rubygems-update 3.2.26 → 3.2.30

data/lib/rubygems.rb

@@ -8,15 +8,15 @@
 require 'rbconfig'
 
 module Gem
-  VERSION = "3.2.26".freeze
+  VERSION = "3.2.30".freeze
 end
 
 # Must be first since it unloads the prelude from 1.9.2
-require 'rubygems/compatibility'
+require_relative 'rubygems/compatibility'
 
-require 'rubygems/defaults'
-require 'rubygems/deprecate'
-require 'rubygems/errors'
+require_relative 'rubygems/defaults'
+require_relative 'rubygems/deprecate'
+require_relative 'rubygems/errors'
 
 ##
 # RubyGems is the Ruby standard for publishing and managing third party
@@ -178,7 +178,7 @@ module Gem
   @configuration = nil
   @gemdeps = nil
   @loaded_specs = {}
-  LOADED_SPECS_MUTEX = Mutex.new
+  LOADED_SPECS_MUTEX = Thread::Mutex.new
   @path_to_default_spec_map = {}
   @platforms = []
   @ruby = nil
@@ -559,7 +559,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
   #   => [#<Gem::Specification:0x1013b4528 @name="minitest", ...>]
 
   def self.install(name, version = Gem::Requirement.default, *options)
-    require "rubygems/dependency_installer"
+    require_relative "rubygems/dependency_installer"
     inst = Gem::DependencyInstaller.new(*options)
     inst.install name, version
     inst.installed_gems
@@ -625,12 +625,12 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
     rescue ::LoadError
       # If we can't load psych, that's fine, go on.
     else
-      require 'rubygems/psych_additions'
-      require 'rubygems/psych_tree'
+      require_relative 'rubygems/psych_additions'
+      require_relative 'rubygems/psych_tree'
     end
 
     require 'yaml'
-    require 'rubygems/safe_yaml'
+    require_relative 'rubygems/safe_yaml'
 
     @yaml_loaded = true
   end
@@ -990,7 +990,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
   # Lazily loads DefaultUserInteraction and returns the default UI.
 
   def self.ui
-    require 'rubygems/user_interaction'
+    require_relative 'rubygems/user_interaction'
 
     Gem::DefaultUserInteraction.ui
   end
@@ -1110,7 +1110,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
     end
 
     ENV["BUNDLE_GEMFILE"] ||= File.expand_path(path)
-    require 'rubygems/user_interaction'
+    require_relative 'rubygems/user_interaction'
     require "bundler"
     begin
       Gem::DefaultUserInteraction.use_ui(ui) do
@@ -1322,7 +1322,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
   autoload :Version,            File.expand_path('rubygems/version', __dir__)
 end
 
-require 'rubygems/exceptions'
+require_relative 'rubygems/exceptions'
 
 # REFACTOR: This should be pulled out into some kind of hacks file.
 begin
@@ -1353,6 +1353,6 @@ end
 # Loads the default specs.
 Gem::Specification.load_defaults
 
-require 'rubygems/core_ext/kernel_gem'
-require 'rubygems/core_ext/kernel_require'
-require 'rubygems/core_ext/kernel_warn'
+require_relative 'rubygems/core_ext/kernel_gem'
+require_relative 'rubygems/core_ext/kernel_require'
+require_relative 'rubygems/core_ext/kernel_warn'

data/rubygems-update.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name = "rubygems-update"
-  s.version = "3.2.26"
+  s.version = "3.2.30"
   s.authors = ["Jim Weirich", "Chad Fowler", "Eric Hodel", "Luis Lavena", "Aaron Patterson", "Samuel Giddins", "André Arko", "Evan Phoenix", "Hiroshi SHIBATA"]
   s.email = ["", "", "drbrain@segment7.net", "luislavena@gmail.com", "aaron@tenderlovemaking.com", "segiddins@segiddins.me", "andre@arko.net", "evan@phx.io", "hsbt@ruby-lang.org"]
 

data/test/rubygems/helper.rb

@@ -398,6 +398,7 @@ class Gem::TestCase < Test::Unit::TestCase
 
     ENV['GEM_PRIVATE_KEY_PASSPHRASE'] = PRIVATE_KEY_PASSPHRASE
 
+    Gem.instance_variable_set(:@default_specifications_dir, nil)
     if Gem.java_platform?
       @orig_default_gem_home = RbConfig::CONFIG['default_gem_home']
       RbConfig::CONFIG['default_gem_home'] = @gemhome
@@ -481,6 +482,7 @@ class Gem::TestCase < Test::Unit::TestCase
 
