rubygems-update 2.6.3 → 2.7.7

data/bundler/lib/bundler/source_list.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+module Bundler
+  class SourceList
+    attr_reader :path_sources,
+      :git_sources,
+      :plugin_sources,
+      :global_rubygems_source,
+      :metadata_source
+
+    def initialize
+      @path_sources           = []
+      @git_sources            = []
+      @plugin_sources         = []
+      @global_rubygems_source = nil
+      @rubygems_aggregate     = rubygems_aggregate_class.new
+      @rubygems_sources       = []
+      @metadata_source        = Source::Metadata.new
+    end
+
+    def add_path_source(options = {})
+      if options["gemspec"]
+        add_source_to_list Source::Gemspec.new(options), path_sources
+      else
+        add_source_to_list Source::Path.new(options), path_sources
+      end
+    end
+
+    def add_git_source(options = {})
+      add_source_to_list(Source::Git.new(options), git_sources).tap do |source|
+        warn_on_git_protocol(source)
+      end
+    end
+
+    def add_rubygems_source(options = {})
+      add_source_to_list Source::Rubygems.new(options), @rubygems_sources
+    end
+
+    def add_plugin_source(source, options = {})
+      add_source_to_list Plugin.source(source).new(options), @plugin_sources
+    end
+
+    def global_rubygems_source=(uri)
+      if Bundler.feature_flag.lockfile_uses_separate_rubygems_sources?
+        @global_rubygems_source ||= rubygems_aggregate_class.new("remotes" => uri)
+      end
+      add_rubygems_remote(uri)
+    end
+
+    def add_rubygems_remote(uri)
+      if Bundler.feature_flag.lockfile_uses_separate_rubygems_sources?
+        return if Bundler.feature_flag.disable_multisource?
+        raise InvalidOption, "`lockfile_uses_separate_rubygems_sources` cannot be set without `disable_multisource` being set"
+      end
+      @rubygems_aggregate.add_remote(uri)
+      @rubygems_aggregate
+    end
+
+    def default_source
+      global_rubygems_source || @rubygems_aggregate
+    end
+
+    def rubygems_sources
+      @rubygems_sources + [default_source]
+    end
+
+    def rubygems_remotes
+      rubygems_sources.map(&:remotes).flatten.uniq
+    end
+
+    def all_sources
+      path_sources + git_sources + plugin_sources + rubygems_sources + [metadata_source]
+    end
+
+    def get(source)
+      source_list_for(source).find {|s| equal_source?(source, s) || equivalent_source?(source, s) }
+    end
+
+    def lock_sources
+      if Bundler.feature_flag.lockfile_uses_separate_rubygems_sources?
+        [[default_source], @rubygems_sources, git_sources, path_sources, plugin_sources].map do |sources|
+          sources.sort_by(&:to_s)
+        end.flatten(1)
+      else
+        lock_sources = (path_sources + git_sources + plugin_sources).sort_by(&:to_s)
+        lock_sources << combine_rubygems_sources
+      end
+    end
+
+    # Returns true if there are changes
+    def replace_sources!(replacement_sources)
+      return true if replacement_sources.empty?
+
+      [path_sources, git_sources, plugin_sources].each do |source_list|
+        source_list.map! do |source|
+          replacement_sources.find {|s| s == source } || source
+        end
+      end
+
+      replacement_rubygems = !Bundler.feature_flag.lockfile_uses_separate_rubygems_sources? &&
+        replacement_sources.detect {|s| s.is_a?(Source::Rubygems) }
+      @rubygems_aggregate = replacement_rubygems if replacement_rubygems
+
+      return true if !equal_sources?(lock_sources, replacement_sources) && !equivalent_sources?(lock_sources, replacement_sources)
+      return true if replacement_rubygems && rubygems_remotes.to_set != replacement_rubygems.remotes.to_set
+
+      false
+    end
+
+    def cached!
+      all_sources.each(&:cached!)
+    end
+
+    def remote!
+      all_sources.each(&:remote!)
+    end
+
+    def rubygems_primary_remotes
+      @rubygems_aggregate.remotes
+    end
+
+  private
+
+    def rubygems_aggregate_class
+      Source::Rubygems
+    end
+
+    def add_source_to_list(source, list)
+      list.unshift(source).uniq!
+      source
+    end
+
+    def source_list_for(source)
+      case source
+      when Source::Git          then git_sources
+      when Source::Path         then path_sources
+      when Source::Rubygems     then rubygems_sources
+      when Plugin::API::Source  then plugin_sources
+      else raise ArgumentError, "Invalid source: #{source.inspect}"
+      end
+    end
+
+    def combine_rubygems_sources
+      Source::Rubygems.new("remotes" => rubygems_remotes)
+    end
+
+    def warn_on_git_protocol(source)
+      return if Bundler.settings["git.allow_insecure"]
+
+      if source.uri =~ /^git\:/
+        Bundler.ui.warn "The git source `#{source.uri}` uses the `git` protocol, " \
+          "which transmits data without encryption. Disable this warning with " \
+          "`bundle config git.allow_insecure true`, or switch to the `https` " \
+          "protocol to keep your data secure."
+      end
+    end
+
+    def equal_sources?(lock_sources, replacement_sources)
+      lock_sources.to_set == replacement_sources.to_set
+    end
+
+    def equal_source?(source, other_source)
+      source == other_source
+    end
+
+    def equivalent_source?(source, other_source)
+      return false unless Bundler.settings[:allow_deployment_source_credential_changes] && source.is_a?(Source::Rubygems)
+
+      equivalent_rubygems_sources?([source], [other_source])
+    end
+
+    def equivalent_sources?(lock_sources, replacement_sources)
+      return false unless Bundler.settings[:allow_deployment_source_credential_changes]
+
+      lock_rubygems_sources, lock_other_sources = lock_sources.partition {|s| s.is_a?(Source::Rubygems) }
+      replacement_rubygems_sources, replacement_other_sources = replacement_sources.partition {|s| s.is_a?(Source::Rubygems) }
+
+      equivalent_rubygems_sources?(lock_rubygems_sources, replacement_rubygems_sources) && equal_sources?(lock_other_sources, replacement_other_sources)
+    end
+
+    def equivalent_rubygems_sources?(lock_sources, replacement_sources)
+      actual_remotes = replacement_sources.map(&:remotes).flatten.uniq
+      lock_sources.all? {|s| s.equivalent_remotes?(actual_remotes) }
+    end
+  end
+end

