rubygems-update 2.6.3 → 2.7.7

data/lib/rubygems/resolver/molinillo/lib/molinillo/resolution.rb

@@ -52,6 +52,7 @@ module Gem::Resolver::Molinillo
         @base = base
         @states = []
         @iteration_counter = 0
+        @parents_of = Hash.new { |h, k| h[k] = [] }
       end
 
       # Resolves the {#original_requested} dependencies into a full dependency
@@ -67,7 +68,12 @@ module Gem::Resolver::Molinillo
           indicate_progress
           if state.respond_to?(:pop_possibility_state) # DependencyState
             debug(depth) { "Creating possibility state for #{requirement} (#{possibilities.count} remaining)" }
-            state.pop_possibility_state.tap { |s| states.push(s) if s }
+            state.pop_possibility_state.tap do |s|
+              if s
+                states.push(s)
+                activated.tag(s)
+              end
+            end
           end
           process_topmost_state
         end
@@ -99,7 +105,7 @@ module Gem::Resolver::Molinillo
 
         handle_missing_or_push_dependency_state(initial_state)
 
-        debug { "Starting resolution (#{@started_at})" }
+        debug { "Starting resolution (#{@started_at})\nUser-requested dependencies: #{original_requested}" }
         resolver_ui.before_resolution
       end
 
@@ -118,27 +124,11 @@ module Gem::Resolver::Molinillo
       require 'rubygems/resolver/molinillo/lib/molinillo/state'
       require 'rubygems/resolver/molinillo/lib/molinillo/modules/specification_provider'
 
-      ResolutionState.new.members.each do |member|
-        define_method member do |*args, &block|
-          current_state = state || ResolutionState.empty
-          current_state.send(member, *args, &block)
-        end
-      end
+      require 'rubygems/resolver/molinillo/lib/molinillo/delegates/resolution_state'
+      require 'rubygems/resolver/molinillo/lib/molinillo/delegates/specification_provider'
 
-      SpecificationProvider.instance_methods(false).each do |instance_method|
-        define_method instance_method do |*args, &block|
-          begin
-            specification_provider.send(instance_method, *args, &block)
-          rescue NoSuchDependencyError => error
-            if state
-              vertex = activated.vertex_named(name_for error.dependency)
-              error.required_by += vertex.incoming_edges.map { |e| e.origin.name }
-              error.required_by << name_for_explicit_dependency_source unless vertex.explicit_requirements.empty?
-            end
-            raise
-          end
-        end
-      end
+      include Gem::Resolver::Molinillo::Delegates::ResolutionState
+      include Gem::Resolver::Molinillo::Delegates::SpecificationProvider
 
       # Processes the topmost available {RequirementState} on the stack
       # @return [void]
@@ -169,6 +159,7 @@ module Gem::Resolver::Molinillo
       def initial_state
         graph = DependencyGraph.new.tap do |dg|
           original_requested.each { |r| dg.add_vertex(name_for(r), nil, true).tap { |v| v.explicit_requirements << r } }
+          dg.tag(:initial_state)
         end
 
         requirements = sort_dependencies(original_requested, graph, {})
@@ -187,11 +178,14 @@ module Gem::Resolver::Molinillo
       # Unwinds the states stack because a conflict has been encountered
       # @return [void]
       def unwind_for_conflict
-        debug(depth) { "Unwinding for conflict: #{requirement}" }
+        debug(depth) { "Unwinding for conflict: #{requirement} to #{state_index_for_unwind / 2}" }
         conflicts.tap do |c|
-          states.slice!((state_index_for_unwind + 1)..-1)
+          sliced_states = states.slice!((state_index_for_unwind + 1)..-1)
           raise VersionConflict.new(c) unless state
+          activated.rewind_to(sliced_states.first || :initial_state) if sliced_states
           state.conflicts = c
+          index = states.size - 1
+          @parents_of.each { |_, a| a.reject! { |i| i >= index } }
         end
       end
 
@@ -200,37 +194,36 @@ module Gem::Resolver::Molinillo
       def state_index_for_unwind
         current_requirement = requirement
         existing_requirement = requirement_for_existing_name(name)
-        until current_requirement.nil?
-          current_state = find_state_for(current_requirement)
-          return states.index(current_state) if state_any?(current_state)
-          current_requirement = parent_of(current_requirement)
+        index = -1
+        [current_requirement, existing_requirement].each do |r|
+          until r.nil?
+            current_state = find_state_for(r)
+            if state_any?(current_state)
+              current_index = states.index(current_state)
+              index = current_index if current_index > index
+              break
+            end
+            r = parent_of(r)
+          end
         end
 
