geminabox 1.0.1 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 989dda9f55d23070e5c33746b9dc21d32e63e1a336bf3d82aa8ac935f7571385
-  data.tar.gz: bd529519469468e0d51a74bccfe3509f7038fed8238c1431c344755ea380ba59
+  metadata.gz: ccd8f5577f0719a552b32d62c4291929c6e544738c4eaef8c3e2d10fab373d92
+  data.tar.gz: e6d33dd7903533d09dde5e8ab8528a427b5b20b5d66097f41ba953df99563b15
 SHA512:
-  metadata.gz: 9ae826eedc94f20eabb4a8a581aab83a01f68708271c93fbdd4f405690bd61633ef5f523ce4d831ecfdcd79d0cb72feb37f2cce7a9b7fc421b78b0a84e7fef2b
-  data.tar.gz: f3a64cbf0e89de75122d3de47cd22198ed2205ffdcfc05153adcab2bce114dc120782562c569edbba6759c66378de43070434f3ab5401c7a04b317978fb9abba
+  metadata.gz: aa8030ff620fbd6843a336f2a93f009e70b2d934fe17681c3fe51a41282544a6f7ff4619250724283ea632e80399a804ecb1a07d2060215727be24a67ac6d2ac
+  data.tar.gz: 8e8a36a99eb8cf115d7b503e4dd9716fcc80138f660c9f8c76746fc5d81554d37e8f2a40f8394be6badc480edb237914b45967b7986fb7ab996bd5d887217e24

data/README.md

@@ -92,6 +92,24 @@ local systems SSL certificates.
 
 TemplateFaradayAdapter is provided as an example of an alternative HTTPAdapter.
 
+## Hooks
+
+You can add a hook (anything callable) which will be called when a gem is
+successfully received.
+
+```ruby
+Geminabox.on_gem_received = Proc.new do |gem|
+  puts "Gem received: #{gem.spec.name} #{gem.spec.version}"
+end
+```
+
+Typically you might use this to push a notification to your team chat. Any
+exceptions which occur within the hook is silently ignored, so please ensure they
+are handled properly if this is not desirable.
+
+Also, please note that this hook blocks `POST /upload` and `POST /api/v1/gems` APIs processing.
+Hook authors are responsible to perform any action non-blocking/async to avoid HTTP timeout.
+
 ## Client Usage
 
 Since version 0.10, Geminabox supports the standard gemcutter push API:
@@ -104,6 +122,10 @@ You can also use the gem plugin:
 
     gem inabox pkg/my-awesome-gem-1.0.gem
 
+And since version 1.2.0, Geminabox supports the standard gemcutter yank API:
+
+    gem yank my-awesome-gem -v 1.0 --host HOST
+
 Configure Gem in a box (interactive prompt to specify where to upload to):
 
     gem inabox -c

data/lib/geminabox.rb

@@ -46,6 +46,7 @@ module Geminabox
       :gem_permissions,
       :allow_delete,
       :rubygems_proxy,
+      :rubygems_proxy_merge_strategy,
       :http_adapter,
       :lockfile,
       :retry_interval,
@@ -53,6 +54,7 @@ module Geminabox
       :ruby_gems_url,
       :bundler_ruby_gems_url,
       :allow_upload,
+      :on_gem_received
     )
 
     def set_defaults(defaults)
@@ -72,22 +74,24 @@ module Geminabox
   end
 
   set_defaults(
-    data:                  File.join(File.dirname(__FILE__), *%w[.. data]),
-    public_folder:         File.join(File.dirname(__FILE__), *%w[.. public]),
-    build_legacy:          false,
-    incremental_updates:   true,
-    views:                 File.join(File.dirname(__FILE__), *%w[.. views]),
-    allow_replace:         false,
-    gem_permissions:       0644,
-    rubygems_proxy:        (ENV['RUBYGEMS_PROXY'] == 'true'),
-    allow_delete:          true,
-    http_adapter:          HttpClientAdapter.new,
-    lockfile:              '/tmp/geminabox.lockfile',
-    retry_interval:        60,
-    allow_remote_failure:  false,
-    ruby_gems_url:         'https://rubygems.org/',
-    bundler_ruby_gems_url: 'https://bundler.rubygems.org/',
-    allow_upload:          true,
+    data:                           File.join(File.dirname(__FILE__), *%w[.. data]),
+    public_folder:                  File.join(File.dirname(__FILE__), *%w[.. public]),
+    build_legacy:                   false,
+    incremental_updates:            true,
+    views:                          File.join(File.dirname(__FILE__), *%w[.. views]),
+    allow_replace:                  false,
+    gem_permissions:                0644,
+    rubygems_proxy:                 (ENV['RUBYGEMS_PROXY'] == 'true'),
+    rubygems_proxy_merge_strategy:  ENV.fetch('RUBYGEMS_PROXY_MERGE_STRATEGY') { :local_gems_take_precedence_over_remote_gems }.to_sym,
+    allow_delete:                   true,
+    http_adapter:                   HttpClientAdapter.new,
+    lockfile:                       '/tmp/geminabox.lockfile',
+    retry_interval:                 60,
+    allow_remote_failure:           false,
+    ruby_gems_url:                  'https://rubygems.org/',
+    bundler_ruby_gems_url:          'https://bundler.rubygems.org/',
+    allow_upload:                   true,
+    on_gem_received:                nil
   )
     
