rubygems-update 2.7.11 → 3.0.9

data/POLICIES.md

@@ -0,0 +1,92 @@
+## Pull Requests
+
+Contributions to RubyGems are made via GitHub pull requests, which must be
+approved by a project committer other than the author. To approve a PR, a
+maintainer can leave a comment including the text "@bundlerbot r+", indicating
+that they have reviewed the PR and approve it. Bundlerbot will then
+automatically create a merge commit, test the merge, and land the PR if the
+merge commit passes the tests.
+
+This process guarantees that our release branches always have passing tests,
+and reduces siloing of information to a single contributor. For a full list of
+possible commands, see [the Bundlerbot
+documentation](https://bors.tech/documentation/).
+
+## Long-Term Support
+
+RubyGems will support Ruby versions for as long as the Ruby team supports that
+Ruby version. That means that the latest RubyGems release will always support
+the currently-supported Ruby versions, and RubyGems security fixes will be
+released for any RubyGems version that shipped inside a currently-supported
+Ruby version.
+
+### Bugfix Releases
+
+RubyGems generally releases bugfixes from the master branch. We may mix bug
+fixes and new features in the same release. RubyGems does not guarantee it
+will ship bugfix releases for previous minor or major versions.
+
+For example, after RubyGems 2.5 is released, the RubyGems team will not
+provide non-security fixes for RubyGems 2.4, or any earlier versions.
+
+### Security Releases
+
+Security releases will be made for RubyGems minor versions that were included
+in a currently-supported Ruby release.
+
+For example, since RubyGems 2.0 was shipped in Ruby 2.0, RubyGems 2.0 will
+receive security fixes until Ruby 2.0 reaches end-of-life.
+
+### Ruby Version Support
+
+When a Ruby version reaches end-of-life the following minor release of
+RubyGems will drop backwards compatibility with that Ruby version.
+
+For example, since Ruby 2.2 has reached end-of-life, future RubyGems minor
+releases will only support Ruby 2.3 and above. As of this writing RubyGems is
+at version 2.7, so when RubyGems 2.8 is released, it will only support Ruby
+2.3 and later.
+
+## Release Process
+
+Releases of new versions should follow these steps, to ensure the process is
+smooth and no needed steps are missed.
+
+### Steps for security releases
+
+*   Obtain CVE numbers as needed from HackerOne or Red Hat.
+*   Agree on a release date with ruby-core, so patches can be backported to
+    older Ruby versions as needed.
+*   Avoid releasing security updates on Fridays, so platform services don't
+    have to work on weekends.
+*   Continue with the regular release process below.
+
+
+### Steps for all releases
+
+*   Confirm milestone on GitHub is complete
+*   Update History.txt
+*   Update Manifest.txt
+*   Create and push git tag
+*   Create and push `rubygems-update` gem and tgz
+*   Publish blog post
+
+
+## Committer Access
+
+RubyGems committers may lose their commit privileges if they are inactive for
+longer than 12 months. Committer permission may be restored upon request by
+having a pull request merged.
+
+This is designed to improve the maintainability of RubyGems by requiring
+committers to maintain familiarity with RubyGems activity and to improve the
+security of RubyGems by preventing idle committers from having their commit
+permissions compromised or exposed.
+
+## Changing These Policies
+
+These policies were set in order to reduce the burden of maintenance and to
+keep committers current with existing development and policies. RubyGems work
+is primarily volunteer-driven which limits the ability to provide long-term
+support. By joining [Ruby Together](https://rubytogether.org) you can help
+extend support for older RubyGems versions.

data/README.md

@@ -1,49 +1,76 @@
-# RubyGems [![Travis Build Status](https://secure.travis-ci.org/rubygems/rubygems.svg?branch=master)](http://travis-ci.org/rubygems/rubygems) [![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/rubygems/rubygems?branch=master&svg=true)](https://ci.appveyor.com/project/rubygems/rubygems?branch=master)
+# RubyGems [![Travis Build Status](https://secure.travis-ci.org/rubygems/rubygems.svg?branch=master)](http://travis-ci.org/rubygems/rubygems) [![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/rubygems/rubygems?branch=master&svg=true)](https://ci.appveyor.com/project/rubygems/rubygems?branch=master) [![Maintainability](https://api.codeclimate.com/v1/badges/30f913e9c2dd932132c1/maintainability)](https://codeclimate.com/github/rubygems/rubygems/maintainability)
 
 RubyGems is a package management framework for Ruby.
 
