rubygems-update 3.0.6 → 3.2.14

data/bundler/lib/bundler/plugin/installer.rb

@@ -8,18 +8,21 @@ module Bundler
   # are heavily dependent on the Gemfile.
   module Plugin
     class Installer
-      autoload :Rubygems, "bundler/plugin/installer/rubygems"
-      autoload :Git,      "bundler/plugin/installer/git"
+      autoload :Rubygems, File.expand_path("installer/rubygems", __dir__)
+      autoload :Git,      File.expand_path("installer/git", __dir__)
 
       def install(names, options)
+        check_sources_consistency!(options)
+
         version = options[:version] || [">= 0"]
-        Bundler.settings.temporary(:lockfile_uses_separate_rubygems_sources => false, :disable_multisource => false) do
-          if options[:git]
-            install_git(names, version, options)
-          else
-            sources = options[:source] || Bundler.rubygems.sources
-            install_rubygems(names, version, sources)
-          end
+
+        if options[:git]
+          install_git(names, version, options)
+        elsif options[:local_git]
+          install_local_git(names, version, options)
+        else
+          sources = options[:source] || Bundler.rubygems.sources
+          install_rubygems(names, version, sources)
         end
       end
 
@@ -36,24 +39,26 @@ module Bundler
         install_from_specs specs
       end
 
-    private
+      private
+
+      def check_sources_consistency!(options)
+        if options.key?(:git) && options.key?(:local_git)
+          raise InvalidOption, "Remote and local plugin git sources can't be both specified"
+        end
+      end
 
       def install_git(names, version, options)
         uri = options.delete(:git)
         options["uri"] = uri
 
-        source_list = SourceList.new
-        source_list.add_git_source(options)
-
-        # To support both sources
-        if options[:source]
-          source_list.add_rubygems_source("remotes" => options[:source])
-        end
+        install_all_sources(names, version, options, options[:source])
+      end
 
-        deps = names.map {|name| Dependency.new name, version }
+      def install_local_git(names, version, options)
+        uri = options.delete(:local_git)
+        options["uri"] = uri
 
-        definition = Definition.new(nil, deps, source_list, true)
-        install_definition(definition)
+        install_all_sources(names, version, options, options[:source])
       end
 
       # Installs the plugin from rubygems source and returns the path where the
@@ -65,10 +70,16 @@ module Bundler
       #
       # @return [Hash] map of names to the specs of plugins installed
       def install_rubygems(names, version, sources)
-        deps = names.map {|name| Dependency.new name, version }
+        install_all_sources(names, version, nil, sources)
+      end
 
+      def install_all_sources(names, version, git_source_options, rubygems_source)
         source_list = SourceList.new
-        source_list.add_rubygems_source("remotes" => sources)
+
+        source_list.add_git_source(git_source_options) if git_source_options
+        source_list.global_rubygems_source = rubygems_source if rubygems_source
+
+        deps = names.map {|name| Dependency.new name, version }
 
         definition = Definition.new(nil, deps, source_list, true)
         install_definition(definition)

data/bundler/lib/bundler/plugin/installer/rubygems.rb

@@ -8,7 +8,7 @@ module Bundler
           "#{spec.name} #{spec.version}"
         end
 
-      private
+        private
 
         def requires_sudo?
           false # Will change on implementation of project level plugins

data/bundler/lib/bundler/plugin/source_list.rb

@@ -17,7 +17,11 @@ module Bundler
         path_sources + git_sources + rubygems_sources + [metadata_source]
       end
 
-    private
+      def default_source
+        git_sources.first || global_rubygems_source
+      end
+
+      private
 
       def rubygems_aggregate_class
         Plugin::Installer::Rubygems

data/bundler/lib/bundler/psyched_yaml.rb

@@ -1,11 +1,5 @@
 # frozen_string_literal: true
 
-# Psych could be a gem, so try to ask for it
-begin
-  gem "psych"
-rescue LoadError
-end if defined?(gem)
-
 # Psych could be in the stdlib
 # but it's too late if Syck is already loaded
 begin
@@ -26,12 +20,3 @@ module Bundler
     YamlLibrarySyntaxError = ::ArgumentError
   end
 end
-
-require "bundler/deprecate"
-begin
-  Bundler::Deprecate.skip_during do
-    require "rubygems/safe_yaml"
-  end
-rescue LoadError
-  # it's OK if the file isn't there
-end