 end

data/lib/geminabox/gem_list_merge.rb

@@ -1,23 +1,38 @@
-module Geminabox
-  class GemListMerge
-    attr_accessor :list
-
-    IGNORE_DEPENDENCIES = 0..-2
+require "set"
 
-    def self.from(*lists)
-      lists.map{|list| new(list)}.inject(:merge)
+module Geminabox
+  module GemListMerge
+    def self.merge(local_gem_list, remote_gem_list, strategy:)
+      strategy_for(strategy).merge(local_gem_list, remote_gem_list)
     end
 
-    def initialize(list)
-      @list = list
+    def self.strategy_for(strategy)
+      case strategy
+      when :local_gems_take_precedence_over_remote_gems
+        LocalGemsTakePrecedenceOverRemoteGems
+      when :combine_local_and_remote_gem_versions
+        CombineLocalAndRemoteGemVersions
+      else
+        raise ArgumentError, "Merge strategy must be :local_gems_take_precedence_over_remote_gems (default) or :merge_local_and_remote_gem_versions"
+      end
     end
 
-    def merge(other)
-      merged = (list + other.list)
-      merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
-      merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
-      merged
+    module LocalGemsTakePrecedenceOverRemoteGems
+      def self.merge(local_gem_list, remote_gem_list)
+        names = Set.new(local_gem_list.map { |gem| gem[:name] })
+        local_gem_list + remote_gem_list.reject { |gem| names.include? gem[:name] }
+      end
     end
 
+    module CombineLocalAndRemoteGemVersions
+      IGNORE_DEPENDENCIES = 0..-2
+
+      def self.merge(local_gem_list, remote_gem_list)
+        merged = local_gem_list + remote_gem_list
+        merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
+        merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
+        merged
+      end
+    end
   end
 end

data/lib/geminabox/proxy/splicer.rb

@@ -1,5 +1,6 @@
 require 'tempfile'
 require 'fileutils'
+require 'rubygems/util'
 
 module Geminabox
   module Proxy
@@ -65,11 +66,11 @@ module Geminabox
       end
 
       def unpackage(content)
-        Marshal.load(Gem.gunzip(content))
+        Marshal.load(Gem::Util.gunzip(content))
       end
 
       def package(content)
-        Gem.gzip(Marshal.dump(content))
+        Gem::Util.gzip(Marshal.dump(content))
       end
 
       def merge_text_content

data/lib/geminabox/server.rb

@@ -1,4 +1,5 @@
 require 'reentrant_flock'
+require 'rubygems/util'
 
 module Geminabox
 
@@ -130,6 +131,7 @@ module Geminabox
     get '/gems/:gemname' do
       gems = Hash[load_gems.by_name]
       @gem = gems[params[:gemname]]
+      @allow_delete = self.class.allow_delete?
       halt 404 unless @gem
       erb :gem
     end
@@ -147,6 +149,27 @@ module Geminabox
 
     end
 
+    delete '/api/v1/gems/yank' do
+      unless self.class.allow_delete?
+        error_response(403, 'Gem deletion is disabled')
+      end
+
+      halt 400 unless request.form_data?
+
+      serialize_update do
+        gems = load_gems.select { |gem| request['gem_name'] == gem.name and
+                                  request['version'] == gem.number.version }
+        halt 404, 'Gem not found' if gems.size == 0
+        gems.each do |gem|
+          gem_path = File.expand_path(File.join(Geminabox.data, 'gems',
+                                                "#{gem.gemfile_name}.gem"))
+          File.delete gem_path if File.exists? gem_path
+        end
+        self.class.reindex(:force_rebuild)
+        return 200, 'Yanked gem and reindexed'
+      end
+    end
+
     post '/upload' do
       unless self.class.allow_upload?
         error_response(403, 'Gem uploading is disabled')
@@ -197,6 +220,12 @@ module Geminabox
         error_response error.code, error.reason
       end
 