-This gem is an update for the RubyGems software. You must have an
-installation of RubyGems before this update can be applied.
+A package (also known as a library) contains a set of functionality that can be invoked by a Ruby program, such as reading and parsing an XML file.
+We call these packages "gems" and RubyGems is a tool to install, create, manage and load these packages in your Ruby environment.
 
-See Gem for information on RubyGems (or `ri Gem`)
+RubyGems is also a client for [RubyGems.org](https://rubygems.org), a public repository of Gems that allows you to publish a Gem
+that can be shared and used by other developers. See our guide on publishing a Gem at [guides.rubygems.org](http://guides.rubygems.org/publishing/)
 
-To upgrade to the latest RubyGems, run:
+## Getting Started
+
+Installing and managing a Gem is done through the `gem` command. To install a Gem such as [Nokogiri](https://github.com/sparklemotion/nokogiri) which lets
+you read and parse XML in Ruby:
+
+    $ gem install nokogiri
+
+RubyGems will download the Nokogiri Gem from RubyGems.org and install it into your Ruby environment.
+
+Finally, inside your Ruby program, load the Nokogiri gem and start parsing your XML:
+
+    require 'nokogiri'
+
+    Nokogiri.XML('<h1>Hello World</h1>')
+
+For more information about how to use RubyGems, see our RubyGems basics guide at [guides.rubygems.org](http://guides.rubygems.org/rubygems-basics/)
+
+## Requirements
+
+* RubyGems 2.6 supports Ruby 2.4 or lower.
+* RubyGems 2.7 supports Ruby 2.5 or lower.
+* RubyGems 3.0 supports Ruby 2.3 or later.
 
-```
-  $ gem update --system  # you might need to be an administrator or root
-```
+## Installation
 
-See [UPGRADING](UPGRADING.rdoc) for more details and alternative instructions.
+RubyGems is likely already installed in your Ruby environment, you can check by running `gem --version` in your terminal emulator.
+In some cases your OS's package manager may install RubyGems as a separate package from Ruby. It's recommended to check
+with your OS's package manager before installing RubyGems manually.
 
------
+If you would like to manually install RubyGems:
 
-If you don't have RubyGems installed, you can still do it manually:
+* Download from https://rubygems.org/pages/download, unpack, and `cd` into RubyGems' src
+* OR clone this repository and `cd` into the repository (make sure to run `git submodule update --init`)
 
-* Download from https://rubygems.org/pages/download, unpack, and `cd` there
-* OR clone this repository and `cd` there (make sure to run `git submodule update --init`)
-* Install with `ruby setup.rb` (you may need admin/root privilege)
+Install RubyGems by running:
+
+    $ ruby setup.rb
+
+Note: You may need to run the install script with admin/root privileges.
 
 For more details and other options, see:
 
-```
-  ruby setup.rb --help
-```
+    $ ruby setup.rb --help
+
+## Upgrading RubyGems
+
+To upgrade to the latest RubyGems, run:
+
+    $ gem update --system
+
+Note: You might need to run the command as an administrator or root user.
+
+See [UPGRADING](UPGRADING.md) for more details and alternative instructions.
 
 ## Documentation
 
 RubyGems uses [rdoc](https://github.com/rdoc/rdoc) for documentation. A compiled set of the docs
-can be viewed online at http://www.rubydoc.info/github/rubygems/rubygems
+can be viewed online at [rubydoc](http://www.rubydoc.info/github/rubygems/rubygems).
 
 RubyGems also provides a comprehensive set of guides which covers numerous topics such as
 creating a new gem, security practices and other resources at http://guides.rubygems.org
 
-## GETTING HELP
-
-### Support Requests
-
-Are you unsure of how to use RubyGems?  Do you think you've found a bug and
-you're not sure?  If that is the case, the best place for you is to file a
-support request at [help.rubygems.org](http://help.rubygems.org).
+## Getting Help
 
 ### Filing Tickets
 
@@ -63,7 +90,7 @@ See http://bundler.io/compatibility for known issues.
 
