rubygems-update 3.0.3 → 3.4.12

data/lib/rubygems/resolver/molinillo/lib/molinillo/resolver.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
-require 'rubygems/resolver/molinillo/lib/molinillo/dependency_graph'
+
+require_relative 'dependency_graph'
 
 module Gem::Resolver::Molinillo
   # This class encapsulates a dependency resolver.
@@ -8,7 +9,7 @@ module Gem::Resolver::Molinillo
   #
   #
   class Resolver
-    require 'rubygems/resolver/molinillo/lib/molinillo/resolution'
+    require_relative 'resolution'
 
     # @return [SpecificationProvider] the specification provider used
     #   in the resolution process

data/lib/rubygems/resolver/molinillo/lib/molinillo/state.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Gem::Resolver::Molinillo
   # A state that a {Resolution} can be in
   # @attr [String] name the name of the current requirement
@@ -7,7 +8,8 @@ module Gem::Resolver::Molinillo
   # @attr [Object] requirement the current requirement
   # @attr [Object] possibilities the possibilities to satisfy the current requirement
   # @attr [Integer] depth the depth of the resolution
-  # @attr [Set<Object>] conflicts unresolved conflicts
+  # @attr [Hash] conflicts unresolved conflicts, indexed by dependency name
+  # @attr [Array<UnwindDetails>] unused_unwind_options unwinds for previous conflicts that weren't explored
   ResolutionState = Struct.new(
     :name,
     :requirements,
@@ -15,14 +17,15 @@ module Gem::Resolver::Molinillo
     :requirement,
     :possibilities,
     :depth,
-    :conflicts
+    :conflicts,
+    :unused_unwind_options
   )
 
   class ResolutionState
     # Returns an empty resolution state
     # @return [ResolutionState] an empty state
     def self.empty
-      new(nil, [], DependencyGraph.new, nil, nil, 0, Set.new)
+      new(nil, [], DependencyGraph.new, nil, nil, 0, {}, [])
     end
   end
 
@@ -40,7 +43,8 @@ module Gem::Resolver::Molinillo
         requirement,
         [possibilities.pop],
         depth + 1,
-        conflicts.dup
+        conflicts.dup,
+        unused_unwind_options.dup
       ).tap do |state|
         state.activated.tag(state)
       end

data/lib/rubygems/resolver/molinillo/lib/molinillo.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
-require 'rubygems/resolver/molinillo/lib/molinillo/gem_metadata'
-require 'rubygems/resolver/molinillo/lib/molinillo/errors'
-require 'rubygems/resolver/molinillo/lib/molinillo/resolver'
-require 'rubygems/resolver/molinillo/lib/molinillo/modules/ui'
-require 'rubygems/resolver/molinillo/lib/molinillo/modules/specification_provider'
+
+require_relative 'molinillo/gem_metadata'
+require_relative 'molinillo/errors'
+require_relative 'molinillo/resolver'
+require_relative 'molinillo/modules/ui'
+require_relative 'molinillo/modules/specification_provider'
 
 # Gem::Resolver::Molinillo is a generic dependency resolution algorithm.
 module Gem::Resolver::Molinillo

data/lib/rubygems/resolver/molinillo.rb

@@ -1,2 +1,2 @@
 # frozen_string_literal: true
-require 'rubygems/resolver/molinillo/lib/molinillo'
+require_relative "molinillo/lib/molinillo"

data/lib/rubygems/resolver/requirement_list.rb

@@ -7,7 +7,6 @@
 # first.
 
 class Gem::Resolver::RequirementList
-
   include Enumerable
 
   ##

data/lib/rubygems/resolver/set.rb

@@ -4,7 +4,6 @@
 # dependencies) used in resolution.  This set is abstract.
 
 class Gem::Resolver::Set
-
   ##
   # Set to true to disable network access for this set
 