+      begin
+        Geminabox.on_gem_received.call(gem) if Geminabox.on_gem_received
+      rescue
+        # ignore errors which occur within the hook
+      end
+
       if api_request?
         "Gem #{gem.name} received and indexed."
       else
@@ -237,7 +266,7 @@ HTML
     def all_gems_with_duplicates
       specs_files_paths.map do |specs_file_path|
         if File.exist?(specs_file_path)
-          Marshal.load(Gem.gunzip(Gem.read_binary(specs_file_path)))
+          Marshal.load(Gem::Util.gunzip(Gem.read_binary(specs_file_path)))
         else
           []
         end
@@ -283,7 +312,7 @@ HTML
     end
 
     def combined_gem_list
-      GemListMerge.from(local_gem_list, remote_gem_list)
+      GemListMerge.merge(local_gem_list, remote_gem_list, strategy: Geminabox.rubygems_proxy_merge_strategy)
     end
 
     helpers do
@@ -305,7 +334,7 @@ HTML
         spec_file = File.join(Geminabox.data, "quick", "Marshal.#{Gem.marshal_version}", "#{filename.join("-")}.gemspec.rz")
         File::open(spec_file, 'r') do |unzipped_spec_file|
           unzipped_spec_file.binmode
-          Marshal.load(Gem.inflate(unzipped_spec_file.read))
+          Marshal.load(Gem::Util.inflate(unzipped_spec_file.read))
         end if File.exist? spec_file
       end
 

data/lib/geminabox/version.rb

@@ -1,3 +1,3 @@
 module Geminabox
-  VERSION = '1.0.1' unless defined? VERSION
+  VERSION = '1.3.1' unless defined? VERSION
 end

data/views/atom.erb

@@ -10,12 +10,12 @@
   <% newest_gem = versions.newest %>
     <% spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
     <entry>
-      <id><%= name %></id>
+      <id><%= h(name) %></id>
       <updated><%= spec.date.w3cdtf %></updated>
-      <title><%= name %> (<%= versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</title>
-      <author><name><%= spec.authors.join(", ") %></name></author>
+      <title><%= h(name) %> (<%= h(versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</title>
+      <author><name><%= h(spec.authors.join(", ")) %></name></author>
       <% versions.each do |version| %>
-        <link href="<%= url "/gems/#{version.gemfile_name}.gem" %>" />
+        <link href="<%= h(url "/gems/#{version.gemfile_name}.gem") %>" />
       <% end %>
     </entry>
   <% end %>

data/views/gem.erb

@@ -5,18 +5,18 @@
 <ul class="gemlist">
   <% @gem.by_name do |name, versions| %>
     <li class="gem-version">
-      <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+      <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
       <% versions.each.reverse_each do |version| %>
         <p>
-        <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+        <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
         <% unless version.platform =~ /^ruby/i %>
-          <small class="platform"><%= version.platform %></small>
+          <small class="platform"><%= h(version.platform) %></small>
         <% end %>
         </p>
         <div class="delete-form">
-          <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
           <% if @allow_delete %>
-          <form method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
+          <form method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
           </form>
@@ -28,10 +28,10 @@
         <p>
         <% newest_gem = versions.newest %>
         <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-          <%= spec.description %>
+          <%= h(spec.description) %>
           <br/>
           <span class="author">– <%= spec.authors.map do |author|
-            "<a href='#{href(spec.homepage)}'>#{author}</a>"
+            "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
           end.join(', ') %></span>
         <% end %>
         </p>

data/views/index.erb

@@ -18,16 +18,16 @@
 
     <% @gems.by_name do |name, versions| %>
       <li <%= %{id="jump_#{name[0..0].downcase}"} if @index_gems.delete(name[0..0].downcase) %> class="gem-version">
-        <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+        <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
         <% versions.each.reverse_each.first(5).each do |version| %>
           <p>
-            <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+            <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
             <% unless version.platform =~ /^ruby/i %>
-              <small class="platform"><%= version.platform %></small>
+              <small class="platform"><%= h(version.platform) %></small>
             <% end %>
           </p>
-          <form class="delete-form" method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
-            <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <form class="delete-form" method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
+            <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
             <% if @allow_delete %>
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
@@ -36,17 +36,17 @@
         <% end %>
 
         <% if versions.count > 5 %>
-          <a href="<%= url("/gems/#{name}") %>" id="more_link">Older versions...</a>
+          <a href="<%= h(url("/gems/#{name}")) %>" id="more_link">Older versions...</a>
         <% end %>
 
         <div class="details">
           <p>
             <% newest_gem = versions.newest %>
             <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-              <%= spec.description %>
+              <%= h(spec.description) %>
               <br/>
               <span class="author">– <%= spec.authors.map do |author|
-                "<a href='#{href(spec.homepage)}'>#{author}</a>"
+                "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
               end.join(', ') %></span>
             <% end %>
           </p>

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.3.1
 platform: ruby
 authors:
 - Tom Lea
 - Jack Foy
 - Rob Nichols
 - Naotoshi Seo
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-03-13 00:00:00.000000000 Z
+date: 2021-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -149,7 +149,7 @@ licenses:
 - MIT-LICENSE
 metadata:
   source_code_uri: https://github.com/geminabox/geminabox
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -166,9 +166,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.4
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Really simple rubygem hosting
 test_files: []