     RbConfig::CONFIG['bindir'] = @orig_bindir
 
+    Gem.instance_variable_set :@default_specifications_dir, nil
     if Gem.java_platform?
       RbConfig::CONFIG['default_gem_home'] = @orig_default_gem_home
     else
@@ -825,16 +827,6 @@ class Gem::TestCase < Test::Unit::TestCase
     Gem::Specification.unresolved_deps.values.map(&:to_s).sort
   end
 
-  def save_loaded_features
-    old_loaded_features = $LOADED_FEATURES.dup
-    yield
-  ensure
-    prefix = File.dirname(__FILE__) + "/"
-    new_features = ($LOADED_FEATURES - old_loaded_features)
-    old_loaded_features.concat(new_features.select {|f| f.rindex(prefix, 0) })
-    $LOADED_FEATURES.replace old_loaded_features
-  end
-
   def new_default_spec(name, version, deps = nil, *files)
     spec = util_spec name, version, deps
 
@@ -1529,14 +1521,14 @@ Also, a list:
   end
 
   ##
-  # Loads an RSA private key named +key_name+ with +passphrase+ in <tt>test/rubygems/</tt>
+  # Loads a private key named +key_name+ with +passphrase+ in <tt>test/rubygems/</tt>
 
   def self.load_key(key_name, passphrase = nil)
     key_file = key_path key_name
 
     key = File.read key_file
 
-    OpenSSL::PKey::RSA.new key, passphrase
+    OpenSSL::PKey.read key, passphrase
   end
 
   ##

data/test/rubygems/private_ec_key.pem

@@ -0,0 +1,9 @@
+-----BEGIN EC PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,4107F98A374CB8EC18F1AA4EA4B6A0DB
+
+BRklFxJGcz7gqQYxek8TZkt8qbPhB0FSR6nyw3SYuio/2tlT9ohs74mlK3EbG9Lt
+Y4OquJbksBFmoB7fIoM4vnuIZ0Eoz2ooxn9tjhBtqJ3mVscYXwZmA3UDUWDMlviQ
+Fu37OpikQv4TFA1jlmUK0LM8xmUCfUeLl0kHD17lFsz2gkO2kwg8mn/YUMOIaDOu
+EnnmxbAwnZBpemQkQfpTt2mYL9gu3CcMt5gokBuGDxY=
+-----END EC PRIVATE KEY-----

data/test/rubygems/test_gem.rb

@@ -25,72 +25,66 @@ class TestGem < Gem::TestCase
   end
 
   def test_self_finish_resolve
-    save_loaded_features do
-      a1 = util_spec "a", "1", "b" => "> 0"
-      b1 = util_spec "b", "1", "c" => ">= 1"
-      b2 = util_spec "b", "2", "c" => ">= 2"
-      c1 = util_spec "c", "1"
-      c2 = util_spec "c", "2"
+    a1 = util_spec "a", "1", "b" => "> 0"
+    b1 = util_spec "b", "1", "c" => ">= 1"
+    b2 = util_spec "b", "2", "c" => ">= 2"
+    c1 = util_spec "c", "1"
+    c2 = util_spec "c", "2"
 
-      install_specs c1, c2, b1, b2, a1
+    install_specs c1, c2, b1, b2, a1
 
-      a1.activate
+    a1.activate
 
-      assert_equal %w[a-1], loaded_spec_names
-      assert_equal ["b (> 0)"], unresolved_names
+    assert_equal %w[a-1], loaded_spec_names
+    assert_equal ["b (> 0)"], unresolved_names
 