@@ -21,7 +20,6 @@ class Gem::Resolver::Set
   attr_accessor :prerelease
 
   def initialize # :nodoc:
-    require 'uri'
     @prerelease = false
     @remote     = true
     @errors     = []
@@ -53,5 +51,4 @@ class Gem::Resolver::Set
   def remote? # :nodoc:
     @remote
   end
-
 end

data/lib/rubygems/resolver/source_set.rb

@@ -4,7 +4,6 @@
 # Kind off like BestSet but filters the sources for gems
 
 class Gem::Resolver::SourceSet < Gem::Resolver::Set
-
   ##
   # Creates a SourceSet for the given +sources+ or Gem::sources if none are
   # specified.  +sources+ must be a Gem::SourceList.
@@ -43,5 +42,4 @@ class Gem::Resolver::SourceSet < Gem::Resolver::Set
     link = @links[name]
     @sets[link] ||= Gem::Source.new(link).dependency_resolver_set if link
   end
-
 end

data/lib/rubygems/resolver/spec_specification.rb

@@ -4,7 +4,6 @@
 # Resolver specifications that are backed by a Gem::Specification.
 
 class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
-
   ##
   # A SpecSpecification is created for a +set+ for a Gem::Specification in
   # +spec+.  The +source+ is either where the +spec+ came from, or should be
@@ -23,6 +22,20 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
     spec.dependencies
   end
 
+  ##
+  # The required_ruby_version constraint for this specification
+
+  def required_ruby_version
+    spec.required_ruby_version
+  end
+
+  ##
+  # The required_rubygems_version constraint for this specification
+
+  def required_rubygems_version
+    spec.required_rubygems_version
+  end
+
   ##
   # The name and version of the specification.
   #
@@ -52,5 +65,4 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
   def version
     spec.version
   end
-
 end

data/lib/rubygems/resolver/specification.rb

@@ -5,7 +5,6 @@
 # dependency resolution in the resolver is included.
 
 class Gem::Resolver::Specification
-
   ##
   # The dependencies of the gem for this specification
 
@@ -44,6 +43,16 @@ class Gem::Resolver::Specification
 
   attr_reader :version
 
+  ##
+  # The required_ruby_version constraint for this specification.
+
+  attr_reader :required_ruby_version
+
+  ##
+  # The required_ruby_version constraint for this specification.
+
+  attr_reader :required_rubygems_version
+
   ##
   # Sets default instance variables for the specification.
 
@@ -54,6 +63,8 @@ class Gem::Resolver::Specification
     @set          = nil
     @source       = nil
     @version      = nil
+    @required_ruby_version = Gem::Requirement.default
+    @required_rubygems_version = Gem::Requirement.default
   end
 
   ##
@@ -82,7 +93,7 @@ class Gem::Resolver::Specification
   # specification.
 
   def install(options = {})
-    require 'rubygems/installer'
+    require_relative "../installer"
 
     gem = download options
 
@@ -105,7 +116,7 @@ class Gem::Resolver::Specification
   # Returns true if this specification is installable on this platform.
 
   def installable_platform?
-    Gem::Platform.match spec.platform
+    Gem::Platform.match_spec? spec
   end
 
   def local? # :nodoc:

data/lib/rubygems/resolver/stats.rb

@@ -32,7 +32,7 @@ class Gem::Resolver::Stats
     @iterations += 1
   end
 
-  PATTERN = "%20s: %d\n".freeze
+  PATTERN = "%20s: %d\n"
 
   def display
     $stdout.puts "=== Resolver Statistics ==="

data/lib/rubygems/resolver/vendor_set.rb

@@ -15,7 +15,6 @@
 # rake.gemspec (watching the given name).
 
 class Gem::Resolver::VendorSet < Gem::Resolver::Set
-
   ##
   # The specifications for this set.
 
