rubygems-update 2.6.1 → 3.5.0

data/bundler/lib/bundler/checksum.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Checksum
+    ALGO_SEPARATOR = "="
+    DEFAULT_ALGORITHM = "sha256"
+    private_constant :DEFAULT_ALGORITHM
+    DEFAULT_BLOCK_SIZE = 16_384
+    private_constant :DEFAULT_BLOCK_SIZE
+
+    class << self
+      def from_gem_package(gem_package, algo = DEFAULT_ALGORITHM)
+        return if Bundler.settings[:disable_checksum_validation]
+        return unless source = gem_package.instance_variable_get(:@gem)
+        return unless source.respond_to?(:with_read_io)
+
+        source.with_read_io do |io|
+          from_gem(io, source.path)
+        ensure
+          io.rewind
+        end
+      end
+
+      def from_gem(io, pathname, algo = DEFAULT_ALGORITHM)
+        digest = Bundler::SharedHelpers.digest(algo.upcase).new
+        buf = String.new(capacity: DEFAULT_BLOCK_SIZE)
+        digest << io.readpartial(DEFAULT_BLOCK_SIZE, buf) until io.eof?
+        Checksum.new(algo, digest.hexdigest!, Source.new(:gem, pathname))
+      end
+
+      def from_api(digest, source_uri, algo = DEFAULT_ALGORITHM)
+        return if Bundler.settings[:disable_checksum_validation]
+        Checksum.new(algo, to_hexdigest(digest, algo), Source.new(:api, source_uri))
+      end
+
+      def from_lock(lock_checksum, lockfile_location)
+        algo, digest = lock_checksum.strip.split(ALGO_SEPARATOR, 2)
+        Checksum.new(algo, to_hexdigest(digest, algo), Source.new(:lock, lockfile_location))
+      end
+
+      def to_hexdigest(digest, algo = DEFAULT_ALGORITHM)
+        return digest unless algo == DEFAULT_ALGORITHM
+        return digest if digest.match?(/\A[0-9a-f]{64}\z/i)
+        if digest.match?(%r{\A[-0-9a-z_+/]{43}={0,2}\z}i)
+          digest = digest.tr("-_", "+/") # fix urlsafe base64
+          return digest.unpack1("m0").unpack1("H*")
+        end
+        raise ArgumentError, "#{digest.inspect} is not a valid SHA256 hex or base64 digest"
+      end
+    end
+
+    attr_reader :algo, :digest, :sources
+
+    def initialize(algo, digest, source)
+      @algo = algo
+      @digest = digest
+      @sources = [source]
+    end
+
+    def ==(other)
+      match?(other) && other.sources == sources
+    end
+
+    alias_method :eql?, :==
+
+    def match?(other)
+      other.is_a?(self.class) && other.digest == digest && other.algo == algo
+    end
+
+    def hash
+      digest.hash
+    end
+
+    def to_s
+      "#{to_lock} (from #{sources.first}#{", ..." if sources.size > 1})"
+    end
+
+    def to_lock
+      "#{algo}#{ALGO_SEPARATOR}#{digest}"
+    end
+
+    def merge!(other)
+      return nil unless match?(other)
+      @sources.concat(other.sources).uniq!
+      self
+    end
+
+    def formatted_sources
+      sources.join("\n    and ").concat("\n")
+    end
+
+    def removable?
+      sources.all?(&:removable?)
+    end
+
+    def removal_instructions
+      msg = +""
+      i = 1
+      sources.each do |source|
+        msg << "  #{i}. #{source.removal}\n"
+        i += 1
+      end
+      msg << "  #{i}. run `bundle install`\n"
+    end
+
+    def inspect
+      abbr = "#{algo}#{ALGO_SEPARATOR}#{digest[0, 8]}"
+      from = "from #{sources.join(" and ")}"
+      "#<#{self.class}:#{object_id} #{abbr} #{from}>"
+    end
+
+    class Source
+      attr_reader :type, :location
+
+      def initialize(type, location)
+        @type = type
+        @location = location
+      end
+
+      def removable?