-      Gem.finish_resolve
+    Gem.finish_resolve
 
-      assert_equal %w[a-1 b-2 c-2], loaded_spec_names
-      assert_equal [], unresolved_names
-    end
+    assert_equal %w[a-1 b-2 c-2], loaded_spec_names
+    assert_equal [], unresolved_names
   end
 
   def test_self_finish_resolve_wtf
-    save_loaded_features do
-      a1 = util_spec "a", "1", "b" => "> 0", "d" => "> 0"    # this
-      b1 = util_spec "b", "1", { "c" => ">= 1" }, "lib/b.rb" # this
-      b2 = util_spec "b", "2", { "c" => ">= 2" }, "lib/b.rb"
-      c1 = util_spec "c", "1"                                # this
-      c2 = util_spec "c", "2"
-      d1 = util_spec "d", "1", { "c" => "< 2" },  "lib/d.rb"
-      d2 = util_spec "d", "2", { "c" => "< 2" },  "lib/d.rb" # this
+    a1 = util_spec "a", "1", "b" => "> 0", "d" => "> 0"    # this
+    b1 = util_spec "b", "1", { "c" => ">= 1" }, "lib/b.rb" # this
+    b2 = util_spec "b", "2", { "c" => ">= 2" }, "lib/b.rb"
+    c1 = util_spec "c", "1"                                # this
+    c2 = util_spec "c", "2"
+    d1 = util_spec "d", "1", { "c" => "< 2" },  "lib/d.rb"
+    d2 = util_spec "d", "2", { "c" => "< 2" },  "lib/d.rb" # this
 
-      install_specs c1, c2, b1, b2, d1, d2, a1
+    install_specs c1, c2, b1, b2, d1, d2, a1
 
-      a1.activate
+    a1.activate
 
-      assert_equal %w[a-1], loaded_spec_names
-      assert_equal ["b (> 0)", "d (> 0)"], unresolved_names
+    assert_equal %w[a-1], loaded_spec_names
+    assert_equal ["b (> 0)", "d (> 0)"], unresolved_names
 
-      Gem.finish_resolve
+    Gem.finish_resolve
 
-      assert_equal %w[a-1 b-1 c-1 d-2], loaded_spec_names
-      assert_equal [], unresolved_names
-    end
+    assert_equal %w[a-1 b-1 c-1 d-2], loaded_spec_names
+    assert_equal [], unresolved_names
   end
 
   def test_self_finish_resolve_respects_loaded_specs
-    save_loaded_features do
-      a1 = util_spec "a", "1", "b" => "> 0"
-      b1 = util_spec "b", "1", "c" => ">= 1"
-      b2 = util_spec "b", "2", "c" => ">= 2"
-      c1 = util_spec "c", "1"
-      c2 = util_spec "c", "2"
+    a1 = util_spec "a", "1", "b" => "> 0"
+    b1 = util_spec "b", "1", "c" => ">= 1"
+    b2 = util_spec "b", "2", "c" => ">= 2"
+    c1 = util_spec "c", "1"
+    c2 = util_spec "c", "2"
 
-      install_specs c1, c2, b1, b2, a1
+    install_specs c1, c2, b1, b2, a1
 
-      a1.activate
-      c1.activate
+    a1.activate
+    c1.activate
 
-      assert_equal %w[a-1 c-1], loaded_spec_names
-      assert_equal ["b (> 0)"], unresolved_names
+    assert_equal %w[a-1 c-1], loaded_spec_names
+    assert_equal ["b (> 0)"], unresolved_names
 
-      Gem.finish_resolve
+    Gem.finish_resolve
 
-      assert_equal %w[a-1 b-1 c-1], loaded_spec_names
-      assert_equal [], unresolved_names
-    end
+    assert_equal %w[a-1 b-1 c-1], loaded_spec_names
+    assert_equal [], unresolved_names
   end
 
   def test_self_install
@@ -210,25 +204,21 @@ class TestGem < Gem::TestCase
   end
 
   def test_require_missing
-    save_loaded_features do
-      assert_raise ::LoadError do
-        require "test_require_missing"
-      end
+    assert_raise ::LoadError do
+      require "test_require_missing"
     end
   end
 
   def test_require_does_not_glob
-    save_loaded_features do
-      a1 = util_spec "a", "1", nil, "lib/a1.rb"
+    a1 = util_spec "a", "1", nil, "lib/a1.rb"
 
