gemvault 0.1.5 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 100a593cb7221bf6cc5842ad00c67335809a351905251a6088c3698b41fa9b95
-  data.tar.gz: 6645dea254fbdd76dbd2fc1de7f8471f27185d205d5a23e038665d060f253cfa
+  metadata.gz: 3c643dd2d86d0a918dbecb5a8f20026746a0e60670eaa5590009fe35e6f9b9b0
+  data.tar.gz: fa0f695ae5d5d9ab9686caa479cc89c2c6954fc8c53bfdd02841cf12578622bd
 SHA512:
-  metadata.gz: a973851f5b6b7b9eaa48fcf21a25660bc3770d36c992ff758e4b9ace061a64e5b2cdd6a0270ee335ca3d2a6cf1b80f842b69e6768a98fd85741ec91141786a60
-  data.tar.gz: 16b6a27438852230e49569493d526efdcf6b07f499137cdcb73a18b29ef06bd89ddf2def281649109bbf1cfbacce1e7e3d4bfdddae44984855fa378e1b79c51f
+  metadata.gz: d16d9d84c05c143a2372eaee7bd55b162aca32019a4709227f689ce47a4c725bd4d2d8a64b9b788f32d107ec37ae8c61b73178d547e60613a221bd55d48aff53
+  data.tar.gz: 21b8fbd66feeea5146546632f5636a194c698c2ab6aa1d51ae0d9544b021dc15f32d4c1171a98e92c67fe62b56cfe2f57dab5138fef2c8dc6a4bb5d194b1952d

data/.containerignore

@@ -0,0 +1,10 @@
+.bundle
+.git
+gemv
+pkg
+tmp
+vendor
+*.gem
+*.gemv
+references
+references/

data/.rubocop.yml

@@ -17,7 +17,7 @@ plugins:
 
 AllCops:
   NewCops: enable
-  TargetRubyVersion: 4.0
+  TargetRubyVersion: 3.4.8
   Exclude:
     - bin/*
     - vendor/**/*
@@ -137,6 +137,13 @@ Style/ArgumentsForwarding:
 Style/RedundantBegin:
   Enabled: false
 
+# Data value objects that carry constants, nested value types, or any class
+# body read best as `class X < Data.define(...)`. The assignment form the cop
+# prefers leaks block-level constants to the enclosing scope and forces a
+# `.freeze` (Style/MutableConstant) on the class. Permitted by David.
+Style/DataInheritance:
+  Enabled: false
+
 # Compact class names are fine for small files and tests.
 Style/ClassAndModuleChildren:
   Enabled: false

data/CHANGELOG.md

@@ -19,10 +19,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   preserving every gem and timestamp, writing a `.bak` backup by default, with
   `--dry-run` and `--no-backup` flags. It is a no-op on an already-current vault.
 
+- All CLI commands accept `vault://` and `file://` locators wherever they take
+  a vault path, e.g. `gemvault list vault:///path/to/myvault.gemv`; resolution
+  is shared with the RubyGems source via `Gemvault::VaultPath` (issue #9).
+
+### Fixed
+- `bundle plugin install bundler-source-vault` no longer dies with
+  `LoadError: cannot load such file -- bundler/plugin/vault_source`. The shim's
+  `plugins.rb` now derives the gem root from its own installed location (local
+  plugin root, global plugin root, or plain GEM_HOME), registers any spec dirs
+  RubyGems is not searching, and resets RubyGems' spec stub cache when it
+  predates the just-installed gems (issue #10).
+- `bundle exec` no longer fails Gemfile parsing with `Could not find 'bundler'
+  (>= 2.0)` under `path: vendor` on rubies that ship bundler as a regular gem:
+  gemvault no longer declares `bundler` as a runtime dependency (issue #12).
+- Vault gems whose versions carry a non-numeric suffix (e.g. `0.2.1.patch1`)
+  install from a vault with `gem install --pre`, matching RubyGems' prerelease
+  semantics (issue #6).
+
 ### Changed
 - `sqlite3` is no longer a runtime dependency. Gemvault runs dependency-free on
   the tarball path (including JRuby); `sqlite3` is loaded lazily only to read a
   legacy SQLite vault, with a clear error if it is not installed.
+- `bundler` is no longer a runtime dependency; the Bundler plugin always runs
+  inside an existing Bundler process, and the declared dependency broke gem
+  activation in restricted GEM_PATH contexts.
+- CI is unblocked (issue #11): RuboCop's TargetRubyVersion now matches the
+  gemspec's `required_ruby_version` floor (3.4.8), the previously-missing
+  `spec:integration` rake task exists alongside a non-integration `spec:core`, the
+  unit job no longer needs podman, and the integration job installs podman
+  when the runner image lacks it.
+- Reading a vault's `manifest.json` is now strict: an entry missing any required
+  field (`name`, `version`, `platform`, `created_at`, `sha256`, `encrypted`)
+  raises instead of silently loading `nil` fields, so a truncated or hand-edited
+  manifest fails fast rather than yielding a subtly broken vault.
 