+        type == :lock || type == :gem
+      end
+
+      def ==(other)
+        other.is_a?(self.class) && other.type == type && other.location == location
+      end
+
+      # phrased so that the usual string format is grammatically correct
+      #   rake (10.3.2) sha256=abc123 from #{to_s}
+      def to_s
+        case type
+        when :lock
+          "the lockfile CHECKSUMS at #{location}"
+        when :gem
+          "the gem at #{location}"
+        when :api
+          "the API at #{location}"
+        else
+          "#{location} (#{type})"
+        end
+      end
+
+      # A full sentence describing how to remove the checksum
+      def removal
+        case type
+        when :lock
+          "remove the matching checksum in #{location}"
+        when :gem
+          "remove the gem at #{location}"
+        when :api
+          "checksums from #{location} cannot be locally modified, you may need to update your sources"
+        else
+          "remove #{location} (#{type})"
+        end
+      end
+    end
+
+    class Store
+      attr_reader :store
+      protected :store
+
+      def initialize
+        @store = {}
+      end
+
+      def initialize_copy(other)
+        @store = {}
+        other.store.each do |lock_name, checksums|
+          store[lock_name] = checksums.dup
+        end
+      end
+
+      def inspect
+        "#<#{self.class}:#{object_id} size=#{store.size}>"
+      end
+
+      def fetch(spec, algo = DEFAULT_ALGORITHM)
+        store[spec.name_tuple.lock_name]&.fetch(algo, nil)
+      end
+
+      # Replace when the new checksum is from the same source.
+      # The primary purpose of this registering checksums from gems where there are
+      # duplicates of the same gem (according to full_name) in the index.
+      # In particular, this is when 2 gems have two similar platforms, e.g.
+      # "darwin20" and "darwin-20", both of which resolve to darwin-20.
+      # In the Index, the later gem replaces the former, so we do that here.
+      #
+      # However, if the new checksum is from a different source, we register like normal.
+      # This ensures a mismatch error where there are multiple top level sources
+      # that contain the same gem with different checksums.
+      def replace(spec, checksum)
+        return unless checksum
+
+        lock_name = spec.name_tuple.lock_name
+        checksums = (store[lock_name] ||= {})
+        existing = checksums[checksum.algo]
+
+        # we assume only one source because this is used while building the index
+        if !existing || existing.sources.first == checksum.sources.first
+          checksums[checksum.algo] = checksum
+        else
+          register_checksum(lock_name, checksum)
+        end
+      end
+
+      def register(spec, checksum)
+        return unless checksum
+        register_checksum(spec.name_tuple.lock_name, checksum)
+      end
+
+      def merge!(other)
+        other.store.each do |lock_name, checksums|
+          checksums.each do |_algo, checksum|
+            register_checksum(lock_name, checksum)
+          end
+        end
+      end
+
+      def to_lock(spec)
+        lock_name = spec.name_tuple.lock_name
+        if checksums = store[lock_name]
+          "#{lock_name} #{checksums.values.map(&:to_lock).sort.join(",")}"
+        else
+          lock_name
+        end
+      end
+
+      private
+
+      def register_checksum(lock_name, checksum)
+        return unless checksum
+        checksums = (store[lock_name] ||= {})
+        existing = checksums[checksum.algo]
+
+        if !existing
+          checksums[checksum.algo] = checksum
+        elsif existing.merge!(checksum)
+          checksum
+        else
+          raise ChecksumMismatchError.new(lock_name, existing, checksum)
+        end
+      end
+    end
+  end
+end

data/bundler/lib/bundler/ci_detector.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Bundler
+  module CIDetector
+    # NOTE: Any changes made here will need to be made to both lib/rubygems/ci_detector.rb and
+    # bundler/lib/bundler/ci_detector.rb (which are enforced duplicates).
