rubygems-update 2.6.1 → 3.5.0

data/lib/rubygems/specification_policy.rb

@@ -0,0 +1,538 @@
+# frozen_string_literal: true
+
+require_relative "user_interaction"
+
+class Gem::SpecificationPolicy
+  include Gem::UserInteraction
+
+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:
+
+  SPECIAL_CHARACTERS = /\A[#{Regexp.escape('.-_')}]+/ # :nodoc:
+
+  VALID_URI_PATTERN = %r{\Ahttps?:\/\/([^\s:@]+:[^\s:@]*@)?[A-Za-z\d\-]+(\.[A-Za-z\d\-]+)+\.?(:\d{1,5})?([\/?]\S*)?\z} # :nodoc:
+
+  METADATA_LINK_KEYS = %w[
+    homepage_uri
+    changelog_uri
+    source_code_uri
+    documentation_uri
+    wiki_uri
+    mailing_list_uri
+    bug_tracker_uri
+    download_uri
+    funding_uri
+  ].freeze # :nodoc:
+
+  def initialize(specification)
+    @warnings = 0
+
+    @specification = specification
+  end
+
+  ##
+  # If set to true, run packaging-specific checks, as well.
+
+  attr_accessor :packaging
+
+  ##
+  # Does a sanity check on the specification.
+  #
+  # Raises InvalidSpecificationException if the spec does not pass the
+  # checks.
+  #
+  # It also performs some validations that do not raise but print warning
+  # messages instead.
+
+  def validate(strict = false)
+    validate_required!
+
+    validate_optional(strict) if packaging || strict
+
+    true
+  end
+
+  ##
+  # Does a sanity check on the specification.
+  #
+  # Raises InvalidSpecificationException if the spec does not pass the
+  # checks.
+  #
+  # Only runs checks that are considered necessary for the specification to be
+  # functional.
+
+  def validate_required!
+    validate_nil_attributes
+
+    validate_rubygems_version
+
+    validate_required_attributes
+
+    validate_name
+
+    validate_require_paths
+
+    @specification.keep_only_files_and_directories
+
+    validate_non_files
+
+    validate_self_inclusion_in_files_list
+
+    validate_specification_version
+
+    validate_platform
+
+    validate_array_attributes
+
+    validate_authors_field
+
+    validate_metadata
+
+    validate_licenses_length
+
+    validate_lazy_metadata
+
+    validate_duplicate_dependencies
+  end
+
+  def validate_optional(strict)
+    validate_licenses
+
+    validate_permissions
+
+    validate_values
+
+    validate_dependencies
+
+    validate_extensions
+
+    validate_removed_attributes
+
+    validate_unique_links
+
+    if @warnings > 0
+      if strict
+        error "specification has warnings"
+      else
+        alert_warning help_text
+      end
+    end
+  end
+
+  ##
+  # Implementation for Specification#validate_metadata
+
+  def validate_metadata
+    metadata = @specification.metadata
+
+    unless Hash === metadata
+      error "metadata must be a hash"
+    end
+
+    metadata.each do |key, value|
+      entry = "metadata['#{key}']"
+      unless key.is_a?(String)
+        error "metadata keys must be a String"
+      end
+
+      if key.size > 128
+        error "metadata key is too large (#{key.size} > 128)"
+      end
+
+      unless value.is_a?(String)
+        error "#{entry} value must be a String"
+      end
+
+      if value.size > 1024
+        error "#{entry} value is too large (#{value.size} > 1024)"
+      end
+
+      next unless METADATA_LINK_KEYS.include? key
+      unless VALID_URI_PATTERN.match?(value)
+        error "#{entry} has invalid link: #{value.inspect}"
+      end
+    end
+  end
+
+  ##
+  # Checks that no duplicate dependencies are specified.
+
+  def validate_duplicate_dependencies # :nodoc:
+    # NOTE: see REFACTOR note in Gem::Dependency about types - this might be brittle
+    seen = Gem::Dependency::TYPES.inject({}) {|types, type| types.merge({ type => {} }) }
+
+    error_messages = []
+    @specification.dependencies.each do |dep|
+      if prev = seen[dep.type][dep.name]
+        error_messages << <<-MESSAGE
+duplicate dependency on #{dep}, (#{prev.requirement}) use:
+    add_#{dep.type}_dependency \"#{dep.name}\", \"#{dep.requirement}\", \"#{prev.requirement}\"
+        MESSAGE
+      end
+
+      seen[dep.type][dep.name] = dep
+    end
+    if error_messages.any?
