geminabox 1.1.1 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 10ddfa01a1de69668505dc20d43a6fd597ef35a66a46c7fe85d6196c743182ef
-  data.tar.gz: a27916b2ce8ebe5f80a81f1b86de685dce6cd4b52b23a664f5fa1cf804c83424
+  metadata.gz: d4cd157b68695f62078fdfe0852c583684149a3df1bf12fe49c77f52786cf814
+  data.tar.gz: 81190a65a9f11776e07569922f7284a72cece2f5a39fa3a950155276b95f0ad1
 SHA512:
-  metadata.gz: c5a5ed58e2168f47472d98f4b4ea27d9cd1bb56c74bcf44ff7f717113086ad61891727810817b76b748be5870a0802c7514f000aac0a1670b5177f6f89f3ad6b
-  data.tar.gz: 1cde2c7b05c8d4ff12666eb86d801f3087fb16bf22e28544e1802bd5bdd72c97d195d4f4f0f5a8aebb77f39d038ce656aa1a1442cc9410c8ea83ea48ff17784c
+  metadata.gz: 48c92617e64fd7abfbe55aee1223f2fa56ee5e6c6436e470b3b491182ccf5508ff259822204c53c32503ce9eb2be38f94e817e4cd0c6e6a3df27814006014f93
+  data.tar.gz: 4baad42fcfce75ff75411481cf118cde1e991471bb9f650f6869e9ccd68b8078448debcbbd5185b3d8cbe4a5b478e7485de6e8a8e7e615ea6420ed89a45fc34e

data/README.md

@@ -122,6 +122,10 @@ You can also use the gem plugin:
 
     gem inabox pkg/my-awesome-gem-1.0.gem
 
+And since version 1.2.0, Geminabox supports the standard gemcutter yank API:
+
+    gem yank my-awesome-gem -v 1.0 --host HOST
+
 Configure Gem in a box (interactive prompt to specify where to upload to):
 
     gem inabox -c

data/lib/geminabox.rb

@@ -46,6 +46,7 @@ module Geminabox
       :gem_permissions,
       :allow_delete,
       :rubygems_proxy,
+      :rubygems_proxy_merge_strategy,
       :http_adapter,
       :lockfile,
       :retry_interval,
@@ -66,30 +67,31 @@ module Geminabox
     def settings
       Server.settings
     end
-    
+
     def call(env)
       Server.call env
     end
   end
 
   set_defaults(
-    data:                  File.join(File.dirname(__FILE__), *%w[.. data]),
-    public_folder:         File.join(File.dirname(__FILE__), *%w[.. public]),
-    build_legacy:          false,
-    incremental_updates:   true,
-    views:                 File.join(File.dirname(__FILE__), *%w[.. views]),
-    allow_replace:         false,
-    gem_permissions:       0644,
-    rubygems_proxy:        (ENV['RUBYGEMS_PROXY'] == 'true'),
-    allow_delete:          true,
-    http_adapter:          HttpClientAdapter.new,
-    lockfile:              '/tmp/geminabox.lockfile',
-    retry_interval:        60,
-    allow_remote_failure:  false,
-    ruby_gems_url:         'https://rubygems.org/',
-    bundler_ruby_gems_url: 'https://bundler.rubygems.org/',
-    allow_upload:          true,
-    on_gem_received:       nil
+    data:                           File.join(File.dirname(__FILE__), *%w[.. data]),
+    public_folder:                  File.join(File.dirname(__FILE__), *%w[.. public]),
+    build_legacy:                   false,
+    incremental_updates:            true,
+    views:                          File.join(File.dirname(__FILE__), *%w[.. views]),
+    allow_replace:                  false,
+    gem_permissions:                0644,
+    rubygems_proxy:                 (ENV['RUBYGEMS_PROXY'] == 'true'),
+    rubygems_proxy_merge_strategy:  ENV.fetch('RUBYGEMS_PROXY_MERGE_STRATEGY') { :local_gems_take_precedence_over_remote_gems }.to_sym,
+    allow_delete:                   true,
+    http_adapter:                   HttpClientAdapter.new,
+    lockfile:                       File.join(ENV.fetch('TMPDIR', '/tmp'), 'geminabox.lockfile'),
+    retry_interval:                 60,
+    allow_remote_failure:           false,
+    ruby_gems_url:                  'https://rubygems.org/',
+    bundler_ruby_gems_url:          'https://bundler.rubygems.org/',
+    allow_upload:                   true,
+    on_gem_received:                nil
   )
-    
+
 end

data/lib/geminabox/gem_list_merge.rb

@@ -1,23 +1,38 @@
-module Geminabox
-  class GemListMerge
-    attr_accessor :list
-
-    IGNORE_DEPENDENCIES = 0..-2
+require "set"
 