-        until existing_requirement.nil?
-          existing_state = find_state_for(existing_requirement)
-          return states.index(existing_state) if state_any?(existing_state)
-          existing_requirement = parent_of(existing_requirement)
-        end
-        -1
+        index
       end
 
       # @return [Object] the requirement that led to `requirement` being added
       #   to the list of requirements.
       def parent_of(requirement)
-        return nil unless requirement
-        seen = false
-        state = states.reverse_each.find do |s|
-          seen ||= s.requirement == requirement || s.requirements.include?(requirement)
-          seen && s.requirement != requirement && !s.requirements.include?(requirement)
-        end
-        state && state.requirement
+        return unless requirement
+        return unless index = @parents_of[requirement].last
+        return unless parent_state = @states[index]
+        parent_state.requirement
       end
 
       # @return [Object] the requirement that led to a version of a possibility
       #   with the given name being activated.
       def requirement_for_existing_name(name)
         return nil unless activated.vertex_named(name).payload
-        states.reverse_each.find { |s| !s.activated.vertex_named(name).payload }.requirement
+        states.find { |s| s.name == name }.requirement
       end
 
       # @return [ResolutionState] the state whose `requirement` is the given
@@ -250,19 +243,25 @@ module Gem::Resolver::Molinillo
       #   the {#possibility} in conjunction with the current {#state}
       def create_conflict
         vertex = activated.vertex_named(name)
-        requirements = {
-          name_for_explicit_dependency_source => vertex.explicit_requirements,
-          name_for_locking_dependency_source => Array(locked_requirement_named(name)),
-        }
+        locked_requirement = locked_requirement_named(name)
+
+        requirements = {}
+        unless vertex.explicit_requirements.empty?
+          requirements[name_for_explicit_dependency_source] = vertex.explicit_requirements
+        end
+        requirements[name_for_locking_dependency_source] = [locked_requirement] if locked_requirement
         vertex.incoming_edges.each { |edge| (requirements[edge.origin.payload] ||= []).unshift(edge.requirement) }
+
+        activated_by_name = {}
+        activated.each { |v| activated_by_name[v.name] = v.payload if v.payload }
         conflicts[name] = Conflict.new(
           requirement,
-          Hash[requirements.select { |_, r| !r.empty? }],
+          requirements,
           vertex.payload,
           possibility,
-          locked_requirement_named(name),
+          locked_requirement,
           requirement_trees,
-          Hash[activated.map { |v| [v.name, v.payload] }.select(&:last)]
+          activated_by_name
         )
       end
 
@@ -341,29 +340,56 @@ module Gem::Resolver::Molinillo
       # spec with the given name
       # @return [Boolean] Whether the possibility was swapped into {#activated}
       def attempt_to_swap_possibility
-        swapped = activated.dup
-        vertex = swapped.vertex_named(name)
-        vertex.payload = possibility
-        return unless vertex.requirements.
-            all? { |r| requirement_satisfied_by?(r, swapped, possibility) }
-        return unless new_spec_satisfied?
-        actual_vertex = activated.vertex_named(name)
-        actual_vertex.payload = possibility
-        fixup_swapped_children(actual_vertex)
+        activated.tag(:swap)
+        vertex = activated.vertex_named(name)
+        activated.set_payload(name, possibility)
+        if !vertex.requirements.
+           all? { |r| requirement_satisfied_by?(r, activated, possibility) } ||
+            !new_spec_satisfied?
+          activated.rewind_to(:swap)
+          return
+        end
+        fixup_swapped_children(vertex)
         activate_spec
       end
 