+      error error_messages.join
+    end
+  end
+
+  ##
+  # Checks that the gem does not depend on itself.
+  # Checks that dependencies use requirements as we recommend.  Warnings are
+  # issued when dependencies are open-ended or overly strict for semantic
+  # versioning.
+
+  def validate_dependencies # :nodoc:
+    warning_messages = []
+    @specification.dependencies.each do |dep|
+      if dep.name == @specification.name # warn on self reference
+        warning_messages << "Self referencing dependency is unnecessary and strongly discouraged."
+      end
+
+      prerelease_dep = dep.requirements_list.any? do |req|
+        Gem::Requirement.new(req).prerelease?
+      end
+
+      warning_messages << "prerelease dependency on #{dep} is not recommended" if
+          prerelease_dep && !@specification.version.prerelease?
+
+      open_ended = dep.requirement.requirements.all? do |op, version|
+        !version.prerelease? && [">", ">="].include?(op)
+      end
+
+      next unless open_ended
+      op, dep_version = dep.requirement.requirements.first
+
+      segments = dep_version.segments
+
+      base = segments.first 2
+
+      recommendation = if [">", ">="].include?(op) && segments == [0]
+        "  use a bounded requirement, such as \"~> x.y\""
+      else
+        bugfix = if op == ">"
+          ", \"> #{dep_version}\""
+        elsif op == ">=" && base != segments
+          ", \">= #{dep_version}\""
+        end
+
+        "  if #{dep.name} is semantically versioned, use:\n" \
+        "    add_#{dep.type}_dependency \"#{dep.name}\", \"~> #{base.join "."}\"#{bugfix}"
+      end
+
+      warning_messages << ["open-ended dependency on #{dep} is not recommended", recommendation].join("\n") + "\n"
+    end
+    if warning_messages.any?
+      warning_messages.each {|warning_message| warning warning_message }
+    end
+  end
+
+  ##
+  # Issues a warning for each file to be packaged which is world-readable.
+  #
+  # Implementation for Specification#validate_permissions
+
+  def validate_permissions
+    return if Gem.win_platform?
+
+    @specification.files.each do |file|
+      next unless File.file?(file)
+      next if File.stat(file).mode & 0o444 == 0o444
+      warning "#{file} is not world-readable"
+    end
+
+    @specification.executables.each do |name|
+      exec = File.join @specification.bindir, name
+      next unless File.file?(exec)
+      next if File.stat(exec).executable?
+      warning "#{exec} is not executable"
+    end
+  end
+
+  private
+
+  def validate_nil_attributes
+    nil_attributes = Gem::Specification.non_nil_attributes.select do |attrname|
+      @specification.instance_variable_get("@#{attrname}").nil?
+    end
+    return if nil_attributes.empty?
+    error "#{nil_attributes.join ", "} must not be nil"
+  end
+
+  def validate_rubygems_version
+    return unless packaging
+
+    rubygems_version = @specification.rubygems_version
+
+    return if rubygems_version == Gem::VERSION
+
+    error "expected RubyGems version #{Gem::VERSION}, was #{rubygems_version}"
+  end
+
+  def validate_required_attributes
+    Gem::Specification.required_attributes.each do |symbol|
+      unless @specification.send symbol
+        error "missing value for attribute #{symbol}"
+      end
+    end
+  end
+
+  def validate_name
+    name = @specification.name
+
+    if !name.is_a?(String)
+      error "invalid value for attribute name: \"#{name.inspect}\" must be a string"
+    elsif !/[a-zA-Z]/.match?(name)
+      error "invalid value for attribute name: #{name.dump} must include at least one letter"
+    elsif !VALID_NAME_PATTERN.match?(name)
+      error "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"
+    elsif SPECIAL_CHARACTERS.match?(name)
+      error "invalid value for attribute name: #{name.dump} can not begin with a period, dash, or underscore"
+    end
+  end
+
+  def validate_require_paths
+    return unless @specification.raw_require_paths.empty?
+
+    error "specification must have at least one require_path"
+  end
+
+  def validate_non_files
+    return unless packaging
+
+    non_files = @specification.files.reject {|x| File.file?(x) || File.symlink?(x) }
+
+    unless non_files.empty?
