rubygems-update 2.6.1 → 3.5.0

data/POLICIES.md

@@ -0,0 +1,135 @@
+## Pull Requests
+
+Contributions to RubyGems are made via GitHub pull requests, which must be
+approved by a project committer other than the author. To approve a PR, a
+maintainer can use GitHubs PR review feature. After that, if the original author
+is happy to merge the PR, she can press the merge button.
+
+## Long-Term Support
+
+RubyGems will support Ruby versions for as long as the Ruby team supports that
+Ruby version. That means that the latest RubyGems release will always support
+the currently-supported Ruby versions, and RubyGems security fixes will be
+released for any RubyGems version that shipped inside a currently-supported
+Ruby version.
+
+### Bugfix Releases
+
+RubyGems generally releases bugfixes from the master branch. We may mix bug
+fixes and new features in the same release. RubyGems does not guarantee it
+will ship bugfix releases for previous minor or major versions.
+
+For example, after RubyGems 2.5 is released, the RubyGems team will not
+provide non-security fixes for RubyGems 2.4, or any earlier versions.
+
+### Security Releases
+
+Security releases will be made for RubyGems minor versions that were included
+in a currently-supported Ruby release.
+
+For example, since RubyGems 2.0 was shipped in Ruby 2.0, RubyGems 2.0 will
+receive security fixes until Ruby 2.0 reaches end-of-life.
+
+### Ruby Version Support
+
+When a Ruby version reaches end-of-life the following minor release of
+RubyGems will drop backwards compatibility with that Ruby version.
+
+For example, since Ruby 2.2 has reached end-of-life, future RubyGems minor
+releases will only support Ruby 2.3 and above. As of this writing RubyGems is
+at version 2.7, so when RubyGems 2.8 is released, it will only support Ruby
+2.3 and later.
+
+## Release Process
+
+### Permissions
+
+You'll need the following environment variables set to release RubyGems &
+Bundler:
+
+* AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY: to be able to push RubyGems zip
+  files to s3 so that they appear at RubyGems [download page].
+
+* GITHUB_RELEASE_PAT: A [GitHub PAT] with repo permissions, in order to push
+  GitHub releases and to use the GitHub API for changelog generation.
+
+[download page]: https://rubygems.org/pages/download
+[GitHub PAT]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token
+
+### Recommendations for security releases
+
+*   Obtain CVE numbers as needed from HackerOne or Red Hat.
+*   Agree on a release date with ruby-core, so patches can be backported to
+    older Ruby versions as needed.
+*   Avoid releasing security updates on Fridays, so platform services don't
+    have to work on weekends.
+*   Continue with the regular release process below.
+
+### Automatic changelog and backport generation
+
+PR labels and titles are used to automatically generate changelogs for patch and
+minor releases.
+
+When releasing, a changelog generation script goes through all PRs that have
+never made it into a release, and selects only the ones with specific labels as
+detailed in the `.changelog.yml` and `bundler/.changelog.yml` files. Those
+particular PRs get backported to the stable branch and included in the release
+changelog.
+
+If PRs don't have a proper label, they won't be backported to patch releases.
+
+If you want a PR to be backported to a patch level release, but don't want to
+include it in the changelog, you can use the special `rubygems: backport` and
+`bundler: backport` labels. For example, this is useful when backporting a PR
+generates conflicts that are solved by backporting another PR with no user
+visible changes. You can use these special labels to also backport the other PR
+and not get any conflicts.
+
+### Steps for patch releases
+
+*   Confirm all PRs that you want backported are properly tagged with `rubygems:
+    <type>` or `bundler: <type>` labels at GitHub.
+*   Run `rake prepare_release[<target_version>]`. This will create a PR to the
+    stable branch with the backports included in the release, and proper
+    changelogs and version bumps. It will also create a PR to merge release
+    changelogs into master.
+*   Once CI passes, merge the release PR, switch to the stable branch and pull
+    the PR just merged.
+*   Release `bundler` with `rake bundler:release`.
+*   Release `rubygems` with `rake release`.
+
+### Steps for minor and major releases
+
+*   Confirm all PRs that you want listed in changelogs are properly tagged with
+    `rubygems: <type>` or `bundler: <type>` labels at GitHub.
+*   Run `rake prepare_release[<target_version>]`. This will create a new stable
+    branch off the master branch, and create a PR to it with the proper version
+    bumps and changelogs. It will also create a PR to merge release changelogs
+    into master.
+*   Replace the stable branch in the workflows with the new stable branch, and
+    push that change to the release PR.
+*   Replace version numbers with the next ".dev" version, and push that change
+    to the master PR.
+*   Once CI passes, merge the release PR, switch to  the stable branch and pull
+    the PR just merged.
+*   Release `bundler` with `rake bundler:release`.
+*   Release `rubygems` with `rake release`.
+
+## Committer Access
+
+RubyGems committers may lose their commit privileges if they are inactive for
+longer than 12 months. Committer permission may be restored upon request by
+having a pull request merged.
+
+This is designed to improve the maintainability of RubyGems by requiring
+committers to maintain familiarity with RubyGems activity and to improve the
+security of RubyGems by preventing idle committers from having their commit
+permissions compromised or exposed.
+
+## Changing These Policies
+
+These policies were set in order to reduce the burden of maintenance and to keep
+committers current with existing development and policies. RubyGems work is
+primarily volunteer-driven which limits the ability to provide long-term
+support. By joining [Ruby Central](https://rubycentral.org/#/portal/signup) you
+can help extend support for older RubyGems versions.

