rubygems-update 2.7.11 → 3.0.9

data/lib/rubygems/resolver/lock_specification.rb

@@ -9,7 +9,7 @@ class Gem::Resolver::LockSpecification < Gem::Resolver::Specification
 
   attr_reader :sources
 
-  def initialize set, name, version, sources, platform
+  def initialize(set, name, version, sources, platform)
     super()
 
     @name     = name
@@ -27,10 +27,10 @@ class Gem::Resolver::LockSpecification < Gem::Resolver::Specification
   # This is a null install as a locked specification is considered installed.
   # +options+ are ignored.
 
-  def install options = {}
+  def install(options = {})
     destination = options[:install_dir] || Gem.dir
 
-    if File.exist? File.join(destination, 'specifications', spec.spec_name) then
+    if File.exist? File.join(destination, 'specifications', spec.spec_name)
       yield nil
       return
     end
@@ -41,11 +41,11 @@ class Gem::Resolver::LockSpecification < Gem::Resolver::Specification
   ##
   # Adds +dependency+ from the lockfile to this specification
 
-  def add_dependency dependency # :nodoc:
+  def add_dependency(dependency) # :nodoc:
     @dependencies << dependency
   end
 
-  def pretty_print q # :nodoc:
+  def pretty_print(q) # :nodoc:
     q.group 2, '[LockSpecification', ']' do
       q.breakable
       q.text "name: #{@name}"
@@ -53,12 +53,12 @@ class Gem::Resolver::LockSpecification < Gem::Resolver::Specification
       q.breakable
       q.text "version: #{@version}"
 
-      unless @platform == Gem::Platform::RUBY then
+      unless @platform == Gem::Platform::RUBY
         q.breakable
         q.text "platform: #{@platform}"
       end
 
-      unless @dependencies.empty? then
+      unless @dependencies.empty?
         q.breakable
         q.text 'dependencies:'
         q.breakable
@@ -85,4 +85,3 @@ class Gem::Resolver::LockSpecification < Gem::Resolver::Specification
   end
 
 end
-

data/lib/rubygems/resolver/requirement_list.rb

@@ -18,7 +18,7 @@ class Gem::Resolver::RequirementList
     @list = []
   end
 
-  def initialize_copy other # :nodoc:
+  def initialize_copy(other) # :nodoc:
     @exact = @exact.dup
     @list = @list.dup
   end

data/lib/rubygems/resolver/set.rb

@@ -31,7 +31,7 @@ class Gem::Resolver::Set
   # The find_all method must be implemented.  It returns all Resolver
   # Specification objects matching the given DependencyRequest +req+.
 
-  def find_all req
+  def find_all(req)
     raise NotImplementedError
   end
 
@@ -43,7 +43,7 @@ class Gem::Resolver::Set
   # When overridden, the #prefetch method should look up specifications
   # matching +reqs+.
 
-  def prefetch reqs
+  def prefetch(reqs)
   end
 
   ##

data/lib/rubygems/resolver/source_set.rb

@@ -16,7 +16,7 @@ class Gem::Resolver::SourceSet < Gem::Resolver::Set
     @sets  = {}
   end
 
-  def find_all req # :nodoc:
+  def find_all(req) # :nodoc:
     if set = get_set(req.dependency.name)
       set.find_all req
     else
@@ -25,7 +25,7 @@ class Gem::Resolver::SourceSet < Gem::Resolver::Set
   end
 
   # potentially no-op
-  def prefetch reqs # :nodoc:
+  def prefetch(reqs) # :nodoc:
     reqs.each do |req|
       if set = get_set(req.dependency.name)
         set.prefetch reqs
@@ -33,11 +33,11 @@ class Gem::Resolver::SourceSet < Gem::Resolver::Set
     end
   end
 
-  def add_source_gem name, source
+  def add_source_gem(name, source)
     @links[name] = source
   end
 
-private
+  private
 
   def get_set(name)
     link = @links[name]
@@ -45,4 +45,3 @@ private
   end
 
 end
-

data/lib/rubygems/resolver/spec_specification.rb

@@ -10,7 +10,7 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
   # +spec+.  The +source+ is either where the +spec+ came from, or should be
   # loaded from.
 
