup)
-      yield
+    def resolve_remote_uri(uri)
+      add_configured_credentials(Bundler::Source.mirror_for(uri))
     end
 
-  private
+    def add_configured_credentials(uri)
+      auth = Bundler.settings[uri.to_s]
+      if auth
+        uri = uri.dup
+        uri.user, uri.password = *auth.split(":", 2)
+      end
+      AnonymizableURI.new(uri)
+    end
 
     def fetch_uri
       @fetch_uri ||= begin
-        if @remote_uri.host == "rubygems.org"
-          uri = @remote_uri.dup
+        if remote_uri.host == "rubygems.org"
+          uri = remote_uri.dup
           uri.host = "bundler.rubygems.org"
           uri
         else
-          @remote_uri
+          remote_uri
         end
       end
     end
 
+    def remote_uri
+      @anonymizable_uri.original_uri
+    end
   end
 end

data/lib/bundler/version.rb

@@ -2,5 +2,5 @@ module Bundler
   # We're doing this because we might write tests that deal
   # with other versions of bundler and we are unsure how to
   # handle this better.
-  VERSION = "1.7.11" unless defined?(::Bundler::VERSION)
+  VERSION = "1.7.12" unless defined?(::Bundler::VERSION)
 end

data/spec/install/gems/dependency_api_spec.rb

@@ -162,6 +162,17 @@ describe "gemcutter's dependency API" do
     should_be_installed "rack 1.0.0"
   end
 
+  it "falls back when the API URL returns 403 Forbidden" do
+    gemfile <<-G
+      source "#{source_uri}"
+      gem "rack"
+    G
+
+    bundle :install, :verbose => true, :artifice => "endpoint_api_forbidden"
+    expect(out).to include("Fetching source index from #{source_uri}")
+    should_be_installed "rack 1.0.0"
+  end
+
   it "handles host redirects" do
     gemfile <<-G
       source "#{source_uri}"

data/spec/support/artifice/endpoint_api_forbidden.rb

@@ -0,0 +1,11 @@
+require File.expand_path("../endpoint", __FILE__)
+
+Artifice.deactivate
+
+class EndpointApiForbidden < Endpoint
+  get "/api/v1/dependencies" do
+    halt 403
+  end
+end
+
+Artifice.activate_with(EndpointApiForbidden)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler
 version: !ruby/object:Gem::Version
-  version: 1.7.11
+  version: 1.7.12
 platform: ruby
 authors:
 - André Arko
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-05 00:00:00.000000000 Z
+date: 2015-01-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mustache
@@ -346,6 +346,7 @@ files:
 - spec/support/artifice/endopint_marshal_fail_basic_authentication.rb
 - spec/support/artifice/endpoint.rb
 - spec/support/artifice/endpoint_500.rb
+- spec/support/artifice/endpoint_api_forbidden.rb
 - spec/support/artifice/endpoint_api_missing.rb
 - spec/support/artifice/endpoint_basic_authentication.rb
 - spec/support/artifice/endpoint_creds_diff_host.rb
@@ -394,7 +395,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: 1.3.6
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: The best way to manage your application's dependencies
@@ -480,6 +481,7 @@ test_files:
 - spec/support/artifice/endopint_marshal_fail_basic_authentication.rb
 - spec/support/artifice/endpoint.rb
 - spec/support/artifice/endpoint_500.rb
+- spec/support/artifice/endpoint_api_forbidden.rb
 - spec/support/artifice/endpoint_api_missing.rb
 - spec/support/artifice/endpoint_basic_authentication.rb
 - spec/support/artifice/endpoint_creds_diff_host.rb