-      install_specs a1
-
-      assert_raise ::LoadError do
-        require "a*"
-      end
+    install_specs a1
 
-      assert_equal [], loaded_spec_names
+    assert_raise ::LoadError do
+      require "a*"
     end
+
+    assert_equal [], loaded_spec_names
   end
 
   def test_self_bin_path_active
@@ -1483,24 +1473,22 @@ class TestGem < Gem::TestCase
   end
 
   def test_self_needs_picks_up_unresolved_deps
-    save_loaded_features do
-      a = util_spec "a", "1"
-      b = util_spec "b", "1", "c" => nil
-      c = util_spec "c", "2"
-      d = util_spec "d", "1", {'e' => '= 1'}, "lib/d#{$$}.rb"
-      e = util_spec "e", "1"
-
-      install_specs a, c, b, e, d
+    a = util_spec "a", "1"
+    b = util_spec "b", "1", "c" => nil
+    c = util_spec "c", "2"
+    d = util_spec "d", "1", {'e' => '= 1'}, "lib/d#{$$}.rb"
+    e = util_spec "e", "1"
 
-      Gem.needs do |r|
-        r.gem "a"
-        r.gem "b", "= 1"
+    install_specs a, c, b, e, d
 
-        require "d#{$$}"
-      end
+    Gem.needs do |r|
+      r.gem "a"
+      r.gem "b", "= 1"
 
-      assert_equal %w[a-1 b-1 c-2 d-1 e-1], loaded_spec_names
+      require "d#{$$}"
     end
+
+    assert_equal %w[a-1 b-1 c-2 d-1 e-1], loaded_spec_names
   end
 
   def test_self_gunzip

data/test/rubygems/test_gem_commands_cert_command.rb

@@ -14,9 +14,10 @@ class TestGemCommandsCertCommand < Gem::TestCase
   ALTERNATE_CERT = load_cert 'alternate'
   EXPIRED_PUBLIC_CERT = load_cert 'expired'
 
-  ALTERNATE_KEY_FILE = key_path 'alternate'
-  PRIVATE_KEY_FILE   = key_path 'private'
-  PUBLIC_KEY_FILE    = key_path 'public'
+  ALTERNATE_KEY_FILE  = key_path 'alternate'
+  PRIVATE_KEY_FILE    = key_path 'private'
+  PRIVATE_EC_KEY_FILE = key_path 'private_ec'
+  PUBLIC_KEY_FILE     = key_path 'public'
 
   ALTERNATE_CERT_FILE      = cert_path 'alternate'
   CHILD_CERT_FILE          = cert_path 'child'
@@ -142,6 +143,42 @@ Added '/CN=alternate/DC=example'
     assert_path_exist File.join(@tempdir, 'gem-public_cert.pem')
   end
 
+  def test_execute_build_key_algorithm_ec_key
+    passphrase = 'Foo bar'
+
+    @cmd.handle_options %W[--build nobody@example.com --key-algorithm ec]
+
+    @build_ui = Gem::MockGemUi.new "#{passphrase}\n#{passphrase}"
+
+    use_ui @build_ui do
+      @cmd.execute
+    end
+
+    output = @build_ui.output.squeeze("\n").split "\n"
+
+    assert_equal "Passphrase for your Private Key:  ",
+                 output.shift
+    assert_equal "Please repeat the passphrase for your Private Key:  ",
+                 output.shift
+    assert_equal "Certificate: #{File.join @tempdir, 'gem-public_cert.pem'}",
+                 output.shift
+    assert_equal "Private Key: #{File.join @tempdir, 'gem-private_key.pem'}",
+                 output.shift
+
+    assert_equal "Don't forget to move the key file to somewhere private!",
+                 output.shift
+
+    assert_empty output
+    assert_empty @build_ui.error
+
+    assert_path_exist File.join(@tempdir, 'gem-private_key.pem')
+
+    cert_path = File.join(@tempdir, 'gem-public_cert.pem')
+    assert_path_exist cert_path
+    cert = OpenSSL::X509::Certificate.new(File.read(cert_path))
+    assert cert.public_key.is_a? OpenSSL::PKey::EC
+  end
+
   def test_execute_build_bad_email_address
     passphrase = 'Foo bar'
     email = "nobody@"
@@ -279,6 +316,28 @@ Added '/CN=alternate/DC=example'
     assert_path_exist File.join(@tempdir, 'gem-public_cert.pem')
   end
 