-  def initialize set, spec, source = nil
+  def initialize(set, spec, source = nil)
     @set    = set
     @source = source
     @spec   = spec
@@ -54,4 +54,3 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
   end
 
 end
-

data/lib/rubygems/resolver/specification.rb

@@ -81,14 +81,10 @@ class Gem::Resolver::Specification
   # After installation #spec is updated to point to the just-installed
   # specification.
 
-  def install options = {}
+  def install(options = {})
     require 'rubygems/installer'
 
-    destination = options[:install_dir] || Gem.dir
-
-    Gem.ensure_gem_subdirectories destination
-
-    gem = source.download spec, destination
+    gem = download options
 
     installer = Gem::Installer.at gem, options
 
@@ -97,6 +93,14 @@ class Gem::Resolver::Specification
     @spec = installer.install
   end
 
+  def download(options)
+    dir = options[:install_dir] || Gem.dir
+
+    Gem.ensure_gem_subdirectories dir
+
+    source.download spec, dir
+  end
+
   ##
   # Returns true if this specification is installable on this platform.
 
@@ -108,4 +112,3 @@ class Gem::Resolver::Specification
     false
   end
 end
-

data/lib/rubygems/resolver/stats.rb

@@ -32,7 +32,7 @@ class Gem::Resolver::Stats
     @iterations += 1
   end
 
-  PATTERN = "%20s: %d\n"
+  PATTERN = "%20s: %d\n".freeze
 
   def display
     $stdout.puts "=== Resolver Statistics ==="

data/lib/rubygems/resolver/vendor_set.rb

@@ -32,7 +32,7 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
   # Adds a specification to the set with the given +name+ which has been
   # unpacked into the given +directory+.
 
-  def add_vendor_gem name, directory # :nodoc:
+  def add_vendor_gem(name, directory) # :nodoc:
     gemspec = File.join directory, "#{name}.gemspec"
 
     spec = Gem::Specification.load gemspec
@@ -52,7 +52,7 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
   # Returns an Array of VendorSpecification objects matching the
   # DependencyRequest +req+.
 
-  def find_all req
+  def find_all(req)
     @specs.values.select do |spec|
       req.match? spec
     end.map do |spec|
@@ -65,11 +65,11 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
   # Loads a spec with the given +name+. +version+, +platform+ and +source+ are
   # ignored.
 
-  def load_spec name, version, platform, source # :nodoc:
+  def load_spec(name, version, platform, source) # :nodoc:
     @specs.fetch name
   end
 
-  def pretty_print q # :nodoc:
+  def pretty_print(q) # :nodoc:
     q.group 2, '[VendorSet', ']' do
       next if @directories.empty?
       q.breakable
@@ -85,4 +85,3 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
   end
 
 end
-

data/lib/rubygems/resolver/vendor_specification.rb

@@ -6,7 +6,7 @@
 
 class Gem::Resolver::VendorSpecification < Gem::Resolver::SpecSpecification
 
-  def == other # :nodoc:
+  def ==(other) # :nodoc:
     self.class === other and
       @set  == other.set and
       @spec == other.spec and
@@ -17,9 +17,8 @@ class Gem::Resolver::VendorSpecification < Gem::Resolver::SpecSpecification
   # This is a null install as this gem was unpacked into a directory.
   # +options+ are ignored.
 
-  def install options = {}
+  def install(options = {})
     yield nil
   end
 
 end
-

data/lib/rubygems/resolver.rb

@@ -59,7 +59,7 @@ class Gem::Resolver
   # uniform manner.  If one of the +sets+ is itself a ComposedSet its sets are
   # flattened into the result ComposedSet.
 
-  def self.compose_sets *sets
+  def self.compose_sets(*sets)
     sets.compact!
 
     sets = sets.map do |set|
@@ -87,7 +87,7 @@ class Gem::Resolver
   # Creates a Resolver that queries only against the already installed gems
   # for the +needed+ dependencies.
 