data/bundler/lib/bundler/spec_set.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require "tsort"
+require "forwardable"
+require "set"
+
+module Bundler
+  class SpecSet
+    extend Forwardable
+    include TSort, Enumerable
+
+    def_delegators :@specs, :<<, :length, :add, :remove, :size, :empty?
+    def_delegators :sorted, :each
+
+    def initialize(specs)
+      @specs = specs
+    end
+
+    def for(dependencies, skip = [], check = false, match_current_platform = false, raise_on_missing = true)
+      handled = Set.new
+      deps = dependencies.dup
+      specs = []
+      skip += ["bundler"]
+
+      loop do
+        break unless dep = deps.shift
+        next if !handled.add?(dep) || skip.include?(dep.name)
+
+        if spec = spec_for_dependency(dep, match_current_platform)
+          specs << spec
+
+          spec.dependencies.each do |d|
+            next if d.type == :development
+            d = DepProxy.new(d, dep.__platform) unless match_current_platform
+            deps << d
+          end
+        elsif check
+          return false
+        elsif raise_on_missing
+          others = lookup[dep.name] if match_current_platform
+          message = "Unable to find a spec satisfying #{dep} in the set. Perhaps the lockfile is corrupted?"
+          message += " Found #{others.join(", ")} that did not match the current platform." if others && !others.empty?
+          raise GemNotFound, message
+        end
+      end
+
+      if spec = lookup["bundler"].first
+        specs << spec
+      end
+
+      check ? true : SpecSet.new(specs)
+    end
+
+    def valid_for?(deps)
+      self.for(deps, [], true)
+    end
+
+    def [](key)
+      key = key.name if key.respond_to?(:name)
+      lookup[key].reverse
+    end
+
+    def []=(key, value)
+      @specs << value
+      @lookup = nil
+      @sorted = nil
+      value
+    end
+
+    def sort!
+      self
+    end
+
+    def to_a
+      sorted.dup
+    end
+
+    def to_hash
+      lookup.dup
+    end
+
+    def materialize(deps, missing_specs = nil)
+      materialized = self.for(deps, [], false, true, !missing_specs).to_a
+      deps = materialized.map(&:name).uniq
+      materialized.map! do |s|
+        next s unless s.is_a?(LazySpecification)
+        s.source.dependency_names = deps if s.source.respond_to?(:dependency_names=)
+        spec = s.__materialize__
+        unless spec
+          unless missing_specs
+            raise GemNotFound, "Could not find #{s.full_name} in any of the sources"
+          end
+          missing_specs << s
+        end
+        spec
+      end
+      SpecSet.new(missing_specs ? materialized.compact : materialized)
+    end
+
+    # Materialize for all the specs in the spec set, regardless of what platform they're for
+    # This is in contrast to how for does platform filtering (and specifically different from how `materialize` calls `for` only for the current platform)
+    # @return [Array<Gem::Specification>]
+    def materialized_for_all_platforms
+      names = @specs.map(&:name).uniq
+      @specs.map do |s|
+        next s unless s.is_a?(LazySpecification)
+        s.source.dependency_names = names if s.source.respond_to?(:dependency_names=)
+        spec = s.__materialize__
+        raise GemNotFound, "Could not find #{s.full_name} in any of the sources" unless spec
+        spec
+      end
+    end
+
+    def merge(set)
+      arr = sorted.dup
+      set.each do |set_spec|
+        full_name = set_spec.full_name
+        next if arr.any? {|spec| spec.full_name == full_name }
+        arr << set_spec
+      end
+      SpecSet.new(arr)
+    end
+
+    def find_by_name_and_platform(name, platform)
+      @specs.detect {|spec| spec.name == name && spec.match_platform(platform) }
+    end
+
+    def what_required(spec)
+      unless req = find {|s| s.dependencies.any? {|d| d.type == :runtime && d.name == spec.name } }
+        return [spec]
+      end
+      what_required(req) << spec
+    end
+
+  private
+
+    def sorted
+      rake = @specs.find {|s| s.name == "rake" }
+      begin
+        @sorted ||= ([rake] + tsort).compact.uniq
+      rescue TSort::Cyclic => error
+        cgems = extract_circular_gems(error)
+        raise CyclicDependencyError, "Your bundle requires gems that depend" \
+          " on each other, creating an infinite loop. Please remove either" \
+          " gem '#{cgems[1]}' or gem '#{cgems[0]}' and try again."
+      end
+    end
+
+    def extract_circular_gems(error)
+      if Bundler.current_ruby.mri? && Bundler.current_ruby.on_19?
+        error.message.scan(/(\w+) \([^)]/).flatten
+      else
+        error.message.scan(/@name="(.*?)"/).flatten
+      end
+    end
+
+    def lookup
+      @lookup ||= begin
+        lookup = Hash.new {|h, k| h[k] = [] }
+        Index.sort_specs(@specs).reverse_each do |s|
+          lookup[s.name] << s
+        end
+        lookup
+      end
+    end
+
+    def tsort_each_node
+      # MUST sort by name for backwards compatibility
+      @specs.sort_by(&:name).each {|s| yield s }
+    end
+
+    def spec_for_dependency(dep, match_current_platform)
+      specs_for_platforms = lookup[dep.name]
+      if match_current_platform
+        Bundler.rubygems.platforms.reverse_each do |pl|
+          match = GemHelpers.select_best_platform_match(specs_for_platforms, pl)
+          return match if match
+        end
+        nil
+      else
+        GemHelpers.select_best_platform_match(specs_for_platforms, dep.__platform)
+      end
+    end
+
+    def tsort_each_child(s)
+      s.dependencies.sort_by(&:name).each do |d|
+        next if d.type == :development
+        lookup[d.name].each {|s2| yield s2 }
+      end
+    end
+  end
+end