+      error "[\"#{non_files.join "\", \""}\"] are not files"
+    end
+  end
+
+  def validate_self_inclusion_in_files_list
+    file_name = @specification.file_name
+
+    return unless @specification.files.include?(file_name)
+
+    error "#{@specification.full_name} contains itself (#{file_name}), check your files list"
+  end
+
+  def validate_specification_version
+    return if @specification.specification_version.is_a?(Integer)
+
+    error "specification_version must be an Integer (did you mean version?)"
+  end
+
+  def validate_platform
+    platform = @specification.platform
+
+    case platform
+    when Gem::Platform, Gem::Platform::RUBY # ok
+    else
+      error "invalid platform #{platform.inspect}, see Gem::Platform"
+    end
+  end
+
+  def validate_array_attributes
+    Gem::Specification.array_attributes.each do |field|
+      validate_array_attribute(field)
+    end
+  end
+
+  def validate_array_attribute(field)
+    val = @specification.send(field)
+    klass = case field
+            when :dependencies then
+              Gem::Dependency
+            else
+              String
+    end
+
+    unless Array === val && val.all? {|x| x.is_a?(klass) || (field == :licenses && x.nil?) }
+      error "#{field} must be an Array of #{klass}"
+    end
+  end
+
+  def validate_authors_field
+    return unless @specification.authors.empty?
+
+    error "authors may not be empty"
+  end
+
+  def validate_licenses_length
+    licenses = @specification.licenses
+
+    licenses.each do |license|
+      next if license.nil?
+
+      if license.length > 64
+        error "each license must be 64 characters or less"
+      end
+    end
+  end
+
+  def validate_licenses
+    licenses = @specification.licenses
+
+    licenses.each do |license|
+      next if Gem::Licenses.match?(license) || license.nil?
+      license_id_deprecated = Gem::Licenses.deprecated_license_id?(license)
+      exception_id_deprecated = Gem::Licenses.deprecated_exception_id?(license)
+      suggestions = Gem::Licenses.suggestions(license)
+
+      if license_id_deprecated
+        main_message = "License identifier '#{license}' is deprecated"
+      elsif exception_id_deprecated
+        main_message = "Exception identifier at '#{license}' is deprecated"
+      else
+        main_message = "License identifier '#{license}' is invalid"
+      end
+
+      message = <<-WARNING
+#{main_message}. Use an identifier from
+https://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license,
+or set it to nil if you don't want to specify a license.
+      WARNING
+      message += "Did you mean #{suggestions.map {|s| "'#{s}'" }.join(", ")}?\n" unless suggestions.nil?
+      warning(message)
+    end
+
+    warning <<-WARNING if licenses.empty?
+licenses is empty, but is recommended. Use an license identifier from
+https://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license,
+or set it to nil if you don't want to specify a license.
+    WARNING
+  end
+
+  LAZY = '"FIxxxXME" or "TOxxxDO"'.gsub(/xxx/, "")
+  LAZY_PATTERN = /\AFI XME|\ATO DO/x
+  HOMEPAGE_URI_PATTERN = /\A[a-z][a-z\d+.-]*:/i
+
+  def validate_lazy_metadata
+    unless @specification.authors.grep(LAZY_PATTERN).empty?
+      error "#{LAZY} is not an author"
+    end
+
+    unless Array(@specification.email).grep(LAZY_PATTERN).empty?
+      error "#{LAZY} is not an email"
+    end
+
+    if LAZY_PATTERN.match?(@specification.description)
+      error "#{LAZY} is not a description"
+    end
+
+    if LAZY_PATTERN.match?(@specification.summary)
+      error "#{LAZY} is not a summary"
+    end
+
+    homepage = @specification.homepage
+
+    # Make sure a homepage is valid HTTP/HTTPS URI
+    if homepage && !homepage.empty?