-    def self.from(*lists)
-      lists.map{|list| new(list)}.inject(:merge)
+module Geminabox
+  module GemListMerge
+    def self.merge(local_gem_list, remote_gem_list, strategy:)
+      strategy_for(strategy).merge(local_gem_list, remote_gem_list)
     end
 
-    def initialize(list)
-      @list = list
+    def self.strategy_for(strategy)
+      case strategy
+      when :local_gems_take_precedence_over_remote_gems
+        LocalGemsTakePrecedenceOverRemoteGems
+      when :combine_local_and_remote_gem_versions
+        CombineLocalAndRemoteGemVersions
+      else
+        raise ArgumentError, "Merge strategy must be :local_gems_take_precedence_over_remote_gems (default) or :merge_local_and_remote_gem_versions"
+      end
     end
 
-    def merge(other)
-      merged = (list + other.list)
-      merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
-      merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
-      merged
+    module LocalGemsTakePrecedenceOverRemoteGems
+      def self.merge(local_gem_list, remote_gem_list)
+        names = Set.new(local_gem_list.map { |gem| gem[:name] })
+        local_gem_list + remote_gem_list.reject { |gem| names.include? gem[:name] }
+      end
     end
 
+    module CombineLocalAndRemoteGemVersions
+      IGNORE_DEPENDENCIES = 0..-2
+
+      def self.merge(local_gem_list, remote_gem_list)
+        merged = local_gem_list + remote_gem_list
+        merged.uniq! {|val| val.values[IGNORE_DEPENDENCIES] }
+        merged.sort_by! {|x| x.values[IGNORE_DEPENDENCIES] }
+        merged
+      end
+    end
   end
 end

data/lib/geminabox/proxy/splicer.rb

@@ -1,5 +1,6 @@
 require 'tempfile'
 require 'fileutils'
+require 'rubygems/util'
 
 module Geminabox
   module Proxy
@@ -65,11 +66,11 @@ module Geminabox
       end
 
       def unpackage(content)
-        Marshal.load(Gem.gunzip(content))
+        Marshal.load(Gem::Util.gunzip(content))
       end
 
       def package(content)
-        Gem.gzip(Marshal.dump(content))
+        Gem::Util.gzip(Marshal.dump(content))
       end
 
       def merge_text_content

data/lib/geminabox/server.rb

@@ -1,4 +1,5 @@
 require 'reentrant_flock'
+require 'rubygems/util'
 
 module Geminabox
 
@@ -148,6 +149,27 @@ module Geminabox
 
     end
 
+    delete '/api/v1/gems/yank' do
+      unless self.class.allow_delete?
+        error_response(403, 'Gem deletion is disabled')
+      end
+
+      halt 400 unless request.form_data?
+
+      serialize_update do
+        gems = load_gems.select { |gem| request['gem_name'] == gem.name and
+                                  request['version'] == gem.number.version }
+        halt 404, 'Gem not found' if gems.size == 0
+        gems.each do |gem|
+          gem_path = File.expand_path(File.join(Geminabox.data, 'gems',
+                                                "#{gem.gemfile_name}.gem"))
+          File.delete gem_path if File.exists? gem_path
+        end
+        self.class.reindex(:force_rebuild)
+        return 200, 'Yanked gem and reindexed'
+      end
+    end
+
     post '/upload' do
       unless self.class.allow_upload?
         error_response(403, 'Gem uploading is disabled')
@@ -184,7 +206,7 @@ module Geminabox
     def serialize_update(&block)
       with_rlock(&block)
     rescue ReentrantFlock::AlreadyLocked
-      halt 503, { 'Retry-After' => Geminabox.retry_interval }, 'Repository lock is held by another process'
+      halt 503, { 'Retry-After' => Geminabox.retry_interval.to_s }, 'Repository lock is held by another process'
     end
 
     def with_rlock(&block)
@@ -290,7 +312,7 @@ HTML
     end
 
     def combined_gem_list
-      GemListMerge.from(local_gem_list, remote_gem_list)
+      GemListMerge.merge(local_gem_list, remote_gem_list, strategy: Geminabox.rubygems_proxy_merge_strategy)
     end
 
     helpers do

data/lib/geminabox/version.rb

@@ -1,3 +1,3 @@
 module Geminabox
-  VERSION = '1.1.1' unless defined? VERSION
+  VERSION = '1.4.1' unless defined? VERSION
 end

