bundler_pack 4.0.15

data/lib/bundler/lazy_specification.rb

@@ -0,0 +1,270 @@
+# frozen_string_literal: true
+
+require_relative "force_platform"
+
+module Bundler
+  class LazySpecification
+    include MatchMetadata
+    include MatchPlatform
+    include ForcePlatform
+
+    attr_reader :name, :version, :platform, :materialization
+    attr_accessor :source, :remote, :force_ruby_platform, :dependencies, :required_ruby_version, :required_rubygems_version
+
+    #
+    # For backwards compatibility with existing lockfiles, if the most specific
+    # locked platform is not a specific platform like x86_64-linux or
+    # universal-java-11, then we keep the previous behaviour of resolving the
+    # best platform variant at materiliazation time. For previous bundler
+    # versions (before 2.2.0) this was always the case (except when the lockfile
+    # only included non-ruby platforms), but we're also keeping this behaviour
+    # on newer bundlers unless users generate the lockfile from scratch or
+    # explicitly add a more specific platform.
+    #
+    attr_accessor :most_specific_locked_platform
+
+    alias_method :runtime_dependencies, :dependencies
+
+    def self.from_spec(s)
+      lazy_spec = new(s.name, s.version, s.platform, s.source)
+      lazy_spec.dependencies = s.runtime_dependencies
+      lazy_spec.required_ruby_version = s.required_ruby_version
+      lazy_spec.required_rubygems_version = s.required_rubygems_version
+      lazy_spec
+    end
+
+    def initialize(name, version, platform, source = nil, **materialization_options)
+      @name          = name
+      @version       = version
+      @dependencies  = []
+      @required_ruby_version = Gem::Requirement.default
+      @required_rubygems_version = Gem::Requirement.default
+      @platform = platform || Gem::Platform::RUBY
+
+      @original_source = source
+      @source = source
+      @materialization_options = materialization_options
+
+      @force_ruby_platform = default_force_ruby_platform
+      @most_specific_locked_platform = nil
+      @materialization = nil
+    end
+
+    def missing?
+      @materialization == self
+    end
+
+    def incomplete?
+      @materialization.nil?
+    end
+
+    def source_changed?
+      @original_source != source
+    end
+
+    def full_name
+      @full_name ||= if platform == Gem::Platform::RUBY
+        "#{@name}-#{@version}"
+      else
+        "#{@name}-#{@version}-#{platform}"
+      end
+    end
+
+    def lock_name
+      @lock_name ||= name_tuple.lock_name
+    end
+
+    def name_tuple
+      Gem::NameTuple.new(@name, @version, @platform)
+    end
+
+    def ==(other)
+      full_name == other.full_name
+    end
+
+    def eql?(other)
+      full_name.eql?(other.full_name)
+    end
+
+    def hash
+      full_name.hash
+    end
+
+    ##
+    # Does this locked specification satisfy +dependency+?
+    #
+    # NOTE: Rubygems default requirement is ">= 0", which doesn't match
+    # prereleases of 0 versions, like "0.0.0.dev" or "0.0.0.SNAPSHOT". However,
+    # bundler users expect those to work. We need to make sure that Gemfile
+    # dependencies without explicit requirements (which use ">= 0" under the
+    # hood by default) are still valid for locked specs using this kind of
+    # versions. The method implements an ad-hoc fix for that. A better solution
+    # might be to change default rubygems requirement of dependencies to be ">=
+    # 0.A" but that's a major refactoring likely to break things. Hopefully we
+    # can attempt it in the future.
+    #
+
+    def satisfies?(dependency)
+      effective_requirement = dependency.requirement == Gem::Requirement.default ? Gem::Requirement.new(">= 0.A") : dependency.requirement
+
+      @name == dependency.name && effective_requirement.satisfied_by?(Gem::Version.new(@version))
+    end
+
+    def to_lock
+      out = String.new
+      out << "    #{lock_name}\n"
+
+      dependencies.sort_by(&:to_s).uniq.each do |dep|
+        next if dep.type == :development
+        out << "    #{dep.to_lock}\n"
+      end
+
+      out
+    end
+
+    def materialize_for_cache
+      source.remote!