-  def self.for_current_gems needed
+  def self.for_current_gems(needed)
     new needed, Gem::Resolver::CurrentSet.new
   end
 
@@ -99,7 +99,7 @@ class Gem::Resolver
   # satisfy the Dependencies. This defaults to IndexSet, which will query
   # rubygems.org.
 
-  def initialize needed, set = nil
+  def initialize(needed, set = nil)
     @set = set || Gem::Resolver::IndexSet.new
     @needed = needed
 
@@ -112,19 +112,22 @@ class Gem::Resolver
     @stats               = Gem::Resolver::Stats.new
   end
 
-  def explain stage, *data # :nodoc:
+  def explain(stage, *data) # :nodoc:
     return unless DEBUG_RESOLVER
 
     d = data.map { |x| x.pretty_inspect }.join(", ")
     $stderr.printf "%10s %s\n", stage.to_s.upcase, d
   end
 
-  def explain_list stage # :nodoc:
+  def explain_list(stage) # :nodoc:
     return unless DEBUG_RESOLVER
 
     data = yield
     $stderr.printf "%10s (%d entries)\n", stage.to_s.upcase, data.size
-    PP.pp data, $stderr unless data.empty?
+    unless data.empty?
+      require 'pp'
+      PP.pp data, $stderr
+    end
   end
 
   ##
@@ -133,7 +136,7 @@ class Gem::Resolver
   #
   # Returns the Specification and the ActivationRequest
 
-  def activation_request dep, possible # :nodoc:
+  def activation_request(dep, possible) # :nodoc:
     spec = possible.pop
 
     explain :activate, [spec.full_name, possible.size]
@@ -145,7 +148,7 @@ class Gem::Resolver
     return spec, activation_request
   end
 
-  def requests s, act, reqs=[] # :nodoc:
+  def requests(s, act, reqs=[]) # :nodoc:
     return reqs if @ignore_dependencies
 
     s.fetch_development_dependencies if @development
@@ -171,7 +174,7 @@ class Gem::Resolver
   include Molinillo::UI
 
   def output
-    @output ||= debug? ? $stdout : File.open(Gem::Util::NULL_DEVICE, 'w')
+    @output ||= debug? ? $stdout : File.open(IO::NULL, 'w')
   end
 
   def debug?
@@ -197,7 +200,7 @@ class Gem::Resolver
   # Extracts the specifications that may be able to fulfill +dependency+ and
   # returns those that match the local platform and all those that match.
 
-  def find_possible dependency # :nodoc:
+  def find_possible(dependency) # :nodoc:
     all = @set.find_all dependency
 
     if (skip_dep_gems = skip_gems[dependency.name]) && !skip_dep_gems.empty?
@@ -216,7 +219,7 @@ class Gem::Resolver
   ##
   # Returns the gems in +specs+ that match the local platform.
 
-  def select_local_platforms specs # :nodoc:
+  def select_local_platforms(specs) # :nodoc:
     specs.select do |spec|
       Gem::Platform.installable? spec
     end
@@ -314,11 +317,6 @@ class Gem::Resolver
 
 end
 
-##
-# TODO remove in RubyGems 3
-
-Gem::DependencyResolver = Gem::Resolver # :nodoc:
-
 require 'rubygems/resolver/activation_request'
 require 'rubygems/resolver/conflict'
 require 'rubygems/resolver/dependency_request'