 ### Deprecated
 - The SQLite vault format is deprecated and now **read-only**: existing SQLite

data/CLAUDE.md

@@ -17,6 +17,7 @@ Do NOT modify `.rubocop.yml` or use inline `# rubocop:disable` tags without expl
 9. ALWAYS write specs first. The workflow is: identify the domain concept (rule 5), write specs describing its behavior, then implement. No implementation without a failing spec.
 10. Integration specs are the first line of defense for CLI-tool bugs. For any bug reported from using the CLI tool (not the gemvault lib / Ruby API), the FIRST spec you write is an integration spec that reproduces the user's exact invocation — real subprocess, real vault, real exit code. Stub-heavy unit specs are complementary, not sufficient: they prove internal logic produces the expected value assuming surrounding wiring works, but a user's bug report is evidence the wiring didn't work.
 11. If an integration spec is not catching a reported CLI-tool bug, one of two things is true, and the fix starts by diagnosing which: (a) existing integration specs are not specific enough — extend them to cover the exact scenario before touching production code; or (b) the scenario is not spec'd at all, which means the work is not a bug fix but a new feature — write integration specs for the contract first (per rule 1), then implement.
+12. NEVER write to /tmp. Use /workspace/tmp
 
 ## Additional rules
 
@@ -25,7 +26,7 @@ Do NOT modify `.rubocop.yml` or use inline `# rubocop:disable` tags without expl
 
 ## Project Overview
 
-Multi-gem portable archives backed by SQLite. A single `.gemv` file contains multiple `.gem` files.
+Multi-gem portable archives. A single `.gemv` file is a tarball holding multiple `.gem` files plus a `manifest.json` index; legacy SQLite vaults are read-only.
 
 Two gems, one repo:
 
@@ -56,7 +57,7 @@ gem install --source file:///path/to/myvault.gemv foo
 ## Architecture
 
 - `gemvault.gemspec` — main gem spec (name: `gemvault`)
-- `lib/gemvault/vault.rb` — Core vault class (SQLite CRUD for gem blobs + specs)
+- `lib/gemvault/vault.rb` — Vault facade choosing a backend by file format (Tarvault current, legacy Dbvault read-only)
 - `lib/gemvault/cli.rb` — CLI dispatcher (new/add/list/remove/extract)
 - `lib/bundler/plugin/vault_source.rb` — Bundler `Plugin::API::Source` implementation
 - `lib/rubygems_plugin.rb` — RubyGems plugin: monkey-patches for `--source myvault.gemv` support
@@ -69,7 +70,7 @@ gem install --source file:///path/to/myvault.gemv foo
 
 ## Key Design Decisions
 
-- SQLite storage — random access, ACID, single file, inspectable with `sqlite3` CLI
+- Tar storage — portable, dependency-free, single file, inspectable with `tar`; legacy SQLite vaults readable via lazily-loaded sqlite3
 - Specs extracted from gem blobs at runtime (no separate spec storage)
 - Vault opened/closed per operation in the source plugin (no persistent connection)
 - `fetch_gemspec_files` checks installed state — Bundler computes `full_gem_path` as `dirname(loaded_from)`, so `loaded_from` must point inside the gem directory
@@ -93,7 +94,7 @@ Integration tests use a manually-written Bundler plugin index to avoid rubygems.
 