data/bundler/lib/bundler/remote_specification.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "uri"
-
 module Bundler
   # Represents a lazily loaded gem specification, where the full specification
   # is on the source server in rubygems' "quick" index. The proxy object is to
@@ -52,6 +50,8 @@ module Bundler
     # once the remote gem is downloaded, the backend specification will
     # be swapped out.
     def __swap__(spec)
+      raise APIResponseInvalidDependenciesError unless spec.dependencies.all? {|d| d.is_a?(Gem::Dependency) }
+
       SharedHelpers.ensure_same_dependencies(self, dependencies, spec.dependencies)
       @_remote_specification = spec
     end
@@ -78,7 +78,8 @@ module Bundler
         deps = method_missing(:dependencies)
 
         # allow us to handle when the specs dependencies are an array of array of string
-        # see https://github.com/bundler/bundler/issues/5797
+        # in order to delay the crash to `#__swap__` where it results in a friendlier error
+        # see https://github.com/rubygems/bundler/issues/5797
         deps = deps.map {|d| d.is_a?(Gem::Dependency) ? d : Gem::Dependency.new(*d) }
 
         deps
@@ -90,7 +91,7 @@ module Bundler
       " #{source.revision[0..6]}"
     end
 
-  private
+    private
 
     def to_ary
       nil

data/bundler/lib/bundler/resolver.rb

@@ -2,8 +2,10 @@
 
 module Bundler
   class Resolver
-    require "bundler/vendored_molinillo"
-    require "bundler/resolver/spec_group"
+    require_relative "vendored_molinillo"
+    require_relative "resolver/spec_group"
+
+    include GemHelpers
 
     # Figures out the best possible configuration of gems that satisfies
     # the list of passed dependencies and any child dependencies without
@@ -15,31 +17,38 @@ module Bundler
     # ==== Returns
     # <GemBundle>,nil:: If the list of dependencies can be resolved, a
     #   collection of gemspecs is returned. Otherwise, nil is returned.
-    def self.resolve(requirements, index, source_requirements = {}, base = [], gem_version_promoter = GemVersionPromoter.new, additional_base_requirements = [], platforms = nil)
-      platforms = Set.new(platforms) if platforms
+    def self.resolve(requirements, source_requirements = {}, base = [], gem_version_promoter = GemVersionPromoter.new, additional_base_requirements = [], platforms = nil)
       base = SpecSet.new(base) unless base.is_a?(SpecSet)
-      resolver = new(index, source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
+      resolver = new(source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
       result = resolver.start(requirements)
       SpecSet.new(result)
     end
 
-    def initialize(index, source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
-      @index = index
+    def initialize(source_requirements, base, gem_version_promoter, additional_base_requirements, platforms)
       @source_requirements = source_requirements
+
+      @index_requirements = source_requirements.each_with_object({}) do |source_requirement, index_requirements|
+        name, source = source_requirement
+        index_requirements[name] = name == :global ? source : source.specs
+      end
+
       @base = base
       @resolver = Molinillo::Resolver.new(self, self)
       @search_for = {}
       @base_dg = Molinillo::DependencyGraph.new
       @base.each do |ls|
         dep = Dependency.new(ls.name, ls.version)
-        @base_dg.add_vertex(ls.name, DepProxy.new(dep, ls.platform), true)
+        @base_dg.add_vertex(ls.name, DepProxy.get_proxy(dep, ls.platform), true)
       end
       additional_base_requirements.each {|d| @base_dg.add_vertex(d.name, d) }
-      @platforms = platforms
+      @platforms = platforms.reject {|p| p != Gem::Platform::RUBY && (platforms - [p]).any? {|pl| generic(pl) == p } }
+      @resolving_only_for_ruby = platforms == [Gem::Platform::RUBY]
       @gem_version_promoter = gem_version_promoter
-      @allow_bundler_dependency_conflicts = Bundler.feature_flag.allow_bundler_dependency_conflicts?
-      @lockfile_uses_separate_rubygems_sources = Bundler.feature_flag.lockfile_uses_separate_rubygems_sources?
       @use_gvp = Bundler.feature_flag.use_gem_version_promoter_for_major_updates? || !@gem_version_promoter.major?
+      @no_aggregate_global_source = @source_requirements[:global].nil?
+
+      @variant_specific_names = []
+      @generic_names = ["Ruby\0", "RubyGems\0"]
     end
 