       # Ensures there are no orphaned successors to the given {vertex}.
       # @param [DependencyGraph::Vertex] vertex the vertex to fix up.
       # @return [void]
-      def fixup_swapped_children(vertex)
+      def fixup_swapped_children(vertex) # rubocop:disable Metrics/CyclomaticComplexity
         payload = vertex.payload
-        dep_names = dependencies_for(payload).map(&method(:name_for))
-        vertex.successors.each do |succ|
-          if !dep_names.include?(succ.name) && !succ.root? && succ.predecessors.to_a == [vertex]
+        deps = dependencies_for(payload).group_by(&method(:name_for))
+        vertex.outgoing_edges.each do |outgoing_edge|
+          requirement = outgoing_edge.requirement
+          parent_index = @parents_of[requirement].last
+          succ = outgoing_edge.destination
+          matching_deps = Array(deps[succ.name])
+          dep_matched = matching_deps.include?(requirement)
+
+          # only push the current index when it was originally required by the
+          # same named spec
+          if parent_index && states[parent_index].name == name
+            @parents_of[requirement].push(states.size - 1)
+          end
+
+          if matching_deps.empty? && !succ.root? && succ.predecessors.to_a == [vertex]
             debug(depth) { "Removing orphaned spec #{succ.name} after swapping #{name}" }
-            activated.detach_vertex_named(succ.name)
-            requirements.delete_if { |r| name_for(r) == succ.name }
+            succ.requirements.each { |r| @parents_of.delete(r) }
+
+            removed_names = activated.detach_vertex_named(succ.name).map(&:name)
+            requirements.delete_if do |r|
+              # the only removed vertices are those with no other requirements,
+              # so it's safe to delete only based upon name here
+              removed_names.include?(name_for(r))
+            end
+          elsif !dep_matched
+            debug(depth) { "Removing orphaned dependency #{requirement} after swapping #{name}" }
+            # also reset if we're removing the edge, but only if its parent has
+            # already been fixed up
+            @parents_of[requirement].push(states.size - 1) if @parents_of[requirement].empty?
+
+            activated.delete_edge(outgoing_edge)
+            requirements.delete(requirement)
           end
         end
       end
@@ -383,13 +409,18 @@ module Gem::Resolver::Molinillo
       # @return [Boolean] whether the current spec is satisfied as a new
       # possibility.
       def new_spec_satisfied?
+        unless requirement_satisfied_by?(requirement, activated, possibility)
+          debug(depth) { 'Unsatisfied by requested spec' }
+          return false
+        end
+
         locked_requirement = locked_requirement_named(name)
-        requested_spec_satisfied = requirement_satisfied_by?(requirement, activated, possibility)
+
         locked_spec_satisfied = !locked_requirement ||
           requirement_satisfied_by?(locked_requirement, activated, possibility)
-        debug(depth) { 'Unsatisfied by requested spec' } unless requested_spec_satisfied
         debug(depth) { 'Unsatisfied by locked spec' } unless locked_spec_satisfied
-        requested_spec_satisfied && locked_spec_satisfied
+
+        locked_spec_satisfied
       end
 
       # @param [String] requirement_name the spec name to search for
@@ -405,9 +436,8 @@ module Gem::Resolver::Molinillo
       # @return [void]
       def activate_spec
         conflicts.delete(name)
-        debug(depth) { 'Activated ' + name + ' at ' + possibility.to_s }
-        vertex = activated.vertex_named(name)
-        vertex.payload = possibility
+        debug(depth) { "Activated #{name} at #{possibility}" }
+        activated.set_payload(name, possibility)
         require_nested_dependencies_for(possibility)
       end
 
@@ -418,19 +448,24 @@ module Gem::Resolver::Molinillo
       def require_nested_dependencies_for(activated_spec)
         nested_dependencies = dependencies_for(activated_spec)
         debug(depth) { "Requiring nested dependencies (#{nested_dependencies.join(', ')})" }
-        nested_dependencies.each { |d| activated.add_child_vertex(name_for(d), nil, [name_for(activated_spec)], d) }
+        nested_dependencies.each do |d|
+          activated.add_child_vertex(name_for(d), nil, [name_for(activated_spec)], d)
+          parent_index = states.size - 1
+          parents = @parents_of[d]
+          parents << parent_index if parents.empty?
+        end
 
-        push_state_for_requirements(requirements + nested_dependencies, nested_dependencies.size > 0)
+        push_state_for_requirements(requirements + nested_dependencies, !nested_dependencies.empty?)
       end
 
       # Pushes a new {DependencyState} that encapsulates both existing and new
       # requirements
       # @param [Array] new_requirements
       # @return [void]
-      def push_state_for_requirements(new_requirements, requires_sort = true, new_activated = activated.dup)
+      def push_state_for_requirements(new_requirements, requires_sort = true, new_activated = activated)
         new_requirements = sort_dependencies(new_requirements.uniq, new_activated, conflicts) if requires_sort
         new_requirement = new_requirements.shift
-        new_name = new_requirement ? name_for(new_requirement) : ''
+        new_name = new_requirement ? name_for(new_requirement) : ''.freeze
         possibilities = new_requirement ? search_for(new_requirement) : []
         handle_missing_or_push_dependency_state DependencyState.new(
           new_name, new_requirements, new_activated,
@@ -451,7 +486,7 @@ module Gem::Resolver::Molinillo
           state.activated.detach_vertex_named(state.name)
           push_state_for_requirements(state.requirements.dup, false, state.activated)
         else
-          states.push state
+          states.push(state).tap { activated.tag(state) }
         end
       end
     end

