geminabox 1.1.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c58b87ab694d0e78e224fd5faf56aa4b7676c88f2c10da711980765fbb8bd1bc
-  data.tar.gz: ca6355cf693daf3a94826f7e9ab29a9f73714077d78dac0c298352e280fbbaee
+  metadata.gz: e6202425f155e5ef57fbf61150ddfb36175feaa2fb27f802de8d56fc3c3716af
+  data.tar.gz: 3cb74860670ac4a0d53df6fa0fbafec173f7441b0675abb2263f525baf34cfbd
 SHA512:
-  metadata.gz: 5cc317ab13ac74784a371820b55bb6625c3d2af1aa3b04a7efcedeb1484ef08c29daa690975079776add41b374a2bb9d9703dfb73ad6930ffdf539d53eee97d9
-  data.tar.gz: 90da6706ea509db2a15c4aafe267334120954e42a5d5c06a918c4bb5e4a9a5626257ccbeb6b39132efb89cb8a45363794854581b2646831e7906159dcf870170
+  metadata.gz: 38234e325f6c2ecf00138cd16b65dbe42bf5724b83c06f1eff3e61d42384ee3330fb57e8c403c2f26a17a0b02b961852970d31d634859c74a4a781b6cdf0f956
+  data.tar.gz: 52c9532b79d0ed5fc9c7a5c0d16e75dacd3befb27a85d7f333901380671814908e7b7fdc3eaa1612d8ee6e79089eed290b43427d94a90809e8e1ae470e3709b2

data/README.md

@@ -122,6 +122,10 @@ You can also use the gem plugin:
 
     gem inabox pkg/my-awesome-gem-1.0.gem
 
+And since version 1.2.0, Geminabox supports the standard gemcutter yank API:
+
+    gem yank my-awesome-gem -v 1.0 --host HOST
+
 Configure Gem in a box (interactive prompt to specify where to upload to):
 
     gem inabox -c

data/lib/geminabox.rb

@@ -46,6 +46,7 @@ module Geminabox
       :gem_permissions,
       :allow_delete,
       :rubygems_proxy,
+      :rubygems_proxy_merge_strategy,
       :http_adapter,
       :lockfile,
       :retry_interval,
@@ -73,23 +74,24 @@ module Geminabox
   end
 
   set_defaults(
-    data:                  File.join(File.dirname(__FILE__), *%w[.. data]),
-    public_folder:         File.join(File.dirname(__FILE__), *%w[.. public]),
-    build_legacy:          false,
-    incremental_updates:   true,
-    views:                 File.join(File.dirname(__FILE__), *%w[.. views]),
-    allow_replace:         false,
-    gem_permissions:       0644,
-    rubygems_proxy:        (ENV['RUBYGEMS_PROXY'] == 'true'),
-    allow_delete:          true,
-    http_adapter:          HttpClientAdapter.new,
-    lockfile:              '/tmp/geminabox.lockfile',
-    retry_interval:        60,
-    allow_remote_failure:  false,
-    ruby_gems_url:         'https://rubygems.org/',
-    bundler_ruby_gems_url: 'https://bundler.rubygems.org/',
-    allow_upload:          true,
-    on_gem_received:       nil
+    data:                           File.join(File.dirname(__FILE__), *%w[.. data]),
+    public_folder:                  File.join(File.dirname(__FILE__), *%w[.. public]),
+    build_legacy:                   false,
+    incremental_updates:            true,
+    views:                          File.join(File.dirname(__FILE__), *%w[.. views]),
+    allow_replace:                  false,
+    gem_permissions:                0644,
+    rubygems_proxy:                 (ENV['RUBYGEMS_PROXY'] == 'true'),
+    rubygems_proxy_merge_strategy:  ENV.fetch('RUBYGEMS_PROXY_MERGE_STRATEGY') { :local_gems_take_precedence_over_remote_gems }.to_sym,
+    allow_delete:                   true,
+    http_adapter:                   HttpClientAdapter.new,
+    lockfile:                       '/tmp/geminabox.lockfile',
+    retry_interval:                 60,
+    allow_remote_failure:           false,
+    ruby_gems_url:                  'https://rubygems.org/',
+    bundler_ruby_gems_url:          'https://bundler.rubygems.org/',
+    allow_upload:                   true,
+    on_gem_received:                nil
   )
     
 end

data/lib/geminabox/gem_list_merge.rb

@@ -1,23 +1,38 @@
-module Geminabox
-  class GemListMerge
-    attr_accessor :list
-
-    IGNORE_DEPENDENCIES = 0..-2
+require "set"
 
