rubygems-update 2.0.0.rc.1 → 2.0.0.rc.2

data/lib/rubygems/dependency_installer.rb

@@ -57,13 +57,13 @@ class Gem::DependencyInstaller
   # :build_args:: See Gem::Installer::new
 
   def initialize(options = {})
-    if options[:install_dir] then
-      @gem_home = options[:install_dir]
+    @install_dir = options[:install_dir] || Gem.dir
 
-      # HACK shouldn't change the global settings
-      Gem::Specification.dirs = @gem_home
-      Gem.ensure_gem_subdirectories @gem_home
-      options[:install_dir] = @gem_home # FIX: because we suck and reuse below
+    if options[:install_dir] then
+      # HACK shouldn't change the global settings, needed for -i behavior
+      # maybe move to the install command?  See also github #442
+      Gem::Specification.dirs = @install_dir
+      Gem.ensure_gem_subdirectories @install_dir
     end
 
     options = DEFAULT_OPTIONS.merge options
@@ -91,7 +91,6 @@ class Gem::DependencyInstaller
     @installed_gems = []
     @toplevel_specs = nil
 
-    @install_dir = options[:install_dir] || Gem.dir
     @cache_dir = options[:cache_dir] || @install_dir
 
     # Set with any errors that SpecFetcher finds while search through
@@ -260,7 +259,7 @@ class Gem::DependencyInstaller
     set = Gem::AvailableSet.new
 
     if consider_local?
-      if File.file? gem_name then
+      if gem_name =~ /\.gem$/ and File.file? gem_name then
         src = Gem::Source::SpecificFile.new(gem_name)
         set.add src.spec, src
       else

data/lib/rubygems/errors.rb

@@ -1,8 +1,9 @@
-##
+#--
 # This file contains all the various exceptions and other errors that are used
 # inside of RubyGems.
 #
 # DOC: Confirm _all_
+#++
 
 module Gem
   ##

data/lib/rubygems/ext/builder.rb

@@ -19,6 +19,7 @@ class Gem::Ext::Builder
     mf = Gem.read_binary 'Makefile'
     mf = mf.gsub(/^RUBYARCHDIR\s*=\s*\$[^$]*/, "RUBYARCHDIR = #{dest_path}")
     mf = mf.gsub(/^RUBYLIBDIR\s*=\s*\$[^$]*/, "RUBYLIBDIR = #{dest_path}")
+    mf = mf.gsub(/\s*\S+\.time$/, "")
 
     File.open('Makefile', 'wb') {|f| f.print mf}
 
@@ -42,12 +43,18 @@ class Gem::Ext::Builder
   def self.run(command, results, command_name = nil)
     verbose = Gem.configuration.really_verbose
 
-    if verbose
-      puts(command)
-      system(command)
-    else
-      results << command
-      results << `#{command} #{redirector}`
+    begin
+      # TODO use Process.spawn when ruby 1.8 support is dropped.
+      rubygems_gemdeps, ENV['RUBYGEMS_GEMDEPS'] = ENV['RUBYGEMS_GEMDEPS'], nil
+      if verbose
+        puts(command)
+        system(command)
+      else
+        results << command
+        results << `#{command} #{redirector}`
+      end
+    ensure
+      ENV['RUBYGEMS_GEMDEPS'] = rubygems_gemdeps
     end
 
     unless $?.success? then

data/lib/rubygems/gemcutter_utilities.rb

@@ -27,17 +27,25 @@ module Gem::GemcutterUtilities
     end
   end
 
-  def sign_in
+  def sign_in sign_in_host = self.host
     return if Gem.configuration.rubygems_api_key
 
-    say "Enter your RubyGems.org credentials."
-    say "Don't have an account yet? Create one at http://rubygems.org/sign_up"
+    pretty_host = if Gem::DEFAULT_HOST == sign_in_host then
+                    'RubyGems.org'
+                  else
+                    sign_in_host
+                  end
+
+    say "Enter your #{pretty_host} credentials."
+    say "Don't have an account yet? " +
+        "Create one at https://#{sign_in_host}/sign_up"
 
     email    =              ask "   Email: "
     password = ask_for_password "Password: "
     say "\n"
 
-    response = rubygems_api_request :get, "api/v1/api_key" do |request|
+    response = rubygems_api_request(:get, "api/v1/api_key",
+                                    sign_in_host) do |request|
       request.basic_auth email, password
     end
 

data/lib/rubygems/package.rb

@@ -277,9 +277,13 @@ EOM
   # the security policy.
 