+
+      materialize(self, &:first)
+    end
+
+    def materialized_for_installation
+      @materialization = materialize_for_installation
+
+      self unless incomplete?
+    end
+
+    def materialize_for_installation
+      source.local!
+
+      if use_exact_resolved_specifications?
+        spec = materialize(self) {|specs| choose_compatible(specs, fallback_to_non_installable: false) }
+        return spec if spec
+
+        # Exact spec is incompatible; in frozen mode, try to find a compatible platform variant
+        # In non-frozen mode, return nil to trigger re-resolution and lockfile update
+        if Bundler.frozen_bundle?
+          materialize([name, version]) {|specs| resolve_best_platform(specs) }
+        end
+      else
+        materialize([name, version]) {|specs| resolve_best_platform(specs) }
+      end
+    end
+
+    def inspect
+      "#<#{self.class} @name=\"#{name}\" (#{full_name.delete_prefix("#{name}-")})>"
+    end
+
+    def to_s
+      lock_name
+    end
+
+    def git_version
+      return unless source.is_a?(Bundler::Source::Git)
+      " #{source.revision[0..6]}"
+    end
+
+    def force_ruby_platform!
+      @force_ruby_platform = true
+    end
+
+    def replace_source_with!(gemfile_source)
+      return unless gemfile_source.can_lock?(self)
+
+      @source = gemfile_source
+
+      true
+    end
+
+    private
+
+    def use_exact_resolved_specifications?
+      !source.is_a?(Source::Path) && ruby_platform_materializes_to_ruby_platform?
+    end
+
+    # Try platforms in order of preference until finding a compatible spec.
+    # Used for legacy lockfiles and as a fallback when the exact locked spec
+    # is incompatible. Falls back to frozen bundle behavior if none match.
+    def resolve_best_platform(specs)
+      find_compatible_platform_spec(specs) || frozen_bundle_fallback(specs)
+    end
+
+    def find_compatible_platform_spec(specs)
+      candidate_platforms.each do |plat|
+        candidates = MatchPlatform.select_best_platform_match(specs, plat)
+        spec = choose_compatible(candidates, fallback_to_non_installable: false)
+        return spec if spec
+      end
+      nil
+    end
+
+    # Platforms to try in order of preference. Ruby platform is last since it
+    # requires compilation, but works when precompiled gems are incompatible.
+    def candidate_platforms
+      target = source.is_a?(Source::Path) ? platform : Bundler.local_platform
+      [target, platform, Gem::Platform::RUBY].uniq
+    end
+
+    # In frozen mode, accept any candidate. Will error at install time.
+    # When target differs from locked platform, prefer locked platform's candidates
+    # to preserve lockfile integrity.
+    def frozen_bundle_fallback(specs)
+      target = source.is_a?(Source::Path) ? platform : Bundler.local_platform
+      fallback_platform = target == platform ? target : platform
+      candidates = MatchPlatform.select_best_platform_match(specs, fallback_platform)
+      choose_compatible(candidates)
+    end
+
+    def ruby_platform_materializes_to_ruby_platform?
+      generic_platform = Bundler.generic_local_platform == Gem::Platform::JAVA ? Gem::Platform::JAVA : Gem::Platform::RUBY
+
+      (most_specific_locked_platform != generic_platform) || force_ruby_platform || Bundler.settings[:force_ruby_platform]
+    end
+
+    def materialize(query)
+      matching_specs = source.specs.search(query)
+      return self if matching_specs.empty?
+
+      yield matching_specs
+    end
+
+    # If in frozen mode, we fallback to a non-installable candidate because by
+    # doing this we avoid re-resolving and potentially end up changing the
+    # lockfile, which is not allowed. In that case, we will give a proper error
+    # about the mismatch higher up the stack, right before trying to install the
+    # bad gem.