data/README.md

@@ -0,0 +1,112 @@
+# RubyGems [![Maintainability](https://api.codeclimate.com/v1/badges/30f913e9c2dd932132c1/maintainability)](https://codeclimate.com/github/rubygems/rubygems/maintainability)
+
+RubyGems is a package management framework for Ruby.
+
+A package (also known as a library) contains a set of functionality that can be invoked by a Ruby program, such as reading and parsing an XML file.
+We call these packages "gems" and RubyGems is a tool to install, create, manage and load these packages in your Ruby environment.
+
+RubyGems is also a client for [RubyGems.org](https://rubygems.org), a public repository of Gems that allows you to publish a Gem
+that can be shared and used by other developers. See our guide on publishing a Gem at [guides.rubygems.org](https://guides.rubygems.org/publishing/)
+
+## Getting Started
+
+Installing and managing a Gem is done through the `gem` command. To install a Gem such as [Nokogiri](https://github.com/sparklemotion/nokogiri) which lets
+you read and parse XML in Ruby:
+
+    $ gem install nokogiri
+
+RubyGems will download the Nokogiri Gem from RubyGems.org and install it into your Ruby environment.
+
+Finally, inside your Ruby program, load the Nokogiri gem and start parsing your XML:
+
+    require 'nokogiri'
+
+    Nokogiri.XML('<h1>Hello World</h1>')
+
+For more information about how to use RubyGems, see our RubyGems basics guide at [guides.rubygems.org](https://guides.rubygems.org/rubygems-basics/)
+
+## Requirements
+
+* RubyGems supports Ruby 3.0 or later.
+
+## Installation
+
+RubyGems is already installed in your Ruby environment, you can check the version you have installed by running `gem --version` in your terminal emulator.
+
+In some cases Ruby & RubyGems may be provided as OS packages. This is not a
+recommended way to use Ruby & RubyGems. It's better to use a Ruby Version
+Manager, such as [rbenv](https://github.com/rbenv/rbenv) or
+[chruby](https://github.com/postmodern/chruby). If you still want to use the
+version provided by your OS package manager, please also use your OS package
+manager to upgrade rubygems, and disregard any other installation instructions
+given below.
+
+If you would like to manually install RubyGems:
+
+* Download from https://rubygems.org/pages/download, unpack, and `cd` into RubyGems' src
+* OR clone this repository and `cd` into the repository
+
+Install RubyGems by running:
+
+    $ ruby setup.rb
+
+For more details and other options, see:
+
+    $ ruby setup.rb --help
+
+## Upgrading RubyGems
+
+To upgrade to the latest RubyGems, run:
+
+    $ gem update --system
+
+See [UPGRADING](UPGRADING.md) for more details and alternative instructions.
+
+## Release policy
+
+RubyGems and Bundler are released in sync, although they do not share their
+major version number. It is planned that also their major version numbers will
+be sync'ed in the future.
+
+The release policy is somewhat similar to the release policy of Ruby itself:
+
+* Frequent patch releases (every 2-4 weeks) including bug fixes, minor
+  enhancements, small features, or even medium sized features declared as
+  experimental for battle testing.
+* Yearly minor releases including bigger features, and minor breaking changes
+  (affecting only edge cases and a very small set of users).
+* Occasional major releases (replacing yearly minors) including major breaking
+  changes.
+
+## Documentation
+
+RubyGems uses [rdoc](https://github.com/rdoc/rdoc) for documentation. A compiled set of the docs
+can be viewed online at [rubydoc](https://www.rubydoc.info/github/rubygems/rubygems).
+
+RubyGems also provides a comprehensive set of guides which covers numerous topics such as
+creating a new gem, security practices and other resources at https://guides.rubygems.org
+
+## Getting Help
+
+### Filing Tickets
+
+Got a bug and you're not sure?  You're sure you have a bug, but don't know
+what to do next?  In any case, let us know about it!  The best place
+for letting the RubyGems team know about bugs or problems you're having is
+[on the RubyGems issues page at GitHub](https://github.com/rubygems/rubygems/issues).
+
+### Bundler Compatibility
+
+See https://bundler.io/compatibility for known issues.
+
+### Supporting
+
+RubyGems is managed by [Ruby Central](https://rubycentral.org), a non-profit organization that supports the Ruby community through projects like this one, as well as [RubyConf](https://rubyconf.org), [RailsConf](https://railsconf.org), and [RubyGems.org](https://rubygems.org). You can support Ruby Central by attending or [sponsoring](sponsors@rubycentral.org) a conference, or by [joining as a supporting member](https://rubycentral.org/#/portal/signup).
+
+### Contributing
+
+If you'd like to contribute to RubyGems, that's awesome, and we <3 you. Check out our [guide to contributing](CONTRIBUTING.md) for more information.
+
+### Code of Conduct
+
+Everyone interacting in the RubyGems project’s codebases, issue trackers, chat rooms, and mailing lists is expected to follow the [contributor code of conduct](https://github.com/rubygems/rubygems/blob/master/CODE_OF_CONDUCT.md).

data/UPGRADING.md

@@ -0,0 +1,15 @@
+# How to upgrade/downgrade Rubygems:
+
+## Downgrade Recipe
+
+    $ gem update --system 3.1.4
+
+## Upgrade Recipe
+
+    $ gem update --system
+
+## Install from source
+
+*   Download from: https://rubygems.org/pages/download
+*   Unpack into a directory and `cd` there
+*   Install with: `ruby setup.rb`