   def digest entry # :nodoc:
-    return unless @checksums
+    algorithms = if @checksums then
+                   @checksums.keys
+                 else
+                   [Gem::Security::DIGEST_NAME]
+                 end
 
-    @checksums.each_key do |algorithm|
+    algorithms.each do |algorithm|
       digester = OpenSSL::Digest.new algorithm
 
       digester << entry.read(16384) until entry.eof?
@@ -473,6 +477,10 @@ EOM
       @security_policy
 
     true
+  rescue Gem::Security::Exception
+    @spec = nil
+    @files = []
+    raise
   rescue Errno::ENOENT => e
     raise Gem::Package::FormatError.new e.message
   rescue Gem::Package::TarInvalidError => e

data/lib/rubygems/package/old.rb

@@ -23,15 +23,18 @@ class Gem::Package::Old < Gem::Package
     require 'zlib'
     Gem.load_yaml
 
-    @gem      = gem
-    @contents = nil
-    @spec     = nil
+    @contents        = nil
+    @gem             = gem
+    @security_policy = nil
+    @spec            = nil
   end
 
   ##
   # A list of file names contained in this gem
 
   def contents
+    verify
+
     return @contents if @contents
 
     open @gem, 'rb' do |io|
@@ -46,6 +49,8 @@ class Gem::Package::Old < Gem::Package
   # Extracts the files in this package into +destination_dir+
 
   def extract_files destination_dir
+    verify
+
     errstr = "Error reading files from gem"
 
     open @gem, 'rb' do |io|
@@ -125,6 +130,8 @@ class Gem::Package::Old < Gem::Package
   # The specification for this gem
 
   def spec
+    verify
+
     return @spec if @spec
 
     yaml = ''
@@ -136,12 +143,36 @@ class Gem::Package::Old < Gem::Package
       end
     end
 
-    @spec = Gem::Specification.from_yaml yaml
-  rescue YAML::SyntaxError => e
-    raise Gem::Exception, "Failed to parse gem specification out of gem file"
+    yaml_error = if RUBY_VERSION < '1.9' then
+                   YAML::ParseError
+                 elsif YAML::ENGINE.yamler == 'syck' then
+                   YAML::ParseError
+                 else
+                   YAML::SyntaxError
+                 end
+
+    begin
+      @spec = Gem::Specification.from_yaml yaml
+    rescue yaml_error => e
+      raise Gem::Exception, "Failed to parse gem specification out of gem file"
+    end
   rescue ArgumentError => e
     raise Gem::Exception, "Failed to parse gem specification out of gem file"
   end
 
+  ##
+  # Raises an exception if a security policy that verifies data is active.
+  # Old format gems cannot be verified as signed.
+
+  def verify
+    return true unless @security_policy
+
+    raise Gem::Security::Exception,
+          'old format gems do not contain signatures and cannot be verified' if
+      @security_policy.verify_data
+
+    true
+  end
+
 end
 

data/lib/rubygems/security/policy.rb

@@ -49,13 +49,18 @@ class Gem::Security::Policy
   # and is valid for the given +time+.
 
   def check_chain chain, time
-    chain.each_cons 2 do |issuer, cert|
-      check_cert cert, issuer, time
-    end
+    raise Gem::Security::Exception, 'missing signing chain' unless chain
+    raise Gem::Security::Exception, 'empty signing chain' if chain.empty?
 
-    true
-  rescue Gem::Security::Exception => e
-    raise Gem::Security::Exception, "invalid signing chain: #{e.message}"
+    begin
+      chain.each_cons 2 do |issuer, cert|
+        check_cert cert, issuer, time
+      end
+
+      true
+    rescue Gem::Security::Exception => e
+      raise Gem::Security::Exception, "invalid signing chain: #{e.message}"
+    end
   end
 
   ##
@@ -74,6 +79,9 @@ class Gem::Security::Policy
   # If the +issuer+ is +nil+ no verification is performed.
 
   def check_cert signer, issuer, time
+    raise Gem::Security::Exception, 'missing signing certificate' unless
+      signer
+
     message = "certificate #{signer.subject}"
 
     if not_before = signer.not_before and not_before > time then
@@ -97,6 +105,12 @@ class Gem::Security::Policy
   # Ensures the public key of +key+ matches the public key in +signer+
 
   def check_key signer, key
+    unless signer and key then
+      return true unless @only_signed
+
+      raise Gem::Security::Exception, 'missing key or signature'
+    end
+
     raise Gem::Security::Exception,
       "certificate #{signer.subject} does not match the signing key" unless
         signer.public_key.to_pem == key.public_key.to_pem
@@ -109,8 +123,12 @@ class Gem::Security::Policy
   # +time+.
 