-    def self.from(*lists)
-      lists.map{|list| new(list)}.inject(:merge)
+module Geminabox
+  module GemListMerge
+    def self.merge(local_gem_list, remote_gem_list, strategy:)
+      strategy_for(strategy).merge(local_gem_list, remote_gem_list)
     end
 
-    def initialize(list)
-      @list = list
+    def self.strategy_for(strategy)
+      case strategy
+      when :local_gems_take_precedence_over_remote_gems
+        LocalGemsTakePrecedenceOverRemoteGems
+      when :combine_local_and_remote_gem_versions
+        CombineLocalAndRemoteGemVersions
+      else
+        raise ArgumentError, "Merge strategy must be :local_gems_take_precedence_over_remote_gems (default) or :merge_local_and_remote_gem_versions"
+      end
     end
 
-    def merge(other)
-      merged = (list + other.list)
-      merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
-      merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
-      merged
+    module LocalGemsTakePrecedenceOverRemoteGems
+      def self.merge(local_gem_list, remote_gem_list)
+        names = Set.new(local_gem_list.map { |gem| gem[:name] })
+        local_gem_list + remote_gem_list.reject { |gem| names.include? gem[:name] }
+      end
     end
 
+    module CombineLocalAndRemoteGemVersions
+      IGNORE_DEPENDENCIES = 0..-2
+
+      def self.merge(local_gem_list, remote_gem_list)
+        merged = local_gem_list + remote_gem_list
+        merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
+        merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
+        merged
+      end
+    end
   end
 end

data/lib/geminabox/proxy/splicer.rb

@@ -1,5 +1,6 @@
 require 'tempfile'
 require 'fileutils'
+require 'rubygems/util'
 
 module Geminabox
   module Proxy
@@ -65,11 +66,11 @@ module Geminabox
       end
 
       def unpackage(content)
-        Marshal.load(Gem.gunzip(content))
+        Marshal.load(Gem::Util.gunzip(content))
       end
 
       def package(content)
-        Gem.gzip(Marshal.dump(content))
+        Gem::Util.gzip(Marshal.dump(content))
       end
 
       def merge_text_content

data/lib/geminabox/server.rb

@@ -1,4 +1,5 @@
 require 'reentrant_flock'
+require 'rubygems/util'
 
 module Geminabox
 
@@ -130,6 +131,7 @@ module Geminabox
     get '/gems/:gemname' do
       gems = Hash[load_gems.by_name]
       @gem = gems[params[:gemname]]
+      @allow_delete = self.class.allow_delete?
       halt 404 unless @gem
       erb :gem
     end
@@ -147,6 +149,27 @@ module Geminabox
 
     end
 
+    delete '/api/v1/gems/yank' do
+      unless self.class.allow_delete?
+        error_response(403, 'Gem deletion is disabled')
+      end
+
+      halt 400 unless request.form_data?
+
+      serialize_update do
+        gems = load_gems.select { |gem| request['gem_name'] == gem.name and
+                                  request['version'] == gem.number.version }
+        halt 404, 'Gem not found' if gems.size == 0
+        gems.each do |gem|
+          gem_path = File.expand_path(File.join(Geminabox.data, 'gems',
+                                                "#{gem.gemfile_name}.gem"))
+          File.delete gem_path if File.exists? gem_path
+        end
+        self.class.reindex(:force_rebuild)
+        return 200, 'Yanked gem and reindexed'
+      end
+    end
+
     post '/upload' do
       unless self.class.allow_upload?
         error_response(403, 'Gem uploading is disabled')
@@ -243,7 +266,7 @@ HTML
     def all_gems_with_duplicates
       specs_files_paths.map do |specs_file_path|
         if File.exist?(specs_file_path)
-          Marshal.load(Gem.gunzip(Gem.read_binary(specs_file_path)))
+          Marshal.load(Gem::Util.gunzip(Gem.read_binary(specs_file_path)))
         else
           []
         end
@@ -289,7 +312,7 @@ HTML
     end
 
     def combined_gem_list
-      GemListMerge.from(local_gem_list, remote_gem_list)
+      GemListMerge.merge(local_gem_list, remote_gem_list, strategy: Geminabox.rubygems_proxy_merge_strategy)
     end
 