+  def test_execute_build_ec_key
+    @cmd.handle_options %W[
+      --build nobody@example.com
+      --private-key #{PRIVATE_EC_KEY_FILE}
+    ]
+
+    use_ui @ui do
+      @cmd.execute
+    end
+
+    output = @ui.output.split "\n"
+
+    assert_equal "Certificate: #{File.join @tempdir, 'gem-public_cert.pem'}",
+                 output.shift
+
+    assert_empty output
+    assert_empty @ui.error
+
+    assert_path_exist File.join(@tempdir, 'gem-public_cert.pem')
+    assert_path_not_exist File.join(@tempdir, 'gem-private_key.pem')
+  end
+
   def test_execute_certificate
     use_ui @ui do
       @cmd.handle_options %W[--certificate #{PUBLIC_CERT_FILE}]
@@ -742,7 +801,7 @@ ERROR:  --private-key not specified and ~/.gem/gem-private_key.pem does not exis
       @cmd.handle_options %W[--private-key #{bad}]
     end
 
-    assert_equal "invalid argument: --private-key #{bad}: invalid RSA key",
+    assert_equal "invalid argument: --private-key #{bad}: invalid RSA, DSA, or EC key",
                  e.message
 
     e = assert_raise OptionParser::InvalidArgument do

data/test/rubygems/test_gem_commands_install_command.rb

@@ -1067,6 +1067,31 @@ ERROR:  Possible alternatives: non_existent_with_hint
     assert_equal x, e
   end
 
+  def test_redact_credentials_from_uri_on_warning
+    spec_fetcher do |fetcher|
+      fetcher.download 'a', 2
+    end
+
+    Gem.sources << "http://username:SECURE_TOKEN@nonexistent.example"
+
+    @cmd.options[:args] = %w[a]
+
+    use_ui @ui do
+      assert_raise Gem::MockGemUi::SystemExitException, @ui.error do
+        @cmd.execute
+      end
+    end
+
+    assert_equal %w[a-2], @cmd.installed_specs.map {|spec| spec.full_name }
+
+    assert_match "1 gem installed", @ui.output
+
+    e = @ui.error
+
+    x = "WARNING:  Unable to pull data from 'http://username:REDACTED@nonexistent.example': no data for http://username:REDACTED@nonexistent.example/specs.4.8.gz (http://username:REDACTED@nonexistent.example/specs.4.8.gz)\n"
+    assert_equal x, e
+  end
+
   def test_execute_uses_from_a_gemdeps
     spec_fetcher do |fetcher|
       fetcher.gem 'a', 2

data/test/rubygems/test_gem_package.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'package/tar_test_case'
-require 'digest'
+require 'rubygems/openssl'
 
 class TestGemPackage < Gem::Package::TarTestCase
   def setup
@@ -84,17 +84,17 @@ class TestGemPackage < Gem::Package::TarTestCase
       io.write spec.to_yaml
     end
 
-    metadata_sha256 = Digest::SHA256.hexdigest s.string
-    metadata_sha512 = Digest::SHA512.hexdigest s.string
+    metadata_sha256 = OpenSSL::Digest::SHA256.hexdigest s.string
+    metadata_sha512 = OpenSSL::Digest::SHA512.hexdigest s.string
 
     expected = {
       'SHA512' => {
         'metadata.gz' => metadata_sha512,
-        'data.tar.gz' => Digest::SHA512.hexdigest(tar),
+        'data.tar.gz' => OpenSSL::Digest::SHA512.hexdigest