+    def choose_compatible(candidates, fallback_to_non_installable: Bundler.frozen_bundle?)
+      search = candidates.reverse.find do |spec|
+        spec.is_a?(StubSpecification) || spec.matches_current_metadata?
+      end
+      if search.nil? && fallback_to_non_installable
+        search = candidates.last
+      end
+
+      if search
+        validate_dependencies(search) if search.platform == platform
+
+        search.locked_platform = platform if search.instance_of?(RemoteSpecification) || search.instance_of?(EndpointSpecification)
+      end
+      search
+    end
+
+    # Validate dependencies of this locked spec are consistent with dependencies
+    # of the actual spec that was materialized.
+    #
+    # Note that unless we are in strict mode (which we set during installation)
+    # we don't validate dependencies of locally installed gems but
+    # accept what's in the lockfile instead for performance, since loading
+    # dependencies of locally installed gems would mean evaluating all gemspecs,
+    # which would affect `bundler/setup` performance.
+    def validate_dependencies(spec)
+      if !@materialization_options[:strict] && spec.is_a?(StubSpecification)
+        spec.dependencies = dependencies
+      else
+        if !source.is_a?(Source::Path) && spec.runtime_dependencies.sort != dependencies.sort
+          raise IncorrectLockfileDependencies.new(self)
+        end
+      end
+    end
+  end
+end

data/lib/bundler/lockfile_generator.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Bundler
+  class LockfileGenerator
+    attr_reader :definition
+    attr_reader :out
+
+    # @private
+    def initialize(definition)
+      @definition = definition
+      @out = String.new
+    end
+
+    def self.generate(definition)
+      new(definition).generate!
+    end
+
+    def generate!
+      add_sources
+      add_platforms
+      add_dependencies
+      add_checksums
+      add_locked_ruby_version
+      add_bundled_with
+
+      out
+    end
+
+    private
+
+    def add_sources
+      definition.sources.lock_sources.each_with_index do |source, idx|
+        out << "\n" unless idx.zero?
+
+        # Add the source header
+        out << source.to_lock
+
+        # Find all specs for this source
+        specs = definition.resolve.select {|s| source.can_lock?(s) }
+        add_specs(specs)
+      end
+    end
+
+    def add_specs(specs)
+      # This needs to be sorted by full name so that
+      # gems with the same name, but different platform
+      # are ordered consistently
+      specs.sort_by(&:full_name).each do |spec|
+        next if spec.name == "bundler"
+        out << spec.to_lock
+      end
+    end
+
+    def add_platforms
+      add_section("PLATFORMS", definition.platforms)
+    end
+
+    def add_dependencies
+      out << "\nDEPENDENCIES\n"
+
+      handled = []
+      definition.dependencies.sort_by(&:to_s).each do |dep|
+        next if handled.include?(dep.name)
+        out << dep.to_lock << "\n"
+        handled << dep.name
+      end
+    end
+
+    def add_checksums
+      return unless definition.locked_checksums
+      checksums = definition.resolve.map do |spec|
+        spec.source.checksum_store.to_lock(spec)
+      end
+
+      add_section("CHECKSUMS", checksums + bundler_checksum)
+    end
+
+    def add_locked_ruby_version
+      return unless locked_ruby_version = definition.locked_ruby_version
+      add_section("RUBY VERSION", locked_ruby_version.to_s)
+    end
+
+    def add_bundled_with
+      add_section("BUNDLED WITH", definition.bundler_version_to_lock.to_s)
+    end
+
+    def add_section(name, value)