     helpers do
@@ -311,7 +334,7 @@ HTML
         spec_file = File.join(Geminabox.data, "quick", "Marshal.#{Gem.marshal_version}", "#{filename.join("-")}.gemspec.rz")
         File::open(spec_file, 'r') do |unzipped_spec_file|
           unzipped_spec_file.binmode
-          Marshal.load(Gem.inflate(unzipped_spec_file.read))
+          Marshal.load(Gem::Util.inflate(unzipped_spec_file.read))
         end if File.exist? spec_file
       end
 

data/lib/geminabox/version.rb

@@ -1,3 +1,3 @@
 module Geminabox
-  VERSION = '1.1.0' unless defined? VERSION
+  VERSION = '1.4.0' unless defined? VERSION
 end

data/views/atom.erb

@@ -10,12 +10,12 @@
   <% newest_gem = versions.newest %>
     <% spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
     <entry>
-      <id><%= name %></id>
+      <id><%= h(name) %></id>
       <updated><%= spec.date.w3cdtf %></updated>
-      <title><%= name %> (<%= versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</title>
-      <author><name><%= spec.authors.join(", ") %></name></author>
+      <title><%= h(name) %> (<%= h(versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</title>
+      <author><name><%= h(spec.authors.join(", ")) %></name></author>
       <% versions.each do |version| %>
-        <link href="<%= url "/gems/#{version.gemfile_name}.gem" %>" />
+        <link href="<%= h(url "/gems/#{version.gemfile_name}.gem") %>" />
       <% end %>
     </entry>
   <% end %>

data/views/gem.erb

@@ -5,18 +5,18 @@
 <ul class="gemlist">
   <% @gem.by_name do |name, versions| %>
     <li class="gem-version">
-      <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+      <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
       <% versions.each.reverse_each do |version| %>
         <p>
-        <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+        <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
         <% unless version.platform =~ /^ruby/i %>
-          <small class="platform"><%= version.platform %></small>
+          <small class="platform"><%= h(version.platform) %></small>
         <% end %>
         </p>
         <div class="delete-form">
-          <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
           <% if @allow_delete %>
-          <form method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
+          <form method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
           </form>
@@ -28,10 +28,10 @@
         <p>
         <% newest_gem = versions.newest %>
         <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-          <%= spec.description %>
+          <%= h(spec.description) %>
           <br/>
           <span class="author">– <%= spec.authors.map do |author|
-            "<a href='#{href(spec.homepage)}'>#{author}</a>"
+            "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
           end.join(', ') %></span>
         <% end %>
         </p>

data/views/index.erb

@@ -18,16 +18,16 @@
 
     <% @gems.by_name do |name, versions| %>
       <li <%= %{id="jump_#{name[0..0].downcase}"} if @index_gems.delete(name[0..0].downcase) %> class="gem-version">
-        <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+        <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
         <% versions.each.reverse_each.first(5).each do |version| %>
           <p>
-            <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+            <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
             <% unless version.platform =~ /^ruby/i %>
-              <small class="platform"><%= version.platform %></small>
+              <small class="platform"><%= h(version.platform) %></small>
             <% end %>
           </p>
-          <form class="delete-form" method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
-            <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <form class="delete-form" method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
+            <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
             <% if @allow_delete %>
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
@@ -36,17 +36,17 @@
         <% end %>
 
         <% if versions.count > 5 %>
-          <a href="<%= url("/gems/#{name}") %>" id="more_link">Older versions...</a>
+          <a href="<%= h(url("/gems/#{name}")) %>" id="more_link">Older versions...</a>
         <% end %>
 
         <div class="details">
           <p>
             <% newest_gem = versions.newest %>
             <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-              <%= spec.description %>
+              <%= h(spec.description) %>
               <br/>
               <span class="author">– <%= spec.authors.map do |author|
-                "<a href='#{href(spec.homepage)}'>#{author}</a>"
+                "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
               end.join(', ') %></span>
             <% end %>
           </p>

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Tom Lea
 - Jack Foy
 - Rob Nichols
 - Naotoshi Seo
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-04-06 00:00:00.000000000 Z
+date: 2021-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -97,6 +97,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rss
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: A sinatra based gem hosting app, with client side gem push style functionality.
 email:
 - contrib@tomlea.co.uk
@@ -149,7 +163,7 @@ licenses:
 - MIT-LICENSE
 metadata:
   source_code_uri: https://github.com/geminabox/geminabox
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -166,9 +180,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.4
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Really simple rubygem hosting
 test_files: []