+    # TODO: Drop that duplication once bundler drops support for RubyGems 3.4
+    #
+    # ## Recognized CI providers, their signifiers, and the relevant docs ##
+    #
+    # Travis CI   - CI, TRAVIS            https://docs.travis-ci.com/user/environment-variables/#default-environment-variables
+    # Cirrus CI   - CI, CIRRUS_CI         https://cirrus-ci.org/guide/writing-tasks/#environment-variables
+    # Circle CI   - CI, CIRCLECI          https://circleci.com/docs/variables/#built-in-environment-variables
+    # Gitlab CI   - CI, GITLAB_CI         https://docs.gitlab.com/ee/ci/variables/
+    # AppVeyor    - CI, APPVEYOR          https://www.appveyor.com/docs/environment-variables/
+    # CodeShip    - CI_NAME               https://docs.cloudbees.com/docs/cloudbees-codeship/latest/pro-builds-and-configuration/environment-variables#_default_environment_variables
+    # dsari       - CI, DSARI             https://github.com/rfinnie/dsari#running
+    # Jenkins     - BUILD_NUMBER          https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#using-environment-variables
+    # TeamCity    - TEAMCITY_VERSION      https://www.jetbrains.com/help/teamcity/predefined-build-parameters.html#Predefined+Server+Build+Parameters
+    # Appflow     - CI_BUILD_ID           https://ionic.io/docs/appflow/automation/environments#predefined-environments
+    # TaskCluster - TASKCLUSTER_ROOT_URL  https://docs.taskcluster.net/docs/manual/design/env-vars
+    # Semaphore   - CI, SEMAPHORE         https://docs.semaphoreci.com/ci-cd-environment/environment-variables/
+    # BuildKite   - CI, BUILDKITE         https://buildkite.com/docs/pipelines/environment-variables
+    # GoCD        - GO_SERVER_URL         https://docs.gocd.org/current/faq/dev_use_current_revision_in_build.html
+    # GH Actions  - CI, GITHUB_ACTIONS    https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
+    #
+    # ### Some "standard" ENVs that multiple providers may set ###
+    #
+    # * CI - this is set by _most_ (but not all) CI providers now; it's approaching a standard.
+    # * CI_NAME - Not as frequently used, but some providers set this to specify their own name
+
+    # Any of these being set is a reasonably reliable indicator that we are
+    # executing in a CI environment.
+    ENV_INDICATORS = [
+      "CI",
+      "CI_NAME",
+      "CONTINUOUS_INTEGRATION",
+      "BUILD_NUMBER",
+      "CI_APP_ID",
+      "CI_BUILD_ID",
+      "CI_BUILD_NUMBER",
+      "RUN_ID",
+      "TASKCLUSTER_ROOT_URL",
+    ].freeze
+
+    # For each CI, this env suffices to indicate that we're on _that_ CI's
+    # containers. (A few of them only supply a CI_NAME variable, which is also
+    # nice). And if they set "CI" but we can't tell which one they are, we also
+    # want to know that - a bare "ci" without another token tells us as much.
+    ENV_DESCRIPTORS = {
+      "TRAVIS" => "travis",
+      "CIRCLECI" => "circle",
+      "CIRRUS_CI" => "cirrus",
+      "DSARI" => "dsari",
+      "SEMAPHORE" => "semaphore",
+      "JENKINS_URL" => "jenkins",
+      "BUILDKITE" => "buildkite",
+      "GO_SERVER_URL" => "go",
+      "GITLAB_CI" => "gitlab",
+      "GITHUB_ACTIONS" => "github",
+      "TASKCLUSTER_ROOT_URL" => "taskcluster",
+      "CI" => "ci",
+    }.freeze
+
+    def self.ci?
+      ENV_INDICATORS.any? {|var| ENV.include?(var) }
+    end
+
+    def self.ci_strings
+      matching_names = ENV_DESCRIPTORS.select {|env, _| ENV[env] }.values
+      matching_names << ENV["CI_NAME"].downcase if ENV["CI_NAME"]
+      matching_names.reject(&:empty?).sort.uniq
+    end
+  end
+end

data/bundler/lib/bundler/cli/add.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Bundler
+  class CLI::Add
+    attr_reader :gems, :options, :version
+
+    def initialize(options, gems)
+      @gems = gems
+      @options = options
+      @options[:group] = options[:group].split(",").map(&:strip) unless options[:group].nil?