 ### Contributing
 
-If you'd like to contribute to RubyGems, that's awesome, and we <3 you. Check out our [guide to contributing](https://github.com/rubygems/rubygems/blob/master/CONTRIBUTING.rdoc#how-to-contribute) for more information.
+If you'd like to contribute to RubyGems, that's awesome, and we <3 you. Check out our [guide to contributing](CONTRIBUTING.md) for more information.
 
 While some RubyGems contributors are compensated by Ruby Together, the project maintainers make decisions independent of Ruby Together. As a project, we welcome contributions regardless of the author’s affiliation with Ruby Together.
 

data/Rakefile

@@ -2,10 +2,7 @@
 
 require 'rubygems'
 require 'rubygems/package_task'
-
-if ENV['YAML'] == "syck"
-  ENV['TEST_SYCK'] = "1"
-end
+require "rake/testtask"
 
 begin
   require 'psych'
@@ -13,146 +10,50 @@ rescue ::LoadError
   require 'yaml'
 end
 
-begin
-  require 'hoe'
-rescue Gem::ConflictError => e
-  abort <<-ERR
-Error while loading the hoe gem.
-#{e}
-  ERR
-rescue ::LoadError
-  abort <<-ERR
-Error while loading the hoe gem.
-Please install it by running the following:
-
-$ [sudo] gem install hoe
-  ERR
-end
-
-Hoe::RUBY_FLAGS << " --disable-gems" if RUBY_VERSION > "1.9"
-
-Hoe.plugin :git
-Hoe.plugin :travis
-Hoe.plugin :newb
-
-hoe = Hoe.spec 'rubygems-update' do
-  self.author         = ['Jim Weirich', 'Chad Fowler', 'Eric Hodel']
-  self.email          = %w[rubygems-developers@rubyforge.org]
-  self.readme_file    = 'README.md'
-
-  license 'Ruby'
-  license 'MIT'
-
-  spec_extras[:required_rubygems_version] = Gem::Requirement.default
-  spec_extras[:required_ruby_version]     = Gem::Requirement.new '>= 1.8.7'
-  spec_extras[:executables]               = ['update_rubygems']
-  spec_extras[:homepage]                  = 'https://rubygems.org'
-
-  rdoc_locations <<
-    'docs-push.seattlerb.org:/data/www/docs.seattlerb.org/rubygems/'
-
-  clean_globs.push('**/debug.log',
-                   '*.out',
-                   '.config',
-                   'data__',
-                   'html',
-                   'logs',
-                   'graph.dot',
-                   'pkgs/sources/sources*.gem',
-                   'scripts/*.hieraki')
-
-  extra_dev_deps.clear
-
-  dependency 'builder',       '~> 2.1',   :dev
-  dependency 'hoe-seattlerb', '~> 1.2',   :dev
-  dependency 'rdoc',          '~> 4.0',   :dev
-  dependency 'ZenTest',       '~> 4.5',   :dev
-  dependency 'rake',          '~> 10.5',  :dev
-  dependency 'minitest',      '~> 4.0',   :dev
-
-  self.extra_rdoc_files = Dir["*.rdoc"] + %w[
-    CVE-2013-4287.txt
-    CVE-2013-4363.txt
-  ]
-
-  spec_extras['rdoc_options'] = proc do |rdoc_options|
-    rdoc_options << "--title=RubyGems Update Documentation"
-  end
-
-  self.rsync_args += " --no-p -O"
-
-  self.version = File.open('lib/rubygems.rb', 'r:utf-8') do |f|
-    f.read[/VERSION\s+=\s+(['"])(#{Gem::Version::VERSION_PATTERN})\1/, 2]
-  end
-
-  spec_extras['require_paths'] = %w[hide_lib_for_update]
-end
+desc "Setup Rubygems dev environment"
+task :setup => ["bundler:checkout"] do
+  gemspec = Gem::Specification.load(File.expand_path("../rubygems-update.gemspec", __FILE__))
 