     def start(requirements)
@@ -48,9 +57,12 @@ module Bundler
 
       verify_gemfile_dependencies_are_found!(requirements)
       dg = @resolver.resolve(requirements, @base_dg)
-      dg.map(&:payload).
+      dg.
+        tap {|resolved| validate_resolved_specs!(resolved) }.
+        map(&:payload).
         reject {|sg| sg.name.end_with?("\0") }.
-        map(&:to_specs).flatten
+        map(&:to_specs).
+        flatten
     rescue Molinillo::VersionConflict => e
       message = version_conflict_message(e)
       raise VersionConflict.new(e.conflicts.keys.uniq, message)
@@ -72,12 +84,17 @@ module Bundler
       return unless debug?
       debug_info = yield
       debug_info = debug_info.inspect unless debug_info.is_a?(String)
-      STDERR.puts debug_info.split("\n").map {|s| "  " * depth + s }
+      puts debug_info.split("\n").map {|s| depth == 0 ? "BUNDLER: #{s}" : "BUNDLER(#{depth}): #{s}" }
     end
 
     def debug?
       return @debug_mode if defined?(@debug_mode)
-      @debug_mode = ENV["DEBUG_RESOLVER"] || ENV["DEBUG_RESOLVER_TREE"] || false
+      @debug_mode =
+        ENV["BUNDLER_DEBUG_RESOLVER"] ||
+        ENV["BUNDLER_DEBUG_RESOLVER_TREE"] ||
+        ENV["DEBUG_RESOLVER"] ||
+        ENV["DEBUG_RESOLVER_TREE"] ||
+        false
     end
 
     def before_resolution
@@ -95,21 +112,31 @@ module Bundler
     include Molinillo::SpecificationProvider
 
     def dependencies_for(specification)
-      specification.dependencies_for_activated_platforms
+      all_dependencies = specification.dependencies_for_activated_platforms
+
+      if @variant_specific_names.include?(specification.name)
+        @variant_specific_names |= all_dependencies.map(&:name) - @generic_names
+      else
+        generic_names, variant_specific_names = specification.partitioned_dependency_names_for_activated_platforms
+        @variant_specific_names |= variant_specific_names - @generic_names
+        @generic_names |= generic_names
+      end
+
+      all_dependencies
     end
 
-    def search_for(dependency)
-      platform = dependency.__platform
-      dependency = dependency.dep unless dependency.is_a? Gem::Dependency
-      search = @search_for[dependency] ||= begin
-        index = index_for(dependency)
-        results = index.search(dependency, @base[dependency.name])
+    def search_for(dependency_proxy)
+      platform = dependency_proxy.__platform
+      dependency = dependency_proxy.dep
+      name = dependency.name
+      search_result = @search_for[dependency_proxy] ||= begin
+        results = results_for(dependency, @base[name])
 
-        if vertex = @base_dg.vertex_named(dependency.name)
+        if vertex = @base_dg.vertex_named(name)
           locked_requirement = vertex.payload.requirement
         end
 