+      out << "\n#{name}\n"
+      case value
+      when Array
+        value.map(&:to_s).sort.each do |val|
+          out << "  #{val}\n"
+        end
+      when Hash
+        value.to_a.sort_by {|k, _| k.to_s }.each do |key, val|
+          out << "  #{key}: #{val}\n"
+        end
+      when String
+        out << "  #{value}\n"
+      else
+        raise ArgumentError, "#{value.inspect} can't be serialized in a lockfile"
+      end
+    end
+
+    def bundler_checksum
+      return [] if Bundler.gem_version.to_s.end_with?(".dev") || ENV["SKIP_BUNDLER_CHECKSUM"]
+
+      bundler_spec = definition.sources.metadata_source.specs.search(["bundler", Bundler.gem_version]).last
+      return [] unless File.exist?(bundler_spec.cache_file)
+
+      require "rubygems/package"
+
+      package = Gem::Package.new(bundler_spec.cache_file)
+      definition.sources.metadata_source.checksum_store.register(bundler_spec, Checksum.from_gem_package(package))
+
+      [definition.sources.metadata_source.checksum_store.to_lock(bundler_spec)]
+    end
+  end
+end

data/lib/bundler/lockfile_parser.rb

@@ -0,0 +1,328 @@
+# frozen_string_literal: true
+
+require_relative "shared_helpers"
+
+module Bundler
+  class LockfileParser
+    class Position
+      attr_reader :line, :column
+      def initialize(line, column)
+        @line = line
+        @column = column
+      end
+
+      def advance!(string)
+        lines = string.count("\n")
+        if lines > 0
+          @line += lines
+          @column = string.length - string.rindex("\n")
+        else
+          @column += string.length
+        end
+      end
+
+      def to_s
+        "#{line}:#{column}"
+      end
+    end
+
+    attr_reader(
+      :sources,
+      :metadata_source,
+      :dependencies,
+      :specs,
+      :platforms,
+      :most_specific_locked_platform,
+      :bundler_version,
+      :ruby_version,
+      :checksums,
+    )
+
+    BUNDLED      = "BUNDLED WITH"
+    DEPENDENCIES = "DEPENDENCIES"
+    CHECKSUMS    = "CHECKSUMS"
+    PLATFORMS    = "PLATFORMS"
+    RUBY         = "RUBY VERSION"
+    GIT          = "GIT"
+    GEM          = "GEM"
+    PATH         = "PATH"
+    PLUGIN       = "PLUGIN SOURCE"
+    SPECS        = "  specs:"
+    OPTIONS      = /^  ([a-z]+): (.*)$/i
+    SOURCE       = [GIT, GEM, PATH, PLUGIN].freeze
+
+    SECTIONS_BY_VERSION_INTRODUCED = {
+      Gem::Version.create("1.0") => [DEPENDENCIES, PLATFORMS, GIT, GEM, PATH].freeze,
+      Gem::Version.create("1.10") => [BUNDLED].freeze,
+      Gem::Version.create("1.12") => [RUBY].freeze,
+      Gem::Version.create("1.13") => [PLUGIN].freeze,
+      Gem::Version.create("2.5.0") => [CHECKSUMS].freeze,
+    }.freeze
+
+    KNOWN_SECTIONS = SECTIONS_BY_VERSION_INTRODUCED.values.flatten!.freeze
+
+    ENVIRONMENT_VERSION_SECTIONS = [BUNDLED, RUBY].freeze
+    deprecate_constant(:ENVIRONMENT_VERSION_SECTIONS)
+
+    def self.sections_in_lockfile(lockfile_contents)
+      sections = lockfile_contents.scan(/^\w[\w ]*$/)
+      sections.uniq!
+      sections
+    end
+
+    def self.unknown_sections_in_lockfile(lockfile_contents)
+      sections_in_lockfile(lockfile_contents) - KNOWN_SECTIONS
+    end
+
+    def self.sections_to_ignore(base_version = nil)
+      base_version &&= base_version.release
+      base_version ||= Gem::Version.create("1.0")
+      attributes = []
+      SECTIONS_BY_VERSION_INTRODUCED.each do |version, introduced|
+        next if version <= base_version
+        attributes += introduced
+      end
+      attributes
+    end
+
+    def self.bundled_with
+      lockfile = Bundler.default_lockfile
+      return unless lockfile.file?