-# Monkey-patch to ensure newly-installed gems are visible
-Hoe::Package.instance_method(:install_gem).tap do |existing_install_gem|
-  Hoe::Package.send(:define_method, :install_gem) do |*args|
-    existing_install_gem.bind(self).call(*args).tap { Gem::Specification.reset }
+  gemspec.dependencies.each do |dep|
+    sh "gem install '#{dep.name}:#{dep.requirement.to_s}'"
   end
 end
 
-Hoe::DEFAULT_CONFIG["exclude"] = %r[#{Hoe::DEFAULT_CONFIG["exclude"]}|\./bundler/(?!lib|man|exe|[^/]+\.md|bundler.gemspec)|doc/]ox
+Rake::TestTask.new do |t|
+  t.ruby_opts = %w[--disable-gems]
+  t.ruby_opts << '-rdevkit' if Gem.win_platform?
 
-v = hoe.version
+  t.libs << "test"
+  t.libs << "bundler/lib"
 
-hoe.testlib      = :minitest
-hoe.test_prelude = <<-RUBY.gsub("\n", ";")
-  gem "minitest", "~> 4.0"
-  $:.unshift #{File.expand_path("../bundler/lib", __FILE__).dump}
-  if "1.8" < RUBY_VERSION && RUBY_VERSION < "2.2"
-    module Gem
-      @path_to_default_spec_map.delete_if do |_path, spec|
-        spec.name == "bundler"
-      end
-    end
-  end
-RUBY
+  t.test_files = FileList['test/**/test_*.rb']
+end
 
-Rake::Task['docs'].clear
-Rake::Task['clobber_docs'].clear
+task :default => :test
 
-begin
-  gem 'rdoc', '~> 4.0'
-  require 'rdoc/task'
+spec = Gem::Specification.load('rubygems-update.gemspec')
+v = spec.version
 
-  RDoc::Task.new :rdoc => 'docs', :clobber_rdoc => 'clobber_docs' do |doc|
-    doc.main   = hoe.readme_file
-    doc.title  = "RubyGems #{v} API Documentation"
+require 'rdoc/task'
 
-    rdoc_files = Rake::FileList.new %w[lib History.txt LICENSE.txt MIT.txt]
-    rdoc_files.add hoe.extra_rdoc_files
+RDoc::Task.new :rdoc => 'docs', :clobber_rdoc => 'clobber_docs' do |doc|
+  doc.main   = 'README.md'
+  doc.title  = "RubyGems #{v} API Documentation"
 
-    doc.rdoc_files = rdoc_files
+  rdoc_files = Rake::FileList.new %w[lib bundler/lib]
+  rdoc_files.add %w[History.txt LICENSE.txt MIT.txt CODE_OF_CONDUCT.md CONTRIBUTING.rdoc
+  MAINTAINERS.txt Manifest.txt POLICIES.rdoc README.md UPGRADING.rdoc bundler/CHANGELOG.md
+  bundler/CODE_OF_CONDUCT.md bundler/CONTRIBUTING.md bundler/LICENSE.md bundler/README.md
+  hide_lib_for_update/note.txt].map(&:freeze)
 
-    doc.rdoc_dir = 'doc'
-  end
-rescue LoadError, RuntimeError # rake 10.1 on rdoc from ruby 1.9.2 and earlier
-  task 'docs' do
-    abort 'You must install rdoc to build documentation, try `rake newb` again'
-  end
-end
+  doc.rdoc_files = rdoc_files
 
-class Hoe
-  module Deps
-    alias_method :default_check_extra_task, :check_extra_deps_task
-    def check_extra_deps_task
-      default_check_extra_task
-    rescue Gem::LoadError => e
-      raise unless e.name == 'rake'
-      details = "#{e.class}: #{e}"
-      abort "To override your default rake version, run: `rake _x.y.z_ task_name`:\n\t#{details}"
-    end
-  end
+  doc.rdoc_dir = 'doc'
 end
-task(:newb).prerequisites.unshift "bundler:checkout"
 
 desc "Install gems needed to run the tests"
 task :install_test_deps => :clean do
-  sh "gem install minitest -v '~> 4.0'"
+  sh "gem install minitest -v '~> 5.0'"
 end
 
 begin
@@ -170,13 +71,37 @@ rescue LoadError
   end
 end
 
+desc "Run rubocop"
+task(:rubocop) do
+  sh "util/rubocop"
+end
+
 # --------------------------------------------------------------------
 # Creating a release
 