-        if !@prerelease_specified[dependency.name] && (!@use_gvp || locked_requirement.nil?)
+        if !@prerelease_specified[name] && (!@use_gvp || locked_requirement.nil?)
           # Move prereleases to the beginning of the list, so they're considered
           # last during resolution.
           pre, results = results.partition {|spec| spec.version.prerelease? }
@@ -128,9 +155,20 @@ module Bundler
           end
           nested.reduce([]) do |groups, (version, specs)|
             next groups if locked_requirement && !locked_requirement.satisfied_by?(version)
-            spec_group = SpecGroup.new(specs)
-            spec_group.ignores_bundler_dependencies = @allow_bundler_dependency_conflicts
-            groups << spec_group
+
+            specs_by_platform = Hash.new do |current_specs, current_platform|
+              current_specs[current_platform] = select_best_platform_match(specs, current_platform)
+            end
+
+            spec_group_ruby = SpecGroup.create_for(specs_by_platform, [Gem::Platform::RUBY], Gem::Platform::RUBY)
+            groups << spec_group_ruby if spec_group_ruby
+
+            next groups if @resolving_only_for_ruby
+
+            spec_group = SpecGroup.create_for(specs_by_platform, @platforms, platform)
+            groups << spec_group if spec_group
+
+            groups
           end
         else
           []
@@ -143,63 +181,82 @@ module Bundler
           @gem_version_promoter.sort_versions(dependency, spec_groups)
         end
       end
-      search.select {|sg| sg.for?(platform) }.each {|sg| sg.activate_platform!(platform) }
+
+      unless search_result.empty?
+        specific_dependency = @variant_specific_names.include?(name)
+        return search_result unless specific_dependency
+
+        search_result.each do |sg|
+          if @generic_names.include?(name)
+            @variant_specific_names -= [name]
+            sg.activate_all_platforms!
+          else
+            sg.activate_platform!(platform)
+          end
+        end
+      end
+
+      search_result
     end
 
     def index_for(dependency)
-      source = @source_requirements[dependency.name]
+      source = @index_requirements[dependency.name]
       if source
-        source.specs
-      elsif @lockfile_uses_separate_rubygems_sources
+        source
+      elsif @no_aggregate_global_source
         Index.build do |idx|
-          if dependency.all_sources
-            dependency.all_sources.each {|s| idx.add_source(s.specs) if s }
-          else
-            idx.add_source @source_requirements[:default].specs
-          end
+          dependency.all_sources.each {|s| idx.add_source(s.specs) }
         end
       else
-        @index
+        @index_requirements[:global]
       end
     end
 
+    def results_for(dependency, base)
+      index_for(dependency).search(dependency, base)
+    end
+
     def name_for(dependency)
       dependency.name
     end
 
     def name_for_explicit_dependency_source
       Bundler.default_gemfile.basename.to_s
-    rescue
+    rescue StandardError
       "Gemfile"
     end
 
     def name_for_locking_dependency_source
       Bundler.default_lockfile.basename.to_s
-    rescue
+    rescue StandardError
       "Gemfile.lock"
     end
 
     def requirement_satisfied_by?(requirement, activated, spec)
-      return false unless requirement.matches_spec?(spec) || spec.source.is_a?(Source::Gemspec)
-      spec.activate_platform!(requirement.__platform) if !@platforms || @platforms.include?(requirement.__platform)
-      true
+      requirement.matches_spec?(spec) || spec.source.is_a?(Source::Gemspec)
+    end
+
+    def dependencies_equal?(dependencies, other_dependencies)
+      dependencies.map(&:dep) == other_dependencies.map(&:dep)
     end
 
     def relevant_sources_for_vertex(vertex)
       if vertex.root?
         [@source_requirements[vertex.name]]
-      elsif @lockfile_uses_separate_rubygems_sources
+      elsif @no_aggregate_global_source
         vertex.recursive_predecessors.map do |v|
           @source_requirements[v.name]
-        end << @source_requirements[:default]
+        end.compact << @source_requirements[:default]
+      else
+        []
       end
     end
 
     def sort_dependencies(dependencies, activated, conflicts)
       dependencies.sort_by do |dependency|
-        dependency.all_sources = relevant_sources_for_vertex(activated.vertex_named(dependency.name))
         name = name_for(dependency)
         vertex = activated.vertex_named(name)
+        dependency.all_sources = relevant_sources_for_vertex(vertex)
         [
           @base_dg.vertex_named(name) ? 0 : 1,
           vertex.payload ? 0 : 1,
@@ -212,19 +269,13 @@ module Bundler
       end
     end
 