data/views/atom.erb

@@ -10,12 +10,12 @@
   <% newest_gem = versions.newest %>
     <% spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
     <entry>
-      <id><%= name %></id>
+      <id><%= h(name) %></id>
       <updated><%= spec.date.w3cdtf %></updated>
-      <title><%= name %> (<%= versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</title>
-      <author><name><%= spec.authors.join(", ") %></name></author>
+      <title><%= h(name) %> (<%= h(versions.size == 1 ? versions.oldest.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</title>
+      <author><name><%= h(spec.authors.join(", ")) %></name></author>
       <% versions.each do |version| %>
-        <link href="<%= url "/gems/#{version.gemfile_name}.gem" %>" />
+        <link href="<%= h(url "/gems/#{version.gemfile_name}.gem") %>" />
       <% end %>
     </entry>
   <% end %>

data/views/gem.erb

@@ -5,18 +5,18 @@
 <ul class="gemlist">
   <% @gem.by_name do |name, versions| %>
     <li class="gem-version">
-      <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+      <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
       <% versions.each.reverse_each do |version| %>
         <p>
-        <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+        <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
         <% unless version.platform =~ /^ruby/i %>
-          <small class="platform"><%= version.platform %></small>
+          <small class="platform"><%= h(version.platform) %></small>
         <% end %>
         </p>
         <div class="delete-form">
-          <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
           <% if @allow_delete %>
-          <form method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
+          <form method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
           </form>
@@ -28,10 +28,10 @@
         <p>
         <% newest_gem = versions.newest %>
         <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-          <%= spec.description %>
+          <%= h(spec.description) %>
           <br/>
           <span class="author">– <%= spec.authors.map do |author|
-            "<a href='#{href(spec.homepage)}'>#{author}</a>"
+            "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
           end.join(', ') %></span>
         <% end %>
         </p>

data/views/index.erb

@@ -18,16 +18,16 @@
 
     <% @gems.by_name do |name, versions| %>
       <li <%= %{id="jump_#{name[0..0].downcase}"} if @index_gems.delete(name[0..0].downcase) %> class="gem-version">
-        <h2><%= name %> (<%= versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}" %>)</h2>
+        <h2><%= h(name) %> (<%= h(versions.count == 1 ? versions.first.number : "#{versions.oldest.number} - #{versions.newest.number}") %>)</h2>
         <% versions.each.reverse_each.first(5).each do |version| %>
           <p>
-            <code>gem install <%= version.name %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= version.number %>"</code>
+            <code>gem install <%= h(version.name) %> <%= "--prerelease" if version.number.to_s.match(/[a-z]/i) %> -v "<%= h(version.number) %>"</code>
             <% unless version.platform =~ /^ruby/i %>
-              <small class="platform"><%= version.platform %></small>
+              <small class="platform"><%= h(version.platform) %></small>
             <% end %>
           </p>
-          <form class="delete-form" method="post" action="<%= url("/gems/#{version.gemfile_name}.gem") %>">
-            <a class="download" href="<%= url("/gems/#{version.gemfile_name}.gem") %>">download</a>
+          <form class="delete-form" method="post" action="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">
+            <a class="download" href="<%= h(url("/gems/#{version.gemfile_name}.gem")) %>">download</a>
             <% if @allow_delete %>
             <input type="hidden" name="_method" value="DELETE" />
             <button type="submit">delete</button>
@@ -36,17 +36,17 @@
         <% end %>
 
         <% if versions.count > 5 %>
-          <a href="<%= url("/gems/#{name}") %>" id="more_link">Older versions...</a>
+          <a href="<%= h(url("/gems/#{name}")) %>" id="more_link">Older versions...</a>
         <% end %>
 
         <div class="details">
           <p>
             <% newest_gem = versions.newest %>
             <% if spec = spec_for(name, newest_gem.number, newest_gem.platform) %>
-              <%= spec.description %>
+              <%= h(spec.description) %>
               <br/>
               <span class="author">– <%= spec.authors.map do |author|
-                "<a href='#{href(spec.homepage)}'>#{author}</a>"
+                "<a href='#{href(spec.homepage)}'>#{h(author)}</a>"
               end.join(', ') %></span>
             <% end %>
           </p>

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 1.4.1
 platform: ruby
 authors:
 - Tom Lea
 - Jack Foy
 - Rob Nichols
 - Naotoshi Seo
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-11-07 00:00:00.000000000 Z
+date: 2021-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sinatra
@@ -97,6 +97,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: rss
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: A sinatra based gem hosting app, with client side gem push style functionality.
 email:
 - contrib@tomlea.co.uk
@@ -149,7 +163,7 @@ licenses:
 - MIT-LICENSE
 metadata:
   source_code_uri: https://github.com/geminabox/geminabox
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -166,9 +180,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Really simple rubygem hosting
 test_files: []