-task :prerelease => %w[clobber check_manifest test bundler:build_metadata]
-
+task :prerelease => %w[clobber test bundler:build_metadata check_deprecations]
 task :postrelease => %w[bundler:build_metadata:clean upload guides:publish blog:publish]
 
+desc "Check for deprecated methods with expired deprecation horizon"
+task :check_deprecations do
+  if v.segments[1] == 0 && v.segments[2] == 0
+    sh("util/rubocop -r ./util/cops/deprecations --only Rubygems/Deprecations")
+  else
+    puts "Skipping deprecation checks since not releasing a major version."
+  end
+end
+
+desc "Release rubygems-#{v}"
+task :release => :prerelease do
+  Rake::Task["package"].invoke
+  sh "gem push pkg/rubygems-update-#{v}.gem"
+  Rake::Task["postrelease"].invoke
+end
+
+Gem::PackageTask.new(spec) {}
+
+Rake::Task["package"].enhance ["pkg/rubygems-#{v}.tgz", "pkg/rubygems-#{v}.zip"]
+
 file "pkg/rubygems-#{v}" => "pkg/rubygems-update-#{v}" do |t|
   require 'find'
 
@@ -186,7 +111,7 @@ file "pkg/rubygems-#{v}" => "pkg/rubygems-update-#{v}" do |t|
     Find.find '.' do |file|
       dest = File.expand_path file, dest_root
 
-      if File.directory? file then
+      if File.directory? file
         mkdir_p dest
       else
         rm_f dest
@@ -196,39 +121,36 @@ file "pkg/rubygems-#{v}" => "pkg/rubygems-update-#{v}" do |t|
   end
 end
 
-source_pkg_dir = "pkg/rubygems-#{v}"
-
-file "pkg/rubygems-#{v}.tgz" => source_pkg_dir do
+file "pkg/rubygems-#{v}.zip" => "pkg/rubygems-#{v}" do
   cd 'pkg' do
-    sh "tar -czf rubygems-#{v}.tgz rubygems-#{v}"
+    sh "zip -q -r rubygems-#{v}.zip rubygems-#{v}"
   end
 end
 
-file "pkg/rubygems-#{v}.zip" => source_pkg_dir do
+file "pkg/rubygems-#{v}.tgz" => "pkg/rubygems-#{v}" do
   cd 'pkg' do
-    sh "zip -q -r rubygems-#{v}.zip rubygems-#{v}"
+    sh "tar -czf rubygems-#{v}.tgz --owner=rubygems:0 --group=rubygems:0 rubygems-#{v}"
   end
 end
 
-file "pkg/rubygems-update-#{v}.gem"
-
-task :package => %W[
-       pkg/rubygems-update-#{v}.gem
-       pkg/rubygems-#{v}.tgz
-       pkg/rubygems-#{v}.zip
-     ]
-
 desc "Upload release to S3"
 task :upload_to_s3 do
-  sh "s3cmd put -P pkg/rubygems-#{v}.zip pkg/rubygems-#{v}.tgz s3://oregon.production.s3.rubygems.org/rubygems/"
+  begin
+    require "aws-sdk-s3"
+  rescue LoadError
+    abort "Install the aws-sdk-s3 gem to be able to upload gems to rubygems.org."
+  end
+
+  s3 = Aws::S3::Resource.new(region:'us-west-2')
+  %w[zip tgz].each do |ext|
+    obj = s3.bucket('oregon.production.s3.rubygems.org').object("rubygems/rubygems-#{v}.#{ext}")
+    obj.upload_file("pkg/rubygems-#{v}.#{ext}")
+  end
 end
 
 desc "Upload release to rubygems.org"
 task :upload => %w[upload_to_s3]
 
-# Ignonre to publish rdoc to docs.seattlerb.org
-Rake::Task['publish_docs'].clear
-
 directory '../guides.rubygems.org' do
   sh 'git', 'clone',
      'git@github.com:rubygems/guides.git',
@@ -325,7 +247,7 @@ namespace 'blog' do
 
     history = File.read 'History.txt'
 
-    history.force_encoding Encoding::UTF_8 if Object.const_defined? :Encoding
+    history.force_encoding Encoding::UTF_8
 