-    # Sort platforms from most general to most specific
-    def self.sort_platforms(platforms)
-      platforms.sort_by do |platform|
-        platform_sort_key(platform)
-      end
-    end
-
     def self.platform_sort_key(platform)
-      return ["", "", ""] if Gem::Platform::RUBY == platform
-      platform.to_a.map {|part| part || "" }
+      # Prefer specific platform to not specific platform
+      return ["99-LAST", "", "", ""] if Gem::Platform::RUBY == platform
+      ["00", *platform.to_a.map {|part| part || "" }]
     end
 
-  private
+    private
 
     # returns an integer \in (-\infty, 0]
     # a number closer to 0 means the dependency is less constraining
@@ -272,16 +323,16 @@ module Bundler
             "If you are updating multiple gems in your Gemfile at once,\n" \
             "try passing them all to `bundle update`"
         elsif source = @source_requirements[name]
-          specs = source.specs[name]
+          specs = source.specs.search(name)
           versions_with_platforms = specs.map {|s| [s.version, s.platform] }
           message = String.new("Could not find gem '#{SharedHelpers.pretty_dependency(requirement)}' in #{source}#{cache_message}.\n")
           message << if versions_with_platforms.any?
-                       "The source contains '#{name}' at: #{formatted_versions_with_platforms(versions_with_platforms)}"
-                     else
-                       "The source does not contain any versions of '#{name}'"
-                     end
+            "The source contains the following versions of '#{name}': #{formatted_versions_with_platforms(versions_with_platforms)}"
+          else
+            "The source does not contain any versions of '#{name}'"
+          end
         else
-          message = "Could not find gem '#{requirement}' in any of the gem sources " \
+          message = "Could not find gem '#{SharedHelpers.pretty_dependency(requirement)}' in any of the gem sources " \
             "listed in your Gemfile#{cache_message}."
         end
         raise GemNotFound, message
@@ -300,9 +351,25 @@ module Bundler
     end
 
     def version_conflict_message(e)
+      # only show essential conflicts, if possible
+      conflicts = e.conflicts.dup
+
+      if conflicts["bundler"]
+        conflicts.replace("bundler" => conflicts["bundler"])
+      else
+        conflicts.delete_if do |_name, conflict|
+          deps = conflict.requirement_trees.map(&:last).flatten(1)
+          !Bundler::VersionRanges.empty?(*Bundler::VersionRanges.for_many(deps.map(&:requirement)))
+        end
+      end
+
+      e = Molinillo::VersionConflict.new(conflicts, e.specification_provider) unless conflicts.empty?
+
+      solver_name = "Bundler"
+      possibility_type = "gem"
       e.message_with_trees(
-        :solver_name => "Bundler",
-        :possibility_type => "gem",
+        :solver_name => solver_name,
+        :possibility_type => possibility_type,
         :reduce_trees => lambda do |trees|
           # called first, because we want to reduce the amount of work required to find maximal empty sets
           trees = trees.uniq {|t| t.flatten.map {|dep| [dep.name, dep.requirement] } }
@@ -314,10 +381,8 @@ module Bundler
           end.flatten(1).select do |deps|
             Bundler::VersionRanges.empty?(*Bundler::VersionRanges.for_many(deps.map(&:requirement)))
           end.min_by(&:size)
-          trees.reject! {|t| !maximal.include?(t.last) } if maximal
 
-          trees = trees.sort_by {|t| t.flatten.map(&:to_s) }
-          trees.uniq! {|t| t.flatten.map {|dep| [dep.name, dep.requirement] } }
+          trees.reject! {|t| !maximal.include?(t.last) } if maximal
 
           trees.sort_by {|t| t.reverse.map(&:name) }
         end,
@@ -325,15 +390,25 @@ module Bundler
         :additional_message_for_conflict => lambda do |o, name, conflict|
           if name == "bundler"
             o << %(\n  Current Bundler version:\n    bundler (#{Bundler::VERSION}))
-            other_bundler_required = !conflict.requirement.requirement.satisfied_by?(Gem::Version.new Bundler::VERSION)
-          end
 