@@ -70,7 +69,7 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[VendorSet', ']' do
+    q.group 2, "[VendorSet", "]" do
       next if @directories.empty?
       q.breakable
 
@@ -83,5 +82,4 @@ class Gem::Resolver::VendorSet < Gem::Resolver::Set
       end
     end
   end
-
 end

data/lib/rubygems/resolver/vendor_specification.rb

@@ -5,11 +5,10 @@
 # option.
 
 class Gem::Resolver::VendorSpecification < Gem::Resolver::SpecSpecification
-
   def ==(other) # :nodoc:
-    self.class === other and
-      @set  == other.set and
-      @spec == other.spec and
+    self.class === other &&
+      @set  == other.set &&
+      @spec == other.spec &&
       @source == other.source
   end
 
@@ -20,5 +19,4 @@ class Gem::Resolver::VendorSpecification < Gem::Resolver::SpecSpecification
   def install(options = {})
     yield nil
   end
-
 end

data/lib/rubygems/resolver.rb

@@ -1,8 +1,7 @@
 # frozen_string_literal: true
-require 'rubygems/dependency'
-require 'rubygems/exceptions'
-require 'rubygems/util'
-require 'rubygems/util/list'
+require_relative "dependency"
+require_relative "exceptions"
+require_relative "util/list"
 
 ##
 # Given a set of Gem::Dependency objects as +needed+ and a way to query the
@@ -11,14 +10,14 @@ require 'rubygems/util/list'
 # all the requirements.
 
 class Gem::Resolver
-  require 'rubygems/resolver/molinillo'
+  require_relative "resolver/molinillo"
 
   ##
   # If the DEBUG_RESOLVER environment variable is set then debugging mode is
   # enabled for the resolver.  This will display information about the state
   # of the resolver while a set of dependencies is being resolved.
 
-  DEBUG_RESOLVER = !ENV['DEBUG_RESOLVER'].nil?
+  DEBUG_RESOLVER = !ENV["DEBUG_RESOLVER"].nil?
 
   ##
   # Set to true if all development dependencies should be considered.
@@ -75,7 +74,7 @@ class Gem::Resolver
 
     case sets.length
     when 0 then
-      raise ArgumentError, 'one set in the composition must be non-nil'
+      raise ArgumentError, "one set in the composition must be non-nil"
     when 1 then
       sets.first
     else
@@ -115,7 +114,7 @@ class Gem::Resolver
   def explain(stage, *data) # :nodoc:
     return unless DEBUG_RESOLVER
 
-    d = data.map { |x| x.pretty_inspect }.join(", ")
+    d = data.map {|x| x.pretty_inspect }.join(", ")
     $stderr.printf "%10s %s\n", stage.to_s.upcase, d
   end
 
@@ -124,7 +123,10 @@ class Gem::Resolver
 
     data = yield
     $stderr.printf "%10s (%d entries)\n", stage.to_s.upcase, data.size
-    PP.pp data, $stderr unless data.empty?
+    unless data.empty?
+      require "pp"
+      PP.pp data, $stderr
+    end
   end
 
   ##
@@ -151,10 +153,10 @@ class Gem::Resolver
     s.fetch_development_dependencies if @development
 
     s.dependencies.reverse_each do |d|
-      next if d.type == :development and not @development
-      next if d.type == :development and @development_shallow and
+      next if d.type == :development && !@development
+      next if d.type == :development && @development_shallow &&
               act.development?
-      next if d.type == :development and @development_shallow and
+      next if d.type == :development && @development_shallow &&
               act.parent
 
       reqs << Gem::Resolver::DependencyRequest.new(d, act)
@@ -171,7 +173,7 @@ class Gem::Resolver
   include Molinillo::UI
 
   def output
-    @output ||= debug? ? $stdout : File.open(IO::NULL, 'w')
+    @output ||= debug? ? $stdout : File.open(IO::NULL, "w")
   end
 
   def debug?
@@ -185,12 +187,12 @@ class Gem::Resolver
 
   def resolve
     locking_dg = Molinillo::DependencyGraph.new
-    Molinillo::Resolver.new(self, self).resolve(@needed.map { |d| DependencyRequest.new d, nil }, locking_dg).tsort.map(&:payload).compact
+    Molinillo::Resolver.new(self, self).resolve(@needed.map {|d| DependencyRequest.new d, nil }, locking_dg).tsort.map(&:payload).compact
   rescue Molinillo::VersionConflict => e
     conflict = e.conflicts.values.first
     raise Gem::DependencyResolutionError, Conflict.new(conflict.requirement_trees.first.first, conflict.existing, conflict.requirement)
   ensure
-    @output.close if defined?(@output) and !debug?
+    @output.close if defined?(@output) && !debug?
   end
 