   def check_root chain, time
+    raise Gem::Security::Exception, 'missing signing chain' unless chain
+
     root = chain.first
 
+    raise Gem::Security::Exception, 'missing root certificate' unless root
+
     raise Gem::Security::Exception,
           "root certificate #{root.subject} is not self-signed " +
           "(issuer #{root.issuer})" if
@@ -124,8 +142,12 @@ class Gem::Security::Policy
   # the digests of the two certificates match according to +digester+
 
   def check_trust chain, digester, trust_dir
+    raise Gem::Security::Exception, 'missing signing chain' unless chain
+
     root = chain.first
 
+    raise Gem::Security::Exception, 'missing root certificate' unless root
+
     path = Gem::Security.trust_dir.cert_path root
 
     unless File.exist? path then
@@ -152,8 +174,8 @@ class Gem::Security::Policy
   end
 
   def inspect # :nodoc:
-    "[Policy: %s - data: %p signer: %p chain: %p root: %p " +
-      "signed-only: %p trusted-only: %p]" % [
+    ("[Policy: %s - data: %p signer: %p chain: %p root: %p " +
+     "signed-only: %p trusted-only: %p]") % [
       @name, @verify_chain, @verify_data, @verify_root, @verify_signer,
       @only_signed, @only_trusted,
     ]
@@ -177,11 +199,16 @@ class Gem::Security::Policy
     trust_dir = opt[:trust_dir]
     time      = Time.now
 
-    signer_digests = digests.find do |algorithm, file_digests|
+    _, signer_digests = digests.find do |algorithm, file_digests|
       file_digests.values.first.name == Gem::Security::DIGEST_NAME
     end
 
-    signer_digests = digests.values.first || {}
+    if @verify_data then
+      raise Gem::Security::Exception, 'no digests provided (probable bug)' if
+        signer_digests.nil? or signer_digests.empty?
+    else
+      signer_digests = {}
+    end
 
     signer = chain.last
 
@@ -195,6 +222,13 @@ class Gem::Security::Policy
 
     check_trust chain, digester, trust_dir if @only_trusted
 
+    signatures.each do |file, _|
+      digest = signer_digests[file]
+
+      raise Gem::Security::Exception, "missing digest for #{file}" unless
+        digest
+    end
+
     signer_digests.each do |file, digest|
       signature = signatures[file]
 

data/lib/rubygems/specification.rb

@@ -656,6 +656,12 @@ class Gem::Specification
 
       @@all = specs.values
 
+      # After a reset, make sure already loaded specs
+      # are still marked as activated.
+      specs = {}
+      Gem.loaded_specs.each_value{|s| specs[s] = true}
+      @@all.each{|s| s.activated = true if specs[s]}
+
       _resort!
     end
     @@all
@@ -898,7 +904,7 @@ class Gem::Specification
       raise Gem::Exception, "YAML data doesn't evaluate to gem specification"
     end
 
-    spec.instance_eval { @specification_version ||= NONEXISTENT_SPECIFICATION_VERSION }
+    spec.specification_version ||= NONEXISTENT_SPECIFICATION_VERSION
     spec.reset_nil_attributes_to_default
 
     spec

data/lib/rubygems/ssl_certs/.document

@@ -0,0 +1 @@
+# Ignore all files in this directory

data/lib/rubygems/test_case.rb

@@ -118,8 +118,8 @@ class Gem::TestCase < MiniTest::Unit::TestCase
     @current_dir = Dir.pwd
     @ui = Gem::MockGemUi.new
 
-    # Need to do this in the project because $SAFE fucks up _everything_
-    tmpdir = File.expand_path("tmp/test")
+    tmpdir = File.expand_path Dir.tmpdir
+    tmpdir.untaint
 
     if ENV['KEEP_FILES'] then
       @tempdir = File.join(tmpdir, "test_rubygems_#{$$}.#{Time.now.to_i}")
@@ -127,11 +127,25 @@ class Gem::TestCase < MiniTest::Unit::TestCase
       @tempdir = File.join(tmpdir, "test_rubygems_#{$$}")
     end
     @tempdir.untaint
+
+    FileUtils.mkdir_p @tempdir
+
+    # This makes the tempdir consistent on OS X.
+    # File.expand_path Dir.tmpdir                      #=> "/var/..."
+    # Dir.chdir Dir.tmpdir do File.expand_path '.' end #=> "/private/var/..."
+    # TODO use File#realpath above instead of #expand_path once 1.8 support is
+    # dropped.
+    Dir.chdir @tempdir do
+      @tempdir = File.expand_path '.'
+      @tempdir.untaint
+    end
+
     @gemhome  = File.join @tempdir, 'gemhome'
     @userhome = File.join @tempdir, 'userhome'
 