     _, change_log, = history.split %r%^===\s*\d.*%, 3
 
@@ -360,7 +282,7 @@ namespace 'blog' do
 
     last_change_type = change_types.pop
 
-    if change_types.empty? then
+    if change_types.empty?
       change_types = ''
     else
       change_types = change_types.join(', ') << ' and '
@@ -433,64 +355,6 @@ end
 
 # Misc Tasks ---------------------------------------------------------
 
-# These tasks expect to have the following directory structure:
-#
-#   git/git.rubini.us/code # Rubinius git HEAD checkout
-#   svn/ruby/trunk         # ruby subversion HEAD checkout
-#   svn/rubygems/trunk     # RubyGems subversion HEAD checkout
-#
-# If you don't have this directory structure, set RUBY_PATH and/or
-# RUBINIUS_PATH.
-
-def rsync_with dir
-  rsync_options =
-    "-avP " +
-    "--exclude '*svn*' " +
-    "--exclude '*swp' " +
-    "--exclude '*rbc' " +
-    "--exclude '*.rej' " +
-    "--exclude '*.orig' " +
-    "--exclude 'lib/rubygems/defaults/*' " +
-    "--exclude gauntlet_rubygems.rb"
-
-  sh "rsync #{rsync_options} bin/gem             #{dir}/bin/gem"
-  sh "rsync #{rsync_options} lib/                #{dir}/lib"
-  sh "rsync #{rsync_options} test/               #{dir}/test"
-end
-
-def diff_with dir
-  diff_options = "-urpN --exclude '*svn*' --exclude '*swp' --exclude '*rbc'"
-  sh "diff #{diff_options} bin/gem             #{dir}/bin/gem;         true"
-  sh "diff #{diff_options} lib/ubygems.rb      #{dir}/lib/ubygems.rb;  true"
-  sh "diff #{diff_options} lib/rubygems.rb     #{dir}/lib/rubygems.rb; true"
-  sh "diff #{diff_options} lib/rubygems        #{dir}/lib/rubygems;    true"
-  sh "diff #{diff_options} lib/rbconfig        #{dir}/lib/rbconfig;    true"
-  sh "diff #{diff_options} test/rubygems       #{dir}/test/rubygems;   true"
-end
-
-rubinius_dir = ENV['RUBINIUS_PATH'] || '../git.rubini.us/code'
-ruby_dir     = ENV['RUBY_PATH']     || '../../svn/ruby/trunk'
-
-desc "Updates Ruby HEAD with the currently checked-out copy of RubyGems."
-task :update_ruby do
-  rsync_with ruby_dir
-end
-
-desc "Updates Rubinius HEAD with the currently checked-out copy of RubyGems."
-task :update_rubinius do
-  rsync_with rubinius_dir
-end
-
-desc "Diffs Ruby HEAD with the currently checked-out copy of RubyGems."
-task :diff_ruby do
-  diff_with ruby_dir
-end
-
-desc "Diffs Rubinius HEAD with the currently checked-out copy of RubyGems."
-task :diff_rubinius do
-  diff_with rubinius_dir
-end
-
 desc "Cleanup trailing whitespace"
 task :whitespace do
   system 'find . -not \( -name .svn -prune -o -name .git -prune \) -type f -print0 | xargs -0 sed -i "" -E "s/[[:space:]]*$//"'
@@ -499,9 +363,10 @@ end
 desc "Update the manifest to reflect what's on disk"
 task :update_manifest do
   files = []
-  require 'find'
-  exclude = Hoe::DEFAULT_CONFIG["exclude"]
-  Find.find(".") do |path|
+  exclude = %r[\.git|\./bundler/(?!lib|man|exe|[^/]+\.md|bundler.gemspec)]ox
+  tracked_files = `git ls-files --recurse-submodules`.split("\n").map {|f| "./#{f}" }
+
+  tracked_files.each do |path|
     next unless File.file?(path)
     next if path =~ exclude
     files << path[2..-1]
@@ -510,6 +375,7 @@ task :update_manifest do
 end
 
 namespace :bundler do
+  desc "Initialize bundler submodule"
   task :checkout do
     sh "git submodule update --init"
   end