+      @version = options[:version].split(",").map(&:strip) unless options[:version].nil?
+    end
+
+    def run
+      validate_options!
+      inject_dependencies
+      perform_bundle_install unless options["skip-install"]
+    end
+
+    private
+
+    def perform_bundle_install
+      Installer.install(Bundler.root, Bundler.definition)
+      Bundler.load.cache if Bundler.app_cache.exist?
+    end
+
+    def inject_dependencies
+      dependencies = gems.map {|g| Bundler::Dependency.new(g, version, options) }
+
+      Injector.inject(dependencies,
+        conservative_versioning: options[:version].nil?, # Perform conservative versioning only when version is not specified
+        optimistic: options[:optimistic],
+        strict: options[:strict])
+    end
+
+    def validate_options!
+      raise InvalidOption, "You can not specify `--strict` and `--optimistic` at the same time." if options[:strict] && options[:optimistic]
+
+      # raise error when no gems are specified
+      raise InvalidOption, "Please specify gems to add." if gems.empty?
+
+      version.to_a.each do |v|
+        raise InvalidOption, "Invalid gem requirement pattern '#{v}'" unless Gem::Requirement::PATTERN.match?(v.to_s)
+      end
+    end
+  end
+end

data/bundler/lib/bundler/cli/binstubs.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Bundler
+  class CLI::Binstubs
+    attr_reader :options, :gems
+    def initialize(options, gems)
+      @options = options
+      @gems = gems
+    end
+
+    def run
+      Bundler.definition.validate_runtime!
+      path_option = options["path"]
+      path_option = nil if path_option&.empty?
+      Bundler.settings.set_command_option :bin, path_option if options["path"]
+      Bundler.settings.set_command_option_if_given :shebang, options["shebang"]
+      installer = Installer.new(Bundler.root, Bundler.definition)
+
+      installer_opts = {
+        force: options[:force],
+        binstubs_cmd: true,
+        all_platforms: options["all-platforms"],
+      }
+
+      if options[:all]
+        raise InvalidOption, "Cannot specify --all with specific gems" unless gems.empty?
+        @gems = Bundler.definition.specs.map(&:name)
+        installer_opts.delete(:binstubs_cmd)
+      elsif gems.empty?
+        Bundler.ui.error "`bundle binstubs` needs at least one gem to run."
+        exit 1
+      end
+
+      gems.each do |gem_name|
+        spec = Bundler.definition.specs.find {|s| s.name == gem_name }
+        unless spec
+          raise GemNotFound, Bundler::CLI::Common.gem_not_found_message(
+            gem_name, Bundler.definition.specs
+          )
+        end
+
+        if options[:standalone]
+          if gem_name == "bundler"
+            Bundler.ui.warn("Sorry, Bundler can only be run via RubyGems.") unless options[:all]
+            next
+          end
+
+          Bundler.settings.temporary(path: (Bundler.settings[:path] || Bundler.root)) do
+            installer.generate_standalone_bundler_executable_stubs(spec, installer_opts)
+          end
+        else
+          installer.generate_bundler_executable_stubs(spec, installer_opts)
+        end
+      end
+    end
+  end
+end

data/bundler/lib/bundler/cli/cache.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Bundler
+  class CLI::Cache
+    attr_reader :options
+
+    def initialize(options)
+      @options = options
+    end
+
+    def run
+      Bundler.ui.level = "warn" if options[:quiet]
+      Bundler.settings.set_command_option_if_given :path, options[:path]
+      Bundler.settings.set_command_option_if_given :cache_path, options["cache-path"]
+
+      setup_cache_all
+      install
+
+      # TODO: move cache contents here now that all bundles are locked
+      custom_path = Bundler.settings[:path] if options[:path]
+
+      Bundler.settings.temporary(cache_all_platforms: options["all-platforms"]) do
+        Bundler.load.cache(custom_path)
+      end
+    end
+
+    private
+
+    def install
+      require_relative "install"
+      options = self.options.dup
+      options["local"] = false if Bundler.settings[:cache_all_platforms]
+      options["no-cache"] = true
+      Bundler::CLI::Install.new(options).run
+    end
+
+    def setup_cache_all
+      all = options.fetch(:all, Bundler.feature_flag.cache_all? || nil)
+
+      Bundler.settings.set_command_option_if_given :cache_all, all
+    end
+  end
+end

data/bundler/lib/bundler/cli/check.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Bundler
+  class CLI::Check
+    attr_reader :options
+
+    def initialize(options)
+      @options = options
+    end
+
+    def run
+      Bundler.settings.set_command_option_if_given :path, options[:path]
+
+      definition = Bundler.definition
+      definition.validate_runtime!