data/bundler/lib/bundler/ssl_certs/.document

@@ -0,0 +1 @@
+# Ignore all files in this directory

data/bundler/lib/bundler/ssl_certs/certificate_manager.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "bundler/vendored_fileutils"
+require "net/https"
+require "openssl"
+
+module Bundler
+  module SSLCerts
+    class CertificateManager
+      attr_reader :bundler_cert_path, :bundler_certs, :rubygems_certs
+
+      def self.update_from!(rubygems_path)
+        new(rubygems_path).update!
+      end
+
+      def initialize(rubygems_path = nil)
+        if rubygems_path
+          rubygems_cert_path = File.join(rubygems_path, "lib/rubygems/ssl_certs")
+          @rubygems_certs = certificates_in(rubygems_cert_path)
+        end
+
+        @bundler_cert_path = File.expand_path("..", __FILE__)
+        @bundler_certs = certificates_in(bundler_cert_path)
+      end
+
+      def up_to_date?
+        rubygems_certs.all? do |rc|
+          bundler_certs.find do |bc|
+            File.basename(bc) == File.basename(rc) && FileUtils.compare_file(bc, rc)
+          end
+        end
+      end
+
+      def update!
+        return if up_to_date?
+
+        FileUtils.rm bundler_certs
+        FileUtils.cp rubygems_certs, bundler_cert_path
+      end
+
+      def connect_to(host)
+        http = Net::HTTP.new(host, 443)
+        http.use_ssl = true
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.cert_store = store
+        http.head("/")
+      end
+
+    private
+
+      def certificates_in(path)
+        Dir[File.join(path, "**/*.pem")].sort
+      end
+
+      def store
+        @store ||= begin
+          store = OpenSSL::X509::Store.new
+          bundler_certs.each do |cert|
+            store.add_file cert
+          end
+          store
+        end
+      end
+    end
+  end
+end

data/bundler/lib/bundler/ssl_certs/index.rubygems.org/GlobalSignRootCA.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
+A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
+b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
+MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
+YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
+aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
+jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
+xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
+1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
+snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
+U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
+9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
+BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
+AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
+yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
+38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
+AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
+DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
+HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
+-----END CERTIFICATE-----

data/bundler/lib/bundler/ssl_certs/rubygems.global.ssl.fastly.net/DigiCertHighAssuranceEVRootCA.pem

