rubygems-update 2.6.0 → 3.5.4

data/lib/rubygems/config_file.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems/user_interaction'
-require 'rbconfig'
+require_relative "user_interaction"
+require "rbconfig"
 
 ##
 # Gem::ConfigFile RubyGems options and gem command options from gemrc.
@@ -27,6 +28,7 @@ require 'rbconfig'
 # +:backtrace+:: See #backtrace
 # +:sources+:: Sets Gem::sources
 # +:verbose+:: See #verbose
+# +:concurrent_downloads+:: See #concurrent_downloads
 #
 # gemrc files may exist in various locations and are read and merged in
 # the following order:
@@ -36,25 +38,27 @@ require 'rbconfig'
 # - per environment (gemrc files listed in the GEMRC environment variable)
 
 class Gem::ConfigFile
-
   include Gem::UserInteraction
 
-  DEFAULT_BACKTRACE = false
+  DEFAULT_BACKTRACE = true
   DEFAULT_BULK_THRESHOLD = 1000
   DEFAULT_VERBOSITY = true
   DEFAULT_UPDATE_SOURCES = true
+  DEFAULT_CONCURRENT_DOWNLOADS = 8
+  DEFAULT_CERT_EXPIRATION_LENGTH_DAYS = 365
+  DEFAULT_IPV4_FALLBACK_ENABLED = false
 
   ##
   # For Ruby packagers to set configuration defaults.  Set in
   # rubygems/defaults/operating_system.rb
 
-  OPERATING_SYSTEM_DEFAULTS = {}
+  OPERATING_SYSTEM_DEFAULTS = Gem.operating_system_defaults
 
   ##
   # For Ruby implementers to set configuration defaults.  Set in
   # rubygems/defaults/#{RUBY_ENGINE}.rb
 
-  PLATFORM_DEFAULTS = {}
+  PLATFORM_DEFAULTS = Gem.platform_defaults
 
   # :stopdoc:
 
@@ -63,31 +67,12 @@ class Gem::ConfigFile
       require "etc"
       Etc.sysconfdir
     rescue LoadError, NoMethodError
-      begin
-        # TODO: remove after we drop 1.8.7 and 1.9.1
-        require 'Win32API'
-
-        CSIDL_COMMON_APPDATA = 0x0023
-        path = 0.chr * 260
-        if RUBY_VERSION > '1.9' then
-          SHGetFolderPath = Win32API.new 'shell32', 'SHGetFolderPath', 'PLPLP',
-          'L', :stdcall
-          SHGetFolderPath.call nil, CSIDL_COMMON_APPDATA, nil, 1, path
-        else
-          SHGetFolderPath = Win32API.new 'shell32', 'SHGetFolderPath', 'LLLLP',
-          'L'
-          SHGetFolderPath.call 0, CSIDL_COMMON_APPDATA, 0, 1, path
-        end
-
-        path.strip
-      rescue LoadError
-        RbConfig::CONFIG["sysconfdir"] || "/etc"
-      end
+      RbConfig::CONFIG["sysconfdir"] || "/etc"
     end
 
   # :startdoc:
 
-  SYSTEM_WIDE_CONFIG_FILE = File.join SYSTEM_CONFIG_PATH, 'gemrc'
+  SYSTEM_WIDE_CONFIG_FILE = File.join SYSTEM_CONFIG_PATH, "gemrc"
 
   ##
   # List of arguments supplied to the config file object.
@@ -123,6 +108,11 @@ class Gem::ConfigFile
 
   attr_accessor :verbose
 
+  ##
+  # Number of gem downloads that should be performed concurrently.
+
+  attr_accessor :concurrent_downloads
+
   ##
   # True if we want to update the SourceInfoCache every time, false otherwise
 
@@ -143,6 +133,21 @@ class Gem::ConfigFile
 
   attr_accessor :ssl_ca_cert
 
+  ##
+  # sources to look for gems
+  attr_accessor :sources
+
+  ##
+  # Expiration length to sign a certificate
+
+  attr_accessor :cert_expiration_length_days
+
+  ##
+  # == Experimental ==
+  # Fallback to IPv4 when IPv6 is not reachable or slow (default: false)
+
+  attr_accessor :ipv4_fallback_enabled
+
   ##
   # Path name of directory or file of openssl client certificate, used for remote https connection with client authentication
 