data/lib/rubygems/resolver/molinillo/lib/molinillo/state.rb

@@ -36,12 +36,14 @@ module Gem::Resolver::Molinillo
       PossibilityState.new(
         name,
         requirements.dup,
-        activated.dup,
+        activated,
         requirement,
         [possibilities.pop],
         depth + 1,
         conflicts.dup
-      )
+      ).tap do |state|
+        state.activated.tag(state)
+      end
     end
   end
 

data/lib/rubygems/resolver/set.rb

@@ -21,6 +21,7 @@ class Gem::Resolver::Set
   attr_accessor :prerelease
 
   def initialize # :nodoc:
+    require 'uri'
     @prerelease = false
     @remote     = true
     @errors     = []
@@ -54,4 +55,3 @@ class Gem::Resolver::Set
   end
 
 end
-

data/lib/rubygems/resolver.rb

@@ -4,9 +4,6 @@ require 'rubygems/exceptions'
 require 'rubygems/util'
 require 'rubygems/util/list'
 
-require 'uri'
-require 'net/http'
-
 ##
 # Given a set of Gem::Dependency objects as +needed+ and a way to query the
 # set of available specs via +set+, calculates a set of ActivationRequest
@@ -233,8 +230,28 @@ class Gem::Resolver
       exc.errors = @set.errors
       raise exc
     end
-    possibles.sort_by { |s| [s.source, s.version, Gem::Platform.local =~ s.platform ? 1 : 0] }.
-      map { |s| ActivationRequest.new s, dependency, [] }
+
+    sources = []
+
+    groups = Hash.new { |hash, key| hash[key] = [] }
+
+    # create groups & sources in the same loop
+    sources = possibles.map { |spec|
+      source = spec.source
+      groups[source] << spec
+      source
+    }.uniq.reverse
+
+    activation_requests = []
+
+    sources.each do |source|
+      groups[source].
+        sort_by { |spec| [spec.version, Gem::Platform.local =~ spec.platform ? 1 : 0] }.
+        map { |spec| ActivationRequest.new spec, dependency, [] }.
+        each { |activation_request| activation_requests << activation_request }
+    end
+
+    activation_requests
   end
 
   def dependencies_for(specification)
@@ -256,6 +273,45 @@ class Gem::Resolver
     @soft_missing
   end
 
+  def sort_dependencies(dependencies, activated, conflicts)
+    dependencies.sort_by.with_index do |dependency, i|
+      name = name_for(dependency)
+      [
+        activated.vertex_named(name).payload ? 0 : 1,
+        amount_constrained(dependency),
+        conflicts[name] ? 0 : 1,
+        activated.vertex_named(name).payload ? 0 : search_for(dependency).count,
+        i # for stable sort
+      ]
+    end
+  end
+
+  SINGLE_POSSIBILITY_CONSTRAINT_PENALTY = 1_000_000
+  private_constant :SINGLE_POSSIBILITY_CONSTRAINT_PENALTY if defined?(private_constant)
+
+  # returns an integer \in (-\infty, 0]
+  # a number closer to 0 means the dependency is less constraining
+  #
+  # dependencies w/ 0 or 1 possibilities (ignoring version requirements)
+  # are given very negative values, so they _always_ sort first,
+  # before dependencies that are unconstrained
+  def amount_constrained(dependency)
+    @amount_constrained ||= {}
+    @amount_constrained[dependency.name] ||= begin
+      name_dependency = Gem::Dependency.new(dependency.name)
+      dependency_request_for_name = Gem::Resolver::DependencyRequest.new(name_dependency, dependency.requester)
+      all = @set.find_all(dependency_request_for_name).size
+
+      if all <= 1
+        all - SINGLE_POSSIBILITY_CONSTRAINT_PENALTY
+      else
+        search = search_for(dependency).size
+        search - all
+      end
+    end
+  end
+  private :amount_constrained
+
 end
 