+
+      lockfile_contents = Bundler.read_file(lockfile)
+      return unless lockfile_contents.include?(BUNDLED)
+
+      lockfile_contents.split(BUNDLED).last.strip
+    end
+
+    def initialize(lockfile, strict: false)
+      @platforms    = []
+      @sources      = []
+      @metadata_source = Source::Metadata.new
+      @dependencies = {}
+      @parse_method = nil
+      @specs        = {}
+      @lockfile_path = begin
+        SharedHelpers.relative_lockfile_path
+      rescue GemfileNotFound
+        "Gemfile.lock"
+      end
+      @pos = Position.new(1, 1)
+      @strict = strict
+
+      if lockfile.match?(/<<<<<<<|=======|>>>>>>>|\|\|\|\|\|\|\|/)
+        raise LockfileError, "Your #{@lockfile_path} contains merge conflicts.\n" \
+          "Run `git checkout HEAD -- #{@lockfile_path}` first to get a clean lock."
+      end
+
+      @valid = lockfile.strip.empty? ||
+               lockfile.split(/(?:\r?\n)+/).any? {|l| KNOWN_SECTIONS.include?(l) }
+
+      unless @valid
+        SharedHelpers.feature_deprecated!(
+          "Your #{@lockfile_path} does not appear to be a valid lockfile. " \
+          "Run `rm #{@lockfile_path}` and then `bundle install` to generate a new lockfile. " \
+          "This will raise a LockfileError in a future version of Bundler."
+        )
+      end
+
+      lockfile.split(/((?:\r?\n)+)/) do |line|
+        # split alternates between the line and the following whitespace
+        next @pos.advance!(line) if line.match?(/^\s*$/)
+
+        if SOURCE.include?(line)
+          @parse_method = :parse_source
+          parse_source(line)
+        elsif line == DEPENDENCIES
+          @parse_method = :parse_dependency
+        elsif line == CHECKSUMS
+          # This is a temporary solution to make this feature disabled by default
+          # for all gemfiles that don't already explicitly include the feature.
+          @checksums = true
+          @parse_method = :parse_checksum
+        elsif line == PLATFORMS
+          @parse_method = :parse_platform
+        elsif line == RUBY
+          @parse_method = :parse_ruby
+        elsif line == BUNDLED
+          @parse_method = :parse_bundled_with
+        elsif /^[^\s]/.match?(line)
+          @parse_method = nil
+        elsif @parse_method
+          send(@parse_method, line)
+        end
+        @pos.advance!(line)
+      end
+
+      if @platforms.include?(Gem::Platform::X64_MINGW_LEGACY)
+        SharedHelpers.feature_deprecated!("Found x64-mingw32 in lockfile, which is deprecated and will be removed in the future.")
+      end
+
+      @most_specific_locked_platform = @platforms.min_by do |bundle_platform|
+        Gem::Platform.platform_specificity_match(bundle_platform, Bundler.local_platform)
+      end
+      @specs = @specs.values.sort_by!(&:full_name).each do |spec|
+        spec.most_specific_locked_platform = @most_specific_locked_platform
+      end
+    rescue ArgumentError => e
+      Bundler.ui.debug(e)
+      raise LockfileError, "Your lockfile is unreadable. Run `rm #{@lockfile_path}` " \
+        "and then `bundle install` to generate a new lockfile. The error occurred while " \
+        "evaluating #{@lockfile_path}:#{@pos}"
+    end
+
+    def may_include_redundant_platform_specific_gems?
+      bundler_version.nil? || bundler_version < Gem::Version.new("1.16.2")
+    end
+
+    def valid?