data/lib/rubygems/s3_uri_signer.rb

@@ -0,0 +1,183 @@
+require 'base64'
+require 'digest'
+require 'openssl'
+
+##
+# S3URISigner implements AWS SigV4 for S3 Source to avoid a dependency on the aws-sdk-* gems
+# More on AWS SigV4: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
+class Gem::S3URISigner
+
+  class ConfigurationError < Gem::Exception
+
+    def initialize(message)
+      super message
+    end
+
+    def to_s # :nodoc:
+      "#{super}"
+    end
+
+  end
+
+  class InstanceProfileError < Gem::Exception
+
+    def initialize(message)
+      super message
+    end
+
+    def to_s # :nodoc:
+      "#{super}"
+    end
+
+  end
+
+  attr_accessor :uri
+
+  def initialize(uri)
+    @uri = uri
+  end
+
+  ##
+  # Signs S3 URI using query-params according to the reference: https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
+  def sign(expiration = 86400)
+    s3_config = fetch_s3_config
+
+    current_time = Time.now.utc
+    date_time = current_time.strftime("%Y%m%dT%H%m%SZ")
+    date = date_time[0,8]
+
+    credential_info = "#{date}/#{s3_config.region}/s3/aws4_request"
+    canonical_host = "#{uri.host}.s3.#{s3_config.region}.amazonaws.com"
+
+    query_params = generate_canonical_query_params(s3_config, date_time, credential_info, expiration)
+    canonical_request = generate_canonical_request(canonical_host, query_params)
+    string_to_sign = generate_string_to_sign(date_time, credential_info, canonical_request)
+    signature = generate_signature(s3_config, date, string_to_sign)
+
+    URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
+  end
+
+  private
+
+  S3Config = Struct.new :access_key_id, :secret_access_key, :security_token, :region
+
+  def generate_canonical_query_params(s3_config, date_time, credential_info, expiration)
+    canonical_params = {}
+    canonical_params["X-Amz-Algorithm"] = "AWS4-HMAC-SHA256"
+    canonical_params["X-Amz-Credential"] = "#{s3_config.access_key_id}/#{credential_info}"
+    canonical_params["X-Amz-Date"] = date_time
+    canonical_params["X-Amz-Expires"] = expiration.to_s
+    canonical_params["X-Amz-SignedHeaders"] = "host"
+    canonical_params["X-Amz-Security-Token"] = s3_config.security_token if s3_config.security_token
+
+    # Sorting is required to generate proper signature
+    canonical_params.sort.to_h.map do |key, value|
+      "#{base64_uri_escape(key)}=#{base64_uri_escape(value)}"
+    end.join("&")
+  end
+
+  def generate_canonical_request(canonical_host, query_params)
+    [
+      "GET",
+      uri.path,
+      query_params,
+      "host:#{canonical_host}",
+      "", # empty params
+      "host",
+      "UNSIGNED-PAYLOAD",
+    ].join("\n")
+  end
+
+  def generate_string_to_sign(date_time, credential_info, canonical_request)
+    [
+      "AWS4-HMAC-SHA256",
+      date_time,
+      credential_info,
+      Digest::SHA256.hexdigest(canonical_request)
+    ].join("\n")
+  end
+
+  def generate_signature(s3_config, date, string_to_sign)
+    date_key = OpenSSL::HMAC.digest("sha256", "AWS4" + s3_config.secret_access_key, date)
+    date_region_key = OpenSSL::HMAC.digest("sha256", date_key, s3_config.region)
+    date_region_service_key = OpenSSL::HMAC.digest("sha256", date_region_key, "s3")
+    signing_key = OpenSSL::HMAC.digest("sha256", date_region_service_key, "aws4_request")
+    OpenSSL::HMAC.hexdigest("sha256", signing_key, string_to_sign)
+  end
+
+  ##
+  # Extracts S3 configuration for S3 bucket
+  def fetch_s3_config
+    return S3Config.new(uri.user, uri.password, nil, "us-east-1") if uri.user && uri.password
+
+    s3_source = Gem.configuration[:s3_source] || Gem.configuration["s3_source"]
+    host = uri.host
+    raise ConfigurationError.new("no s3_source key exists in .gemrc") unless s3_source
+
+    auth = s3_source[host] || s3_source[host.to_sym]
+    raise ConfigurationError.new("no key for host #{host} in s3_source in .gemrc") unless auth
+
+    provider = auth[:provider] || auth["provider"]
+    case provider
+    when "env"
+      id = ENV["AWS_ACCESS_KEY_ID"]
+      secret = ENV["AWS_SECRET_ACCESS_KEY"]
+      security_token = ENV["AWS_SESSION_TOKEN"]
+    when "instance_profile"
+      credentials = ec2_metadata_credentials_json
+      id = credentials["AccessKeyId"]
+      secret = credentials["SecretAccessKey"]
+      security_token = credentials["Token"]
+    else
+      id = auth[:id] || auth["id"]
+      secret = auth[:secret] || auth["secret"]
+      security_token = auth[:security_token] || auth["security_token"]
+    end
+
+    raise ConfigurationError.new("s3_source for #{host} missing id or secret") unless id && secret
+
+    region = auth[:region] || auth["region"] || "us-east-1"
+    S3Config.new(id, secret, security_token, region)
+  end
+
+  def base64_uri_escape(str)
+    str.gsub(/[\+\/=\n]/, BASE64_URI_TRANSLATE)
+  end
+
+  def ec2_metadata_credentials_json
+    require 'net/http'
+    require 'rubygems/request'
+    require 'rubygems/request/connection_pools'
+    require 'json'
+
+    iam_info = ec2_metadata_request(EC2_IAM_INFO)
+    # Expected format: arn:aws:iam::<id>:instance-profile/<role_name>
+    role_name = iam_info['InstanceProfileArn'].split('/').last
+    ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name)
+  end
+
+  def ec2_metadata_request(url)
+    uri = URI(url)
+    @request_pool ||= create_request_pool(uri)
+    request = Gem::Request.new(uri, Net::HTTP::Get, nil, @request_pool)
+    response = request.fetch
+
+    case response
+    when Net::HTTPOK then
+      JSON.parse(response.body)
+    else
+      raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}")
+    end
+  end
+
+  def create_request_pool(uri)
+    proxy_uri = Gem::Request.proxy_uri(Gem::Request.get_proxy_from_env(uri.scheme))
+    certs = Gem::Request.get_cert_files
+    Gem::Request::ConnectionPools.new(proxy_uri, certs).pool_for(uri)
+  end
+
+  BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze
+  EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze
+  EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze
+
+end