+
+      begin
+        definition.resolve_only_locally!
+        not_installed = definition.missing_specs
+      rescue GemNotFound, SolveFailure
+        Bundler.ui.error "Bundler can't satisfy your Gemfile's dependencies."
+        Bundler.ui.warn "Install missing gems with `bundle install`."
+        exit 1
+      end
+
+      if not_installed.any?
+        Bundler.ui.error "The following gems are missing"
+        not_installed.each {|s| Bundler.ui.error " * #{s.name} (#{s.version})" }
+        Bundler.ui.warn "Install missing gems with `bundle install`"
+        exit 1
+      elsif !Bundler.default_lockfile.file? && Bundler.frozen_bundle?
+        Bundler.ui.error "This bundle has been frozen, but there is no #{SharedHelpers.relative_lockfile_path} present"
+        exit 1
+      else
+        Bundler.load.lock(preserve_unknown_sections: true) unless options[:"dry-run"]
+        Bundler.ui.info "The Gemfile's dependencies are satisfied"
+      end
+    end
+  end
+end

data/bundler/lib/bundler/cli/clean.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Bundler
+  class CLI::Clean
+    attr_reader :options
+
+    def initialize(options)
+      @options = options
+    end
+
+    def run
+      require_path_or_force unless options[:"dry-run"]
+      Bundler.load.clean(options[:"dry-run"])
+    end
+
+    protected
+
+    def require_path_or_force
+      return unless Bundler.use_system_gems? && !options[:force]
+      raise InvalidOption, "Cleaning all the gems on your system is dangerous! " \
+        "If you're sure you want to remove every system gem not in this " \
+        "bundle, run `bundle clean --force`."
+    end
+  end
+end

data/bundler/lib/bundler/cli/common.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+module Bundler
+  module CLI::Common
+    def self.output_post_install_messages(messages)
+      return if Bundler.settings["ignore_messages"]
+      messages.to_a.each do |name, msg|
+        print_post_install_message(name, msg) unless Bundler.settings["ignore_messages.#{name}"]
+      end
+    end
+
+    def self.print_post_install_message(name, msg)
+      Bundler.ui.confirm "Post-install message from #{name}:"
+      Bundler.ui.info msg
+    end
+
+    def self.output_fund_metadata_summary
+      return if Bundler.settings["ignore_funding_requests"]
+      definition = Bundler.definition
+      current_dependencies = definition.requested_dependencies
+      current_specs = definition.specs
+
+      count = current_dependencies.count {|dep| current_specs[dep.name].first.metadata.key?("funding_uri") }
+
+      return if count.zero?
+
+      intro = count > 1 ? "#{count} installed gems you directly depend on are" : "#{count} installed gem you directly depend on is"
+      message = "#{intro} looking for funding.\n  Run `bundle fund` for details"
+      Bundler.ui.info message
+    end
+
+    def self.output_without_groups_message(command)
+      return if Bundler.settings[:without].empty?