 ## Dependencies
 
-- `bundler` (>= 2.0) — runtime
+- `bundler` — NOT a dependency; the plugin always runs inside an existing Bundler process, and declaring it breaks gem activation under `bundle exec`'s restricted GEM_PATH
 - `command_kit` (~> 0.6) — runtime (CLI)
 - `sqlite3` (~> 2.0) — NOT a runtime dependency; loaded lazily only to read a legacy SQLite (Dbvault) vault. Declared in the Gemfile for development/test.
 - `minitest`, `rake` — development

data/Dockerfile.test

@@ -11,5 +11,15 @@ RUN cd /tmp/build \
     && rm -rf /tmp/build
 
 # sqlite3 is not a gemvault runtime dependency; install it here so the upgrade
-# integration test can build a legacy SQLite (Dbvault) fixture to migrate.
+# integration test can read the committed legacy SQLite (Dbvault) fixture it
+# migrates.
 RUN gem install --no-document sqlite3
+
+# Gem files for integration specs that install the plugin from a local gem
+# index at spec runtime, kept for offline use: command_kit is gemvault's
+# runtime dependency; the bundler gem lets specs simulate distro rubies where
+# bundler is a regular (non-default) gem.
+RUN mkdir -p /opt/gems \
+    && cd /opt/gems \
+    && gem fetch command_kit -v 0.6.0 \
+    && gem fetch bundler -v "$(ruby -rbundler -e 'print Bundler::VERSION')"

data/README.md

@@ -1,10 +1,8 @@
 # Gemvault
 
-A gem server in a file. No HTTP. No infrastructure.
+A file that behaves like a private gem server.
 
-A `.gemv` file is a self-contained archive that contains Ruby gems. Commit it to your repo, drop it on S3, email it, put it on a USB drive — Bundler and RubyGems read from it directly. Private gems without running a server.
-
-New vaults are portable tarballs (no runtime dependencies, works on JRuby); the original SQLite format is still read transparently. See [Vault format versioning](#vault-format-versioning).
+You can commit it to your repo, drop it on S3, email it, put it on a USB drive, or whatever you feel like doing. Bundler and RubyGems read from it directly.
 
 ## Installation
 
@@ -29,7 +27,6 @@ end
 bundle install
 ```
 
-Bundler auto-discovers the `bundler-source-vault` plugin, installs it, and resolves gems from the vault alongside rubygems.org. No extra configuration.
 
 ### RubyGems CLI
 
@@ -67,12 +64,7 @@ gemvault upgrade myvault.gemv --no-backup  # skip the default myvault.gemv.bak c
 
 ## How It Works
 
-A `.gemv` file is a self-contained archive of gem metadata and raw `.gem` blobs. A current-format (tarball) vault has a `manifest.json` first entry followed by the `.gem` files, inspectable with standard tools:
-
-```bash
-tar -tf myvault.gemv                 # tarball (v2) vault
-sqlite3 myvault.gemv "SELECT name, version, platform FROM gems"   # SQLite (v1) vault
-```
+The gemv file is a tarball containing your .gem files and a json manifest. It has no dependencies other than the tar utilities that rubygems provides.
 
 When Bundler sees `type: :vault` in your Gemfile, it auto-installs the `bundler-source-vault` plugin from rubygems.org. The plugin implements the `Bundler::Plugin::API::Source` interface — it reads gemspecs from the vault, participates in dependency resolution, then extracts and installs gems from the vault's blob storage.
 

data/Rakefile

@@ -10,6 +10,14 @@ require "rspec/core/rake_task"
 
 RSpec::Core::RakeTask.new(:spec)
 
+RSpec::Core::RakeTask.new("spec:core") do |t|
+  t.rspec_opts = "--tag ~integration"
+end
+
+RSpec::Core::RakeTask.new("spec:integration") do |t|
+  t.rspec_opts = "--tag integration"
+end
+
 require "rubocop/rake_task"
 RuboCop::RakeTask.new
 
@@ -59,6 +67,7 @@ namespace :shim do
 end
 
 Rake::Task[:spec].enhance ["spec:setup"]
+Rake::Task["spec:integration"].enhance ["spec:setup"]
 Rake::Task[:build].enhance ["shim:build"]
 Rake::Task[:release].enhance ["shim:release"]
 Rake::Task[:clobber].enhance ["spec:teardown"]