   ##
@@ -202,7 +204,7 @@ class Gem::Resolver
 
     if (skip_dep_gems = skip_gems[dependency.name]) && !skip_dep_gems.empty?
       matching = all.select do |api_spec|
-        skip_dep_gems.any? { |s| api_spec.version == s.version }
+        skip_dep_gems.any? {|s| api_spec.version == s.version }
       end
 
       all = matching unless matching.empty?
@@ -231,24 +233,22 @@ class Gem::Resolver
       raise exc
     end
 
-    sources = []
-
-    groups = Hash.new { |hash, key| hash[key] = [] }
+    groups = Hash.new {|hash, key| hash[key] = [] }
 
     # create groups & sources in the same loop
-    sources = possibles.map { |spec|
+    sources = possibles.map do |spec|
       source = spec.source
       groups[source] << spec
       source
-    }.uniq.reverse
+    end.uniq.reverse
 
     activation_requests = []
 
     sources.each do |source|
       groups[source].
-        sort_by { |spec| [spec.version, Gem::Platform.local =~ spec.platform ? 1 : 0] }.
-        map { |spec| ActivationRequest.new spec, dependency, [] }.
-        each { |activation_request| activation_requests << activation_request }
+        sort_by {|spec| [spec.version, spec.platform =~ Gem::Platform.local ? 1 : 0] }.
+        map {|spec| ActivationRequest.new spec, dependency }.
+        each {|activation_request| activation_requests << activation_request }
     end
 
     activation_requests
@@ -261,7 +261,12 @@ class Gem::Resolver
   end
 
   def requirement_satisfied_by?(requirement, activated, spec)
-    requirement.matches_spec? spec
+    matches_spec = requirement.matches_spec? spec
+    return matches_spec if @soft_missing
+
+    matches_spec &&
+      spec.spec.required_ruby_version.satisfied_by?(Gem.ruby_version) &&
+      spec.spec.required_rubygems_version.satisfied_by?(Gem.rubygems_version)
   end
 
   def name_for(dependency)
@@ -281,7 +286,7 @@ class Gem::Resolver
         amount_constrained(dependency),
         conflicts[name] ? 0 : 1,
         activated.vertex_named(name).payload ? 0 : search_for(dependency).count,
-        i # for stable sort
+        i, # for stable sort
       ]
     end
   end
@@ -311,33 +316,32 @@ class Gem::Resolver
     end
   end
   private :amount_constrained
-
 end
 
-require 'rubygems/resolver/activation_request'
-require 'rubygems/resolver/conflict'
-require 'rubygems/resolver/dependency_request'
-require 'rubygems/resolver/requirement_list'
-require 'rubygems/resolver/stats'
-
-require 'rubygems/resolver/set'
-require 'rubygems/resolver/api_set'
-require 'rubygems/resolver/composed_set'
-require 'rubygems/resolver/best_set'
-require 'rubygems/resolver/current_set'
-require 'rubygems/resolver/git_set'
-require 'rubygems/resolver/index_set'
-require 'rubygems/resolver/installer_set'
-require 'rubygems/resolver/lock_set'
-require 'rubygems/resolver/vendor_set'
-require 'rubygems/resolver/source_set'
-
-require 'rubygems/resolver/specification'
-require 'rubygems/resolver/spec_specification'
-require 'rubygems/resolver/api_specification'
-require 'rubygems/resolver/git_specification'
-require 'rubygems/resolver/index_specification'
-require 'rubygems/resolver/installed_specification'
-require 'rubygems/resolver/local_specification'
-require 'rubygems/resolver/lock_specification'
-require 'rubygems/resolver/vendor_specification'
+require_relative "resolver/activation_request"
+require_relative "resolver/conflict"
+require_relative "resolver/dependency_request"
+require_relative "resolver/requirement_list"
+require_relative "resolver/stats"
+
+require_relative "resolver/set"
+require_relative "resolver/api_set"
+require_relative "resolver/composed_set"
+require_relative "resolver/best_set"
+require_relative "resolver/current_set"
+require_relative "resolver/git_set"
+require_relative "resolver/index_set"
+require_relative "resolver/installer_set"
+require_relative "resolver/lock_set"
+require_relative "resolver/vendor_set"
+require_relative "resolver/source_set"
+
+require_relative "resolver/specification"
+require_relative "resolver/spec_specification"
+require_relative "resolver/api_specification"
+require_relative "resolver/git_specification"
+require_relative "resolver/index_specification"
+require_relative "resolver/installed_specification"
+require_relative "resolver/local_specification"
+require_relative "resolver/lock_specification"
+require_relative "resolver/vendor_specification"