@@ -170,52 +175,44 @@ class Gem::ConfigFile
   # TODO: parse options upstream, pass in options directly
 
   def initialize(args)
-    @config_file_name = nil
-    need_config_file_name = false
-
-    arg_list = []
-
-    args.each do |arg|
-      if need_config_file_name then
-        @config_file_name = arg
-        need_config_file_name = false
-      elsif arg =~ /^--config-file=(.*)/ then
-        @config_file_name = $1
-      elsif arg =~ /^--config-file$/ then
-        need_config_file_name = true
-      else
-        arg_list << arg
-      end
-    end
+    set_config_file_name(args)
 
     @backtrace = DEFAULT_BACKTRACE
     @bulk_threshold = DEFAULT_BULK_THRESHOLD
     @verbose = DEFAULT_VERBOSITY
     @update_sources = DEFAULT_UPDATE_SOURCES
+    @concurrent_downloads = DEFAULT_CONCURRENT_DOWNLOADS
+    @cert_expiration_length_days = DEFAULT_CERT_EXPIRATION_LENGTH_DAYS
+    @ipv4_fallback_enabled = ENV["IPV4_FALLBACK_ENABLED"] == "true" || DEFAULT_IPV4_FALLBACK_ENABLED
 
     operating_system_config = Marshal.load Marshal.dump(OPERATING_SYSTEM_DEFAULTS)
     platform_config = Marshal.load Marshal.dump(PLATFORM_DEFAULTS)
     system_config = load_file SYSTEM_WIDE_CONFIG_FILE
-    user_config = load_file config_file_name.dup.untaint
-    environment_config = (ENV['GEMRC'] || '').split(/[:;]/).inject({}) do |result, file|
-      result.merge load_file file
-    end
+    user_config = load_file config_file_name
+
+    environment_config = (ENV["GEMRC"] || "").
+      split(File::PATH_SEPARATOR).inject({}) do |result, file|
+        result.merge load_file file
+      end
 
     @hash = operating_system_config.merge platform_config
-    unless arg_list.index '--norc'
+    unless args.index "--norc"
       @hash = @hash.merge system_config
       @hash = @hash.merge user_config
       @hash = @hash.merge environment_config
     end
 
-    # HACK these override command-line args, which is bad
-    @backtrace                  = @hash[:backtrace]                  if @hash.key? :backtrace
-    @bulk_threshold             = @hash[:bulk_threshold]             if @hash.key? :bulk_threshold
-    @home                       = @hash[:gemhome]                    if @hash.key? :gemhome
-    @path                       = @hash[:gempath]                    if @hash.key? :gempath
-    @update_sources             = @hash[:update_sources]             if @hash.key? :update_sources
-    @verbose                    = @hash[:verbose]                    if @hash.key? :verbose
-    @disable_default_gem_server = @hash[:disable_default_gem_server] if @hash.key? :disable_default_gem_server
+    # HACK: these override command-line args, which is bad
+    @backtrace                   = @hash[:backtrace]                   if @hash.key? :backtrace
+    @bulk_threshold              = @hash[:bulk_threshold]              if @hash.key? :bulk_threshold
+    @home                        = @hash[:gemhome]                     if @hash.key? :gemhome
+    @path                        = @hash[:gempath]                     if @hash.key? :gempath
+    @update_sources              = @hash[:update_sources]              if @hash.key? :update_sources
+    @verbose                     = @hash[:verbose]                     if @hash.key? :verbose
+    @disable_default_gem_server  = @hash[:disable_default_gem_server]  if @hash.key? :disable_default_gem_server
+    @sources                     = @hash[:sources]                     if @hash.key? :sources
+    @cert_expiration_length_days = @hash[:cert_expiration_length_days] if @hash.key? :cert_expiration_length_days
+    @ipv4_fallback_enabled       = @hash[:ipv4_fallback_enabled]       if @hash.key? :ipv4_fallback_enabled
 
     @ssl_verify_mode  = @hash[:ssl_verify_mode]  if @hash.key? :ssl_verify_mode
     @ssl_ca_cert      = @hash[:ssl_ca_cert]      if @hash.key? :ssl_ca_cert
@@ -224,8 +221,7 @@ class Gem::ConfigFile
     @api_keys         = nil
     @rubygems_api_key = nil
 
-    Gem.sources = @hash[:sources] if @hash.key? :sources
-    handle_arguments arg_list
+    handle_arguments args
   end
 