+      Bundler.ui.confirm without_groups_message(command)
+    end
+
+    def self.without_groups_message(command)
+      command_in_past_tense = command == :install ? "installed" : "updated"
+      groups = Bundler.settings[:without]
+      "Gems in the #{verbalize_groups(groups)} were not #{command_in_past_tense}."
+    end
+
+    def self.verbalize_groups(groups)
+      groups.map! {|g| "'#{g}'" }
+      group_list = [groups[0...-1].join(", "), groups[-1..-1]].
+        reject {|s| s.to_s.empty? }.join(" and ")
+      group_str = groups.size == 1 ? "group" : "groups"
+      "#{group_str} #{group_list}"
+    end
+
+    def self.select_spec(name, regex_match = nil)
+      specs = []
+      regexp = Regexp.new(name) if regex_match
+
+      Bundler.definition.specs.each do |spec|
+        return spec if spec.name == name
+        specs << spec if regexp && spec.name.match?(regexp)
+      end
+
+      default_spec = default_gem_spec(name)
+      specs << default_spec if default_spec
+
+      case specs.count
+      when 0
+        dep_in_other_group = Bundler.definition.current_dependencies.find {|dep|dep.name == name }
+
+        if dep_in_other_group
+          raise GemNotFound, "Could not find gem '#{name}', because it's in the #{verbalize_groups(dep_in_other_group.groups)}, configured to be ignored."
+        else
+          raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
+        end
+      when 1
+        specs.first
+      else
+        ask_for_spec_from(specs)
+      end
+    rescue RegexpError
+      raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
+    end
+
+    def self.default_gem_spec(name)
+      gem_spec = Gem::Specification.find_all_by_name(name).last
+      gem_spec if gem_spec&.default_gem?
+    end
+
+    def self.ask_for_spec_from(specs)
+      specs.each_with_index do |spec, index|
+        Bundler.ui.info "#{index.succ} : #{spec.name}", true
+      end
+      Bundler.ui.info "0 : - exit -", true
+
+      num = Bundler.ui.ask("> ").to_i
+      num > 0 ? specs[num - 1] : nil
+    end
+
+    def self.gem_not_found_message(missing_gem_name, alternatives)
+      require_relative "../similarity_detector"
+      message = "Could not find gem '#{missing_gem_name}'."
+      alternate_names = alternatives.map {|a| a.respond_to?(:name) ? a.name : a }
+      suggestions = SimilarityDetector.new(alternate_names).similar_word_list(missing_gem_name)
+      message += "\nDid you mean #{suggestions}?" if suggestions
+      message
+    end
+
+    def self.ensure_all_gems_in_lockfile!(names, locked_gems = Bundler.locked_gems)
+      return unless locked_gems
+
+      locked_names = locked_gems.specs.map(&:name).uniq
+      names.-(locked_names).each do |g|
+        raise GemNotFound, gem_not_found_message(g, locked_names)
+      end
+    end
+
+    def self.configure_gem_version_promoter(definition, options)
+      patch_level = patch_level_options(options)
+      patch_level << :patch if patch_level.empty? && Bundler.settings[:prefer_patch]
+      raise InvalidOption, "Provide only one of the following options: #{patch_level.join(", ")}" unless patch_level.length <= 1
+
+      definition.gem_version_promoter.tap do |gvp|
+        gvp.level = patch_level.first || :major
+        gvp.strict = options[:strict] || options["filter-strict"]
+        gvp.pre = options[:pre]
+      end
+    end
+
+    def self.patch_level_options(options)
+      [:major, :minor, :patch].select {|v| options.keys.include?(v.to_s) }
+    end
+
+    def self.clean_after_install?
+      clean = Bundler.settings[:clean]
+      return clean unless clean.nil?
+      clean ||= Bundler.feature_flag.auto_clean_without_path? && Bundler.settings[:path].nil?
+      clean &&= !Bundler.use_system_gems?
+      clean
+    end
+  end
+end