-    @orig_ruby = if ruby = ENV['RUBY'] then
-                   Gem.class_eval { ruby, @ruby = @ruby, ruby.dup }
+    @orig_ruby = if ENV['RUBY'] then
+                   ruby = Gem.instance_variable_get :@ruby
+                   Gem.instance_variable_set :@ruby, ENV['RUBY']
                    ruby
                  end
 
@@ -251,7 +265,7 @@ class Gem::TestCase < MiniTest::Unit::TestCase
     ENV['GEM_PATH'] = @orig_gem_path
 
     _ = @orig_ruby
-    Gem.class_eval { @ruby = _ } if _
+    Gem.instance_variable_set :@ruby, @orig_ruby if @orig_ruby
 
     if @orig_ENV_HOME then
       ENV['HOME'] = @orig_ENV_HOME

data/test/rubygems/test_gem.rb

@@ -667,6 +667,25 @@ class TestGem < Gem::TestCase
     assert_equal %w[http://rubygems.org/], Gem.default_sources
   end
 
+  def test_self_detect_gemdeps
+    rubygems_gemdeps, ENV['RUBYGEMS_GEMDEPS'] = ENV['RUBYGEMS_GEMDEPS'], '-'
+
+    FileUtils.mkdir_p 'detect/a/b'
+    FileUtils.mkdir_p 'detect/a/Isolate'
+
+    FileUtils.touch 'detect/Isolate'
+
+    begin
+      Dir.chdir 'detect/a/b'
+
+      assert_empty Gem.detect_gemdeps
+    ensure
+      Dir.chdir @tempdir
+    end
+  ensure
+    ENV['RUBYGEMS_GEMDEPS'] = rubygems_gemdeps
+  end
+
   def test_self_dir
     assert_equal @gemhome, Gem.dir
   end
@@ -959,6 +978,27 @@ class TestGem < Gem::TestCase
     assert_includes Gem::Specification.all_names, @a1.full_name
   end
 
+  def test_self_refresh_keeps_loaded_specs_activated
+    util_make_gems
+
+    a1_spec = @a1.spec_file
+    moved_path = File.join @tempdir, File.basename(a1_spec)
+
+    FileUtils.mv a1_spec, moved_path
+
+    Gem.refresh
+
+    s = Gem::Specification.first
+    s.activate
+
+    Gem.refresh
+
+    Gem::Specification.each{|spec| assert spec.activated? if spec == s}
+
+    Gem.loaded_specs.delete(s)
+    Gem.refresh
+  end
+
   def test_self_ruby_escaping_spaces_in_path
     orig_ruby = Gem.ruby
     orig_bindir = Gem::ConfigMap[:bindir]
@@ -1436,7 +1476,7 @@ class TestGem < Gem::TestCase
     ENV['GEM_PATH'] = path
     ENV['RUBYGEMS_GEMDEPS'] = "-"
 
-    out = `#{Gem.ruby.untaint} -I #{LIB_PATH.untaint} -rubygems -e "p Gem.loaded_specs.values.map(&:full_name).sort"`
+    out = `#{Gem.ruby.dup.untaint} -I #{LIB_PATH.untaint} -rubygems -e "p Gem.loaded_specs.values.map(&:full_name).sort"`
 
     assert_equal '["a-1", "b-1", "c-1"]', out.strip
   end
@@ -1468,7 +1508,7 @@ class TestGem < Gem::TestCase
 
     Dir.mkdir "sub1"
     out = Dir.chdir "sub1" do
-      `#{Gem.ruby.untaint} -I #{LIB_PATH.untaint} -rubygems -e "p Gem.loaded_specs.values.map(&:full_name).sort"`
+      `#{Gem.ruby.dup.untaint} -I #{LIB_PATH.untaint} -rubygems -e "p Gem.loaded_specs.values.map(&:full_name).sort"`
     end
 
     Dir.rmdir "sub1"