   ##
@@ -245,9 +241,9 @@ class Gem::ConfigFile
     return if Gem.win_platform? # windows doesn't write 0600 as 0600
     return unless File.exist? credentials_path
 
-    existing_permissions = File.stat(credentials_path).mode & 0777
+    existing_permissions = File.stat(credentials_path).mode & 0o777
 
-    return if existing_permissions == 0600
+    return if existing_permissions == 0o600
 
     alert_error <<-ERROR
 Your gem push credentials file located at:
@@ -274,19 +270,24 @@ if you believe they were disclosed to a third party.
   # Location of RubyGems.org credentials
 
   def credentials_path
-    File.join Gem.user_home, '.gem', 'credentials'
+    credentials = File.join Gem.user_home, ".gem", "credentials"
+    if File.exist? credentials
+      credentials
+    else
+      File.join Gem.data_home, "gem", "credentials"
+    end
   end
 
   def load_api_keys
     check_credentials_permissions
 
-    @api_keys = if File.exist? credentials_path then
-                  load_file(credentials_path)
-                else
-                  @hash
-                end
+    @api_keys = if File.exist? credentials_path
+      load_file(credentials_path)
+    else
+      @hash
+    end
 
-    if @api_keys.key? :rubygems_api_key then
+    if @api_keys.key? :rubygems_api_key
       @rubygems_api_key    = @api_keys[:rubygems_api_key]
       @api_keys[:rubygems] = @api_keys.delete :rubygems_api_key unless
         @api_keys.key? :rubygems
@@ -305,7 +306,7 @@ if you believe they were disclosed to a third party.
   ##
   # Sets the RubyGems.org API key to +api_key+
 
-  def rubygems_api_key= api_key
+  def rubygems_api_key=(api_key)
     set_api_key :rubygems_api_key, api_key
 
     @rubygems_api_key = api_key
@@ -314,39 +315,45 @@ if you believe they were disclosed to a third party.
   ##
   # Set a specific host's API key to +api_key+
 
-  def set_api_key host, api_key
+  def set_api_key(host, api_key)
     check_credentials_permissions
 
     config = load_file(credentials_path).merge(host => api_key)
 
     dirname = File.dirname credentials_path
-    Dir.mkdir(dirname) unless File.exist? dirname
+    require "fileutils"
+    FileUtils.mkdir_p(dirname)
 
-    Gem.load_yaml
-
-    permissions = 0600 & (~File.umask)
-    File.open(credentials_path, 'w', permissions) do |f|
-      f.write config.to_yaml
+    permissions = 0o600 & (~File.umask)
+    File.open(credentials_path, "w", permissions) do |f|
+      f.write self.class.dump_with_rubygems_yaml(config)
     end
 
     load_api_keys # reload
   end
 
-  def load_file(filename)
-    Gem.load_yaml
+  ##
+  # Remove the +~/.gem/credentials+ file to clear all the current sessions.
+
+  def unset_api_key!
+    return false unless File.exist?(credentials_path)
+
+    File.delete(credentials_path)
+  end
 
+  def load_file(filename)
     yaml_errors = [ArgumentError]
-    yaml_errors << Psych::SyntaxError if defined?(Psych::SyntaxError)
 
-    return {} unless filename and File.exist? filename
+    return {} unless filename && !filename.empty? && File.exist?(filename)
 
     begin
-      content = YAML.load(File.read(filename))
-      unless content.kind_of? Hash
+      config = self.class.load_with_rubygems_config_hash(File.read(filename))
+      if config.keys.any? {|k| k.to_s.gsub(%r{https?:\/\/}, "").include?(": ") }
         warn "Failed to load #{filename} because it doesn't contain valid YAML hash"
         return {}
+      else
+        return config
       end
-      return content
     rescue *yaml_errors => e
       warn "Failed to load #{filename}, #{e}"
     rescue Errno::EACCES
@@ -358,7 +365,21 @@ if you believe they were disclosed to a third party.
 