data/lib/rubygems/s3_uri_signer.rb

@@ -0,0 +1,175 @@
+require_relative "openssl"
+
+##
+# S3URISigner implements AWS SigV4 for S3 Source to avoid a dependency on the aws-sdk-* gems
+# More on AWS SigV4: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
+class Gem::S3URISigner
+  class ConfigurationError < Gem::Exception
+    def initialize(message)
+      super message
+    end
+
+    def to_s # :nodoc:
+      "#{super}"
+    end
+  end
+
+  class InstanceProfileError < Gem::Exception
+    def initialize(message)
+      super message
+    end
+
+    def to_s # :nodoc:
+      "#{super}"
+    end
+  end
+
+  attr_accessor :uri
+
+  def initialize(uri)
+    @uri = uri
+  end
+
+  ##
+  # Signs S3 URI using query-params according to the reference: https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html
+  def sign(expiration = 86400)
+    s3_config = fetch_s3_config
+
+    current_time = Time.now.utc
+    date_time = current_time.strftime("%Y%m%dT%H%m%SZ")
+    date = date_time[0,8]
+
+    credential_info = "#{date}/#{s3_config.region}/s3/aws4_request"
+    canonical_host = "#{uri.host}.s3.#{s3_config.region}.amazonaws.com"
+
+    query_params = generate_canonical_query_params(s3_config, date_time, credential_info, expiration)
+    canonical_request = generate_canonical_request(canonical_host, query_params)
+    string_to_sign = generate_string_to_sign(date_time, credential_info, canonical_request)
+    signature = generate_signature(s3_config, date, string_to_sign)
+
+    URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
+  end
+
+  private
+
+  S3Config = Struct.new :access_key_id, :secret_access_key, :security_token, :region
+
+  def generate_canonical_query_params(s3_config, date_time, credential_info, expiration)
+    canonical_params = {}
+    canonical_params["X-Amz-Algorithm"] = "AWS4-HMAC-SHA256"
+    canonical_params["X-Amz-Credential"] = "#{s3_config.access_key_id}/#{credential_info}"
+    canonical_params["X-Amz-Date"] = date_time
+    canonical_params["X-Amz-Expires"] = expiration.to_s
+    canonical_params["X-Amz-SignedHeaders"] = "host"
+    canonical_params["X-Amz-Security-Token"] = s3_config.security_token if s3_config.security_token
+
+    # Sorting is required to generate proper signature
+    canonical_params.sort.to_h.map do |key, value|
+      "#{base64_uri_escape(key)}=#{base64_uri_escape(value)}"
+    end.join("&")
+  end
+
+  def generate_canonical_request(canonical_host, query_params)
+    [
+      "GET",
+      uri.path,
+      query_params,
+      "host:#{canonical_host}",
+      "", # empty params
+      "host",
+      "UNSIGNED-PAYLOAD",
+    ].join("\n")
+  end
+
+  def generate_string_to_sign(date_time, credential_info, canonical_request)
+    [
+      "AWS4-HMAC-SHA256",
+      date_time,
+      credential_info,
+      OpenSSL::Digest::SHA256.hexdigest(canonical_request),
+    ].join("\n")
+  end
+
+  def generate_signature(s3_config, date, string_to_sign)
+    date_key = OpenSSL::HMAC.digest("sha256", "AWS4" + s3_config.secret_access_key, date)
+    date_region_key = OpenSSL::HMAC.digest("sha256", date_key, s3_config.region)