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
+ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
+MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
+LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
+RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
+PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
+xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
+Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
+hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
+EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
+MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
+FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
+nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
+eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
+hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
+Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
+vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
++OkuE6N36B9K
+-----END CERTIFICATE-----

data/bundler/lib/bundler/stub_specification.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require "bundler/remote_specification"
+
+module Bundler
+  class StubSpecification < RemoteSpecification
+    def self.from_stub(stub)
+      return stub if stub.is_a?(Bundler::StubSpecification)
+      spec = new(stub.name, stub.version, stub.platform, nil)
+      spec.stub = stub
+      spec
+    end
+
+    attr_accessor :stub, :ignored
+
+    # Pre 2.2.0 did not include extension_dir
+    # https://github.com/rubygems/rubygems/commit/9485ca2d101b82a946d6f327f4bdcdea6d4946ea
+    if Bundler.rubygems.provides?(">= 2.2.0")
+      def source=(source)
+        super
+        # Stub has no concept of source, which means that extension_dir may be wrong
+        # This is the case for git-based gems. So, instead manually assign the extension dir
+        return unless source.respond_to?(:extension_dir_name)
+        path = File.join(stub.extensions_dir, source.extension_dir_name)
+        stub.extension_dir = File.expand_path(path)
+      end
+    end
+
+    def to_yaml
+      _remote_specification.to_yaml
+    end
+
+    # @!group Stub Delegates
+
+    if Bundler.rubygems.provides?(">= 2.3")
+      # This is defined directly to avoid having to load every installed spec
+      def missing_extensions?
+        stub.missing_extensions?
+      end
+    end
+
+    def activated
+      stub.activated
+    end
+
+    def activated=(activated)
+      stub.instance_variable_set(:@activated, activated)
+    end
+
+    def default_gem
+      stub.default_gem
+    end
+
+    def full_gem_path
+      # deleted gems can have their stubs return nil, so in that case grab the
+      # expired path from the full spec
+      stub.full_gem_path || method_missing(:full_gem_path)
+    end
+
+    if Bundler.rubygems.provides?(">= 2.2.0")
+      def full_require_paths
+        stub.full_require_paths
+      end
+
+      # This is what we do in bundler/rubygems_ext
+      # full_require_paths is always implemented in >= 2.2.0
+      def load_paths
+        full_require_paths
+      end
+    end
+
+    def loaded_from
+      stub.loaded_from
+    end
+
+    if Bundler.rubygems.stubs_provide_full_functionality?
+      def matches_for_glob(glob)
+        stub.matches_for_glob(glob)
+      end
+    end
+
+    def raw_require_paths
+      stub.raw_require_paths
+    end
+
+  private
+
+    def _remote_specification
+      @_remote_specification ||= begin
+        rs = stub.to_spec
+        if rs.equal?(self) # happens when to_spec gets the spec from Gem.loaded_specs
+          rs = Gem::Specification.load(loaded_from)
+          Bundler.rubygems.stub_set_spec(stub, rs)
+        end
+
+        unless rs
+          raise GemspecError, "The gemspec for #{full_name} at #{loaded_from}" \
+            " was missing or broken. Try running `gem pristine #{name} -v #{version}`" \
+            " to fix the cached spec."
+        end
+
+        rs.source = source
+
+        rs
+      end
+    end
+  end
+end

data/bundler/lib/bundler/templates/.document

@@ -0,0 +1 @@
+# Ignore all files in this directory

data/bundler/lib/bundler/templates/Executable

@@ -0,0 +1,29 @@
+#!/usr/bin/env <%= Bundler.settings[:shebang] || RbConfig::CONFIG["ruby_install_name"] %>
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application '<%= executable %>' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+require "pathname"
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../<%= relative_gemfile_path %>",
+  Pathname.new(__FILE__).realpath)
+
+bundle_binstub = File.expand_path("../bundle", __FILE__)
+
+if File.file?(bundle_binstub)
+  if File.read(bundle_binstub, 300) =~ /This file was generated by Bundler/
+    load(bundle_binstub)
+  else
+    abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run.
+Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.")
+  end
+end
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("<%= spec.name %>", "<%= executable %>")