   # True if the backtrace option has been specified, or debug is on.
   def backtrace
-    @backtrace or $DEBUG
+    @backtrace || $DEBUG
+  end
+
+  # Check state file is writable. Creates empty file if not present to ensure we can write to it.
+  def state_file_writable?
+    if File.exist?(state_file_name)
+      File.writable?(state_file_name)
+    else
+      require "fileutils"
+      FileUtils.mkdir_p File.dirname(state_file_name)
+      File.open(state_file_name, "w") {}
+      true
+    end
+  rescue Errno::EACCES
+    false
   end
 
   # The name of the configuration file.
@@ -366,6 +387,25 @@ if you believe they were disclosed to a third party.
     @config_file_name || Gem.config_file
   end
 
+  # The name of the state file.
+  def state_file_name
+    Gem.state_file
+  end
+
+  # Reads time of last update check from state file
+  def last_update_check
+    if File.readable?(state_file_name)
+      File.read(state_file_name).to_i
+    else
+      0
+    end
+  end
+
+  # Writes time of last update check to state file
+  def last_update_check=(timestamp)
+    File.write(state_file_name, timestamp.to_s) if state_file_writable?
+  end
+
   # Delegates to @hash
   def each(&block)
     hash = @hash.dup
@@ -379,7 +419,7 @@ if you believe they were disclosed to a third party.
     yield :backtrace, @backtrace
     yield :bulk_threshold, @bulk_threshold
 
-    yield 'config_file_name', @config_file_name if @config_file_name
+    yield "config_file_name", @config_file_name if @config_file_name
 
     hash.each(&block)
   end
@@ -395,7 +435,7 @@ if you believe they were disclosed to a third party.
       when /^--debug$/ then
         $DEBUG = true
 
-        warn 'NOTE:  Debugging mode prints all exceptions even when rescued'
+        warn "NOTE:  Debugging mode prints all exceptions even when rescued"
       else
         @args << arg
       end
@@ -415,31 +455,14 @@ if you believe they were disclosed to a third party.
   # to_yaml only overwrites things you can't override on the command line.
   def to_yaml # :nodoc:
     yaml_hash = {}
-    yaml_hash[:backtrace] = if @hash.key?(:backtrace)
-                              @hash[:backtrace]
-                            else
-                              DEFAULT_BACKTRACE
-                            end
-
-    yaml_hash[:bulk_threshold] = if @hash.key?(:bulk_threshold)
-                                   @hash[:bulk_threshold]
-                                 else
-                                   DEFAULT_BULK_THRESHOLD
-                                 end
-
+    yaml_hash[:backtrace] = @hash.fetch(:backtrace, DEFAULT_BACKTRACE)
+    yaml_hash[:bulk_threshold] = @hash.fetch(:bulk_threshold, DEFAULT_BULK_THRESHOLD)
     yaml_hash[:sources] = Gem.sources.to_a
+    yaml_hash[:update_sources] = @hash.fetch(:update_sources, DEFAULT_UPDATE_SOURCES)
+    yaml_hash[:verbose] = @hash.fetch(:verbose, DEFAULT_VERBOSITY)
 
-    yaml_hash[:update_sources] = if @hash.key?(:update_sources)
-                                   @hash[:update_sources]
-                                 else
-                                   DEFAULT_UPDATE_SOURCES
-                                 end
-
-    yaml_hash[:verbose] = if @hash.key?(:verbose)
-                            @hash[:verbose]
-                          else
-                            DEFAULT_VERBOSITY
-                          end
+    yaml_hash[:concurrent_downloads] =
+      @hash.fetch(:concurrent_downloads, DEFAULT_CONCURRENT_DOWNLOADS)
 
     yaml_hash[:ssl_verify_mode] =
       @hash[:ssl_verify_mode] if @hash.key? :ssl_verify_mode
@@ -450,22 +473,25 @@ if you believe they were disclosed to a third party.
     yaml_hash[:ssl_client_cert] =
       @hash[:ssl_client_cert] if @hash.key? :ssl_client_cert
 
-    keys = yaml_hash.keys.map { |key| key.to_s }
-    keys << 'debug'
+    keys = yaml_hash.keys.map(&:to_s)
+    keys << "debug"
     re = Regexp.union(*keys)
 
     @hash.each do |key, value|
       key = key.to_s
-      next if key =~ re
+      next if key&.match?(re)
       yaml_hash[key.to_s] = value
     end
 