+    date_region_service_key = OpenSSL::HMAC.digest("sha256", date_region_key, "s3")
+    signing_key = OpenSSL::HMAC.digest("sha256", date_region_service_key, "aws4_request")
+    OpenSSL::HMAC.hexdigest("sha256", signing_key, string_to_sign)
+  end
+
+  ##
+  # Extracts S3 configuration for S3 bucket
+  def fetch_s3_config
+    return S3Config.new(uri.user, uri.password, nil, "us-east-1") if uri.user && uri.password
+
+    s3_source = Gem.configuration[:s3_source] || Gem.configuration["s3_source"]
+    host = uri.host
+    raise ConfigurationError.new("no s3_source key exists in .gemrc") unless s3_source
+
+    auth = s3_source[host] || s3_source[host.to_sym]
+    raise ConfigurationError.new("no key for host #{host} in s3_source in .gemrc") unless auth
+
+    provider = auth[:provider] || auth["provider"]
+    case provider
+    when "env"
+      id = ENV["AWS_ACCESS_KEY_ID"]
+      secret = ENV["AWS_SECRET_ACCESS_KEY"]
+      security_token = ENV["AWS_SESSION_TOKEN"]
+    when "instance_profile"
+      credentials = ec2_metadata_credentials_json
+      id = credentials["AccessKeyId"]
+      secret = credentials["SecretAccessKey"]
+      security_token = credentials["Token"]
+    else
+      id = auth[:id] || auth["id"]
+      secret = auth[:secret] || auth["secret"]
+      security_token = auth[:security_token] || auth["security_token"]
+    end
+
+    raise ConfigurationError.new("s3_source for #{host} missing id or secret") unless id && secret
+
+    region = auth[:region] || auth["region"] || "us-east-1"
+    S3Config.new(id, secret, security_token, region)
+  end
+
+  def base64_uri_escape(str)
+    str.gsub(/[\+\/=\n]/, BASE64_URI_TRANSLATE)
+  end
+
+  def ec2_metadata_credentials_json
+    require "net/http"
+    require_relative "request"
+    require_relative "request/connection_pools"
+    require "json"
+
+    iam_info = ec2_metadata_request(EC2_IAM_INFO)
+    # Expected format: arn:aws:iam::<id>:instance-profile/<role_name>
+    role_name = iam_info["InstanceProfileArn"].split("/").last
+    ec2_metadata_request(EC2_IAM_SECURITY_CREDENTIALS + role_name)
+  end
+
+  def ec2_metadata_request(url)
+    uri = URI(url)
+    @request_pool ||= create_request_pool(uri)
+    request = Gem::Request.new(uri, Net::HTTP::Get, nil, @request_pool)
+    response = request.fetch
+
+    case response
+    when Net::HTTPOK then
+      JSON.parse(response.body)
+    else
+      raise InstanceProfileError.new("Unable to fetch AWS metadata from #{uri}: #{response.message} #{response.code}")
+    end
+  end
+
+  def create_request_pool(uri)
+    proxy_uri = Gem::Request.proxy_uri(Gem::Request.get_proxy_from_env(uri.scheme))
+    certs = Gem::Request.get_cert_files
+    Gem::Request::ConnectionPools.new(proxy_uri, certs).pool_for(uri)
+  end
+
+  BASE64_URI_TRANSLATE = { "+" => "%2B", "/" => "%2F", "=" => "%3D", "\n" => "" }.freeze
+  EC2_IAM_INFO = "http://169.254.169.254/latest/meta-data/iam/info".freeze
+  EC2_IAM_SECURITY_CREDENTIALS = "http://169.254.169.254/latest/meta-data/iam/security-credentials/".freeze
+end