+      require "uri"
+      begin
+        homepage_uri = URI.parse(homepage)
+        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+          error "\"#{homepage}\" is not a valid HTTP URI"
+        end
+      rescue URI::InvalidURIError
+        error "\"#{homepage}\" is not a valid HTTP URI"
+      end
+    end
+  end
+
+  def validate_values
+    %w[author homepage summary files].each do |attribute|
+      validate_attribute_present(attribute)
+    end
+
+    if @specification.description == @specification.summary
+      warning "description and summary are identical"
+    end
+
+    # TODO: raise at some given date
+    warning "deprecated autorequire specified" if @specification.autorequire
+
+    @specification.executables.each do |executable|
+      validate_shebang_line_in(executable)
+    end
+
+    @specification.files.select {|f| File.symlink?(f) }.each do |file|
+      warning "#{file} is a symlink, which is not supported on all platforms"
+    end
+  end
+
+  def validate_attribute_present(attribute)
+    value = @specification.send attribute
+    warning("no #{attribute} specified") if value.nil? || value.empty?
+  end
+
+  def validate_shebang_line_in(executable)
+    executable_path = File.join(@specification.bindir, executable)
+    return if File.read(executable_path, 2) == "#!"
+
+    warning "#{executable_path} is missing #! line"
+  end
+
+  def validate_removed_attributes # :nodoc:
+    @specification.removed_method_calls.each do |attr|
+      warning("#{attr} is deprecated and ignored. Please remove this from your gemspec to ensure that your gem continues to build in the future.")
+    end
+  end
+
+  def validate_extensions # :nodoc:
+    require_relative "ext"
+    builder = Gem::Ext::Builder.new(@specification)
+
+    validate_rake_extensions(builder)
+    validate_rust_extensions(builder)
+  end
+
+  def validate_rust_extensions(builder) # :nodoc:
+    rust_extension = @specification.extensions.any? {|s| builder.builder_for(s).is_a? Gem::Ext::CargoBuilder }
+    missing_cargo_lock = !@specification.files.any? {|f| f.end_with?("Cargo.lock") }
+
+    error <<-ERROR if rust_extension && missing_cargo_lock
+You have specified rust based extension, but Cargo.lock is not part of the gem files. Please run `cargo generate-lockfile` or any other command to generate Cargo.lock and ensure it is added to your gem files section in gemspec.
+    ERROR
+  end
+
+  def validate_rake_extensions(builder) # :nodoc:
+    rake_extension = @specification.extensions.any? {|s| builder.builder_for(s) == Gem::Ext::RakeBuilder }
+    rake_dependency = @specification.dependencies.any? {|d| d.name == "rake" }
+
+    warning <<-WARNING if rake_extension && !rake_dependency
+You have specified rake based extension, but rake is not added as dependency. It is recommended to add rake as a dependency in gemspec since there's no guarantee rake will be already installed.
+    WARNING
+  end
+
+  def validate_unique_links
+    links = @specification.metadata.slice(*METADATA_LINK_KEYS)
+    grouped = links.group_by {|_key, uri| uri }
+    grouped.each do |uri, copies|
+      next unless copies.length > 1
+      keys = copies.map(&:first).join("\n  ")
+      warning <<~WARNING
+        You have specified the uri:
+          #{uri}
+        for all of the following keys:
+          #{keys}
+        Only the first one will be shown on rubygems.org
+      WARNING
+    end
+  end
+
+  def warning(statement) # :nodoc:
+    @warnings += 1
+
+    alert_warning statement
+  end
+
+  def error(statement) # :nodoc:
+    raise Gem::InvalidSpecificationException, statement
+  ensure
+    alert_warning help_text
+  end
+
+  def help_text # :nodoc:
+    "See https://guides.rubygems.org/specification-reference/ for help"
+  end
+end

data/lib/rubygems/ssl_certs/rubygems.org/GlobalSignRootCA.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
+MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
+aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
+jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
+xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
+1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
+snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
+U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
+9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
+AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
+yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
+38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
+AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
+DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
+HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
+-----END CERTIFICATE-----

data/lib/rubygems/ssl_certs/rubygems.org/GlobalSignRootCA_R3.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
+A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
+Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
+MTAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEG
+A1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5BngiFvXAg7aEyiie/QV2EcWtiHL8
+RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X17YUhhB5uzsT
+gHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm
+KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zd
+QQ4gOsC0p6Hpsk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZ
+XriX7613t2Saer9fwRPvm2L7DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAw
+DgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFI/wS3+o
+LkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBLQNvAUKr+yAzv95ZU
+RUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25sbwMp
+jjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK
+6fBdRoyV3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQX
+mcIfeg7jLQitChws/zyrVQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecs
+Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
+WD9f
+-----END CERTIFICATE-----