data/lib/rubygems/safe_yaml.rb

@@ -7,7 +7,7 @@ module Gem
   # Psych.safe_load
 
   module SafeYAML
-    WHITELISTED_CLASSES = %w(
+    PERMITTED_CLASSES = %w(
       Symbol
       Time
       Date
@@ -19,31 +19,39 @@ module Gem
       Gem::Version::Requirement
       YAML::Syck::DefaultKey
       Syck::DefaultKey
-    )
+    ).freeze
 
-    WHITELISTED_SYMBOLS = %w(
+    PERMITTED_SYMBOLS = %w(
       development
       runtime
-    )
+    ).freeze
 
     if ::YAML.respond_to? :safe_load
-      def self.safe_load input
-        ::YAML.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)
+      def self.safe_load(input)
+        if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
+          ::YAML.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
+        else
+          ::YAML.safe_load(input, PERMITTED_CLASSES, PERMITTED_SYMBOLS, true)
+        end
       end
 
-      def self.load input
-        ::YAML.safe_load(input, [::Symbol])
+      def self.load(input)
+        if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
+          ::YAML.safe_load(input, permitted_classes: [::Symbol])
+        else
+          ::YAML.safe_load(input, [::Symbol])
+        end
       end
     else
       unless Gem::Deprecate.skip
         warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
       end
 
-      def self.safe_load input, *args
+      def self.safe_load(input, *args)
         ::YAML.load input
       end
 
-      def self.load input
+      def self.load(input)
         ::YAML.load input
       end
     end

data/lib/rubygems/security/policies.rb

@@ -110,7 +110,6 @@ module Gem::Security
     'MediumSecurity'   => MediumSecurity,
     'HighSecurity'     => HighSecurity,
     # SigningPolicy is not intended for use by `gem -P` so do not list it
-  }
+  }.freeze
 
 end
-