-          if name == "bundler" && other_bundler_required
-            o << "\n"
-            o << "This Gemfile requires a different version of Bundler.\n"
-            o << "Perhaps you need to update Bundler by running `gem install bundler`?\n"
-          end
-          if conflict.locked_requirement
+            conflict_dependency = conflict.requirement
+            conflict_requirement = conflict_dependency.requirement
+            other_bundler_required = !conflict_requirement.satisfied_by?(Gem::Version.new(Bundler::VERSION))
+
+            if other_bundler_required
+              o << "\n\n"
+
+              candidate_specs = @index_requirements[:default_bundler].search(conflict_dependency)
+              if candidate_specs.any?
+                target_version = candidate_specs.last.version
+                new_command = [File.basename($PROGRAM_NAME), "_#{target_version}_", *ARGV].join(" ")
+                o << "Your bundle requires a different version of Bundler than the one you're running.\n"
+                o << "Install the necessary version with `gem install bundler:#{target_version}` and rerun bundler using `#{new_command}`\n"
+              else
+                o << "Your bundle requires a different version of Bundler than the one you're running, and that version could not be found.\n"
+              end
+            end
+          elsif conflict.locked_requirement
             o << "\n"
             o << %(Running `bundle update` will rebuild your snapshot from scratch, using only\n)
             o << %(the gems in your Gemfile, which may resolve the conflict.\n)
@@ -342,17 +417,15 @@ module Bundler
 
             relevant_sources = if conflict.requirement.source
               [conflict.requirement.source]
-            elsif conflict.requirement.all_sources
-              conflict.requirement.all_sources
-            elsif @lockfile_uses_separate_rubygems_sources
-              # every conflict should have an explicit group of sources when we
-              # enforce strict pinning
-              raise "no source set for #{conflict}"
             else
-              []
+              conflict.requirement.all_sources
             end.compact.map(&:to_s).uniq.sort
 
-            o << "Could not find gem '#{SharedHelpers.pretty_dependency(conflict.requirement)}'"
+            metadata_requirement = name.end_with?("\0")
+
+            o << "Could not find gem '" unless metadata_requirement
+            o << SharedHelpers.pretty_dependency(conflict.requirement)
+            o << "'" unless metadata_requirement
             if conflict.requirement_trees.first.size > 1
               o << ", which is required by "
               o << "gem '#{SharedHelpers.pretty_dependency(conflict.requirement_trees.first[-2])}',"
@@ -360,14 +433,45 @@ module Bundler
             o << " "
 
             o << if relevant_sources.empty?
-                   "in any of the sources.\n"
-                 else
-                   "in any of the relevant sources:\n  #{relevant_sources * "\n  "}\n"
-                 end
+              "in any of the sources.\n"
+            elsif metadata_requirement
+              "is not available in #{relevant_sources.join(" or ")}"
+            else
+              "in any of the relevant sources:\n  #{relevant_sources * "\n  "}\n"
+            end
           end
         end,
-        :version_for_spec => lambda {|spec| spec.version }
+        :version_for_spec => lambda {|spec| spec.version },
+        :incompatible_version_message_for_conflict => lambda do |name, _conflict|
+          if name.end_with?("\0")
+            %(#{solver_name} found conflicting requirements for the #{name} version:)
+          else
+            %(#{solver_name} could not find compatible versions for #{possibility_type} "#{name}":)
+          end
+        end
       )
     end
+
+    def validate_resolved_specs!(resolved_specs)
+      resolved_specs.each do |v|
+        name = v.name
+        sources = relevant_sources_for_vertex(v)
+        next unless sources.any?
+        if default_index = sources.index(@source_requirements[:default])
+          sources.delete_at(default_index)
+        end
+        sources.reject! {|s| s.specs.search(name).empty? }
+        sources.uniq!
+        next if sources.size <= 1
+
+        msg = ["The gem '#{name}' was found in multiple relevant sources."]
+        msg.concat sources.map {|s| "  * #{s}" }.sort
+        msg << "You #{@no_aggregate_global_source ? :must : :should} add this gem to the source block for the source you wish it to be installed from."
+        msg = msg.join("\n")
+
+        raise SecurityError, msg if @no_aggregate_global_source
+        Bundler.ui.warn "Warning: #{msg}"
+      end
+    end
   end
 end