 ##

data/lib/rubygems/safe_yaml.rb

@@ -0,0 +1,51 @@
+module Gem
+
+  ###
+  # This module is used for safely loading YAML specs from a gem.  The
+  # `safe_load` method defined on this module is specifically designed for
+  # loading Gem specifications.  For loading other YAML safely, please see
+  # Psych.safe_load
+
+  module SafeYAML
+    WHITELISTED_CLASSES = %w(
+      Symbol
+      Time
+      Date
+      Gem::Dependency
+      Gem::Platform
+      Gem::Requirement
+      Gem::Specification
+      Gem::Version
+      Gem::Version::Requirement
+      YAML::Syck::DefaultKey
+      Syck::DefaultKey
+    )
+
+    WHITELISTED_SYMBOLS = %w(
+      development
+      runtime
+    )
+
+    if ::YAML.respond_to? :safe_load
+      def self.safe_load input
+        ::YAML.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)
+      end
+
+      def self.load input
+        ::YAML.safe_load(input, [::Symbol])
+      end
+    else
+      unless Gem::Deprecate.skip
+        warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
+      end
+
+      def self.safe_load input, *args
+        ::YAML.load input
+      end
+
+      def self.load input
+        ::YAML.load input
+      end
+    end
+  end
+end

data/lib/rubygems/security/signer.rb

@@ -102,6 +102,8 @@ class Gem::Security::Signer
   def sign data
     return unless @key
 
+    raise Gem::Security::Exception, 'no certs provided' if @cert_chain.empty?
+
     if @cert_chain.length == 1 and @cert_chain.last.not_after < Time.now then
       re_sign_key
     end

data/lib/rubygems/security/trust_dir.rb

@@ -93,7 +93,7 @@ class Gem::Security::TrustDir
 
     destination = cert_path certificate
 
-    open destination, 'wb', @permissions[:trusted_cert] do |io|
+    File.open destination, 'wb', @permissions[:trusted_cert] do |io|
       io.write certificate.to_pem
     end
   end

data/lib/rubygems/security.rb

@@ -340,7 +340,9 @@ module Gem::Security
   # Digest algorithm used to sign gems
 
   DIGEST_ALGORITHM =
-    if defined?(OpenSSL::Digest::SHA1) then
+    if defined?(OpenSSL::Digest::SHA256) then
+      OpenSSL::Digest::SHA256
+    elsif defined?(OpenSSL::Digest::SHA1) then
       OpenSSL::Digest::SHA1
     end
 
@@ -363,7 +365,7 @@ module Gem::Security
   ##
   # Length of keys created by KEY_ALGORITHM
 
-  KEY_LENGTH = 2048
+  KEY_LENGTH = 3072
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
@@ -371,10 +373,15 @@ module Gem::Security
 
   KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
 
+  ##
+  # One day in seconds
+
+  ONE_DAY = 86400
+
   ##
   # One year in seconds
 
-  ONE_YEAR = 86400 * 365
+  ONE_YEAR = ONE_DAY * 365
 
   ##
   # The default set of extensions are:
@@ -455,7 +462,7 @@ module Gem::Security
 
   ##
   # Creates a new key pair of the specified +length+ and +algorithm+.  The
-  # default is a 2048 bit RSA key.
+  # default is a 3072 bit RSA key.
 
   def self.create_key length = KEY_LENGTH, algorithm = KEY_ALGORITHM
     algorithm.new length
@@ -571,7 +578,7 @@ module Gem::Security
   def self.write pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER
     path = File.expand_path path
 
-    open path, 'wb', permissions do |io|
+    File.open path, 'wb', permissions do |io|
       if passphrase and cipher
         io.write pemmable.to_pem cipher, passphrase
       else

data/lib/rubygems/security_option.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+#--
+# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
+# All rights reserved.
+# See LICENSE.txt for permissions.
+#++
+
+require 'rubygems'
+
+# forward-declare
+
+module Gem::Security # :nodoc:
+  class Policy # :nodoc:
+  end
+end
+
+##
+# Mixin methods for security option for Gem::Commands
+
+module Gem::SecurityOption
+  def add_security_option
+    # TODO: use @parser.accept
+    OptionParser.accept Gem::Security::Policy do |value|
+      require 'rubygems/security'
+
+      raise OptionParser::InvalidArgument, 'OpenSSL not installed' unless
+        defined?(Gem::Security::HighSecurity)
+
+      policy = Gem::Security::Policies[value]
+      unless policy
+        valid = Gem::Security::Policies.keys.sort
+        raise OptionParser::InvalidArgument, "#{value} (#{valid.join ', '} are valid)"
+      end
+      policy
+    end
+
+    add_option(:"Install/Update", '-P', '--trust-policy POLICY',
+               Gem::Security::Policy,
+               'Specify gem trust policy') do |value, options|
+      options[:security_policy] = value
+    end
+  end
+end