+      @valid
+    end
+
+    private
+
+    TYPES = {
+      GIT => Bundler::Source::Git,
+      GEM => Bundler::Source::Rubygems,
+      PATH => Bundler::Source::Path,
+      PLUGIN => Bundler::Plugin,
+    }.freeze
+
+    def parse_source(line)
+      case line
+      when SPECS
+        return unless TYPES.key?(@type)
+        @current_source = TYPES[@type].from_lock(@opts)
+        @sources << @current_source
+      when OPTIONS
+        value = $2
+        value = true if value == "true"
+        value = false if value == "false"
+
+        key = $1
+
+        if @opts[key]
+          @opts[key] = Array(@opts[key])
+          @opts[key] << value
+        else
+          @opts[key] = value
+        end
+      when *SOURCE
+        @current_source = nil
+        @opts = {}
+        @type = line
+      else
+        parse_spec(line)
+      end
+    end
+
+    space = / /
+    NAME_VERSION = /
+      ^(#{space}{2}|#{space}{4}|#{space}{6})(?!#{space}) # Exactly 2, 4, or 6 spaces at the start of the line
+      (.*?)                                              # Name
+      (?:#{space}\(([^-]*)                               # Space, followed by version
+      (?:-(.*))?\))?                                     # Optional platform
+      (!)?                                               # Optional pinned marker
+      (?:#{space}([^ ]+))?                               # Optional checksum
+      $                                                  # Line end
+    /xo
+
+    def parse_dependency(line)
+      return unless line =~ NAME_VERSION
+      spaces = $1
+      return unless spaces.size == 2
+      name = -$2
+      version = $3
+      pinned = $5
+
+      version = version.split(",").each(&:strip!) if version
+
+      dep = Bundler::Dependency.new(name, version)
+
+      if pinned && dep.name != "bundler"
+        spec = @specs.find {|_, v| v.name == dep.name }
+        dep.source = spec.last.source if spec
+
+        # Path sources need to know what the default name / version
+        # to use in the case that there are no gemspecs present. A fake
+        # gemspec is created based on the version set on the dependency
+        # TODO: Use the version from the spec instead of from the dependency
+        if version && version.size == 1 && version.first =~ /^\s*= (.+)\s*$/ && dep.source.is_a?(Bundler::Source::Path)
+          dep.source.name    = name
+          dep.source.version = $1
+        end
+      end
+
+      @dependencies[dep.name] = dep
+    end
+
+    def parse_checksum(line)
+      return unless line =~ NAME_VERSION
+
+      spaces = $1
+      return unless spaces.size == 2
+      checksums = $6
+      name = $2
+      version = $3
+      platform = $4
+
+      version = Gem::Version.new(version)
+      platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
+      full_name = Gem::NameTuple.new(name, version, platform).full_name
+      spec = @specs[full_name]
+
+      if name == "bundler"
+        spec ||= LazySpecification.new(name, version, platform, @metadata_source)
+      end
+      return unless spec
+
+      if checksums
+        checksums.split(",") do |lock_checksum|
+          column = line.index(lock_checksum) + 1
+          checksum = Checksum.from_lock(lock_checksum, "#{@lockfile_path}:#{@pos.line}:#{column}")
+          spec.source.checksum_store.register(spec, checksum)
+        end
+      else
+        spec.source.checksum_store.register(spec, nil)
+      end
+    end
+
+    def parse_spec(line)
+      return unless line =~ NAME_VERSION
+      spaces = $1
+      name = -$2
+      version = $3
+
+      if spaces.size == 4
+        # only load platform for non-dependency (spec) line
+        platform = $4
+
+        version = Gem::Version.new(version)
+        platform = platform ? Gem::Platform.new(platform) : Gem::Platform::RUBY
+        @current_spec = LazySpecification.new(name, version, platform, @current_source, strict: @strict)
+        @current_source.add_dependency_names(name)
+
+        @specs[@current_spec.full_name] = @current_spec
+      elsif spaces.size == 6
+        version = version.split(",").each(&:strip!) if version
+        dep = Gem::Dependency.new(name, version)
+        @current_spec.dependencies << dep
+      end
+    end
+
+    def parse_platform(line)
+      @platforms << Gem::Platform.new($1.strip) if line =~ /^  (.*)$/
+    end
+
+    def parse_bundled_with(line)
+      line.strip!
+      return unless Gem::Version.correct?(line)
+      @bundler_version = Gem::Version.create(line)
+    end
+
+    def parse_ruby(line)
+      line.strip!
+      @ruby_version = line
+    end
+  end
+end