-    yaml_hash.to_yaml
+    self.class.dump_with_rubygems_yaml(yaml_hash)
   end
 
   # Writes out this config file, replacing its source.
   def write
-    open config_file_name, 'w' do |io|
+    require "fileutils"
+    FileUtils.mkdir_p File.dirname(config_file_name)
+
+    File.open config_file_name, "w" do |io|
       io.write to_yaml
     end
   end
@@ -481,14 +507,83 @@ if you believe they were disclosed to a third party.
   end
 
   def ==(other) # :nodoc:
-    self.class === other and
-      @backtrace == other.backtrace and
-      @bulk_threshold == other.bulk_threshold and
-      @verbose == other.verbose and
-      @update_sources == other.update_sources and
+    self.class === other &&
+      @backtrace == other.backtrace &&
+      @bulk_threshold == other.bulk_threshold &&
+      @verbose == other.verbose &&
+      @update_sources == other.update_sources &&
       @hash == other.hash
   end
 
   attr_reader :hash
   protected :hash
+
+  def self.dump_with_rubygems_yaml(content)
+    content.transform_keys! do |k|
+      k.is_a?(Symbol) ? ":#{k}" : k
+    end
+
+    require_relative "yaml_serializer"
+    Gem::YAMLSerializer.dump(content)
+  end
+
+  def self.load_with_rubygems_config_hash(yaml)
+    require_relative "yaml_serializer"
+
+    content = Gem::YAMLSerializer.load(yaml)
+
+    content.transform_keys! do |k|
+      if k.match?(/\A:(.*)\Z/)
+        k[1..-1].to_sym
+      elsif k.include?("__") || k.match?(%r{/\Z})
+        if k.is_a?(Symbol)
+          k.to_s.gsub(/__/,".").gsub(%r{/\Z}, "").to_sym
+        else
+          k.dup.gsub(/__/,".").gsub(%r{/\Z}, "")
+        end
+      else
+        k
+      end
+    end
+
+    content.transform_values! do |v|
+      if v.is_a?(String)
+        if v.match?(/\A:(.*)\Z/)
+          v[1..-1].to_sym
+        elsif v.match?(/\A[+-]?\d+\Z/)
+          v.to_i
+        elsif v.match?(/\Atrue|false\Z/)
+          v == "true"
+        elsif v.empty?
+          nil
+        else
+          v
+        end
+      elsif v.is_a?(Hash) && v.empty?
+        nil
+      else
+        v
+      end
+    end
+
+    content
+  end
+
+  private
+
+  def set_config_file_name(args)
+    @config_file_name = ENV["GEMRC"]
+    need_config_file_name = false
+
+    args.each do |arg|
+      if need_config_file_name
+        @config_file_name = arg
+        need_config_file_name = false
+      elsif arg =~ /^--config-file=(.*)/
+        @config_file_name = $1
+      elsif /^--config-file$/.match?(arg)
+        need_config_file_name = true
+      end
+    end
+  end
 end

data/lib/rubygems/core_ext/kernel_gem.rb

@@ -1,15 +1,6 @@
 # frozen_string_literal: true
-##
-# RubyGems adds the #gem method to allow activation of specific gem versions
-# and overrides the #require method on Kernel to make gems appear as if they
-# live on the <code>$LOAD_PATH</code>.  See the documentation of these methods
-# for further detail.
 
 module Kernel
-
-  # REFACTOR: This should be pulled out into some kind of hacks file.
-  remove_method :gem if 'method' == defined? gem # from gem_prelude.rb on 1.9
-
   ##
   # Use Kernel#gem to activate a specific version of +gem_name+.
   #
@@ -42,12 +33,12 @@ module Kernel
   #   GEM_SKIP=libA:libB ruby -I../libA -I../libB ./mycode.rb
 
   def gem(gem_name, *requirements) # :doc:
-    skip_list = (ENV['GEM_SKIP'] || "").split(/:/)
+    skip_list = (ENV["GEM_SKIP"] || "").split(/:/)
     raise Gem::LoadError, "skipping #{gem_name}" if skip_list.include? gem_name
 
-    if gem_name.kind_of? Gem::Dependency
+    if gem_name.is_a? Gem::Dependency
       unless Gem::Deprecate.skip
-        warn "#{Gem.location_of_caller.join ':'}:Warning: Kernel.gem no longer "\
+        warn "#{Gem.location_of_caller.join ":"}:Warning: Kernel.gem no longer "\
           "accepts a Gem::Dependency object, please pass the name "\
           "and requirements directly"
       end
@@ -64,11 +55,14 @@ module Kernel
 
     spec = dep.to_spec
 
-    Gem::LOADED_SPECS_MUTEX.synchronize {
-      spec.activate
-    } if spec
+    if spec
+      if Gem::LOADED_SPECS_MUTEX.owned?
+        spec.activate
+      else
+        Gem::LOADED_SPECS_MUTEX.synchronize { spec.activate }
+      end
+    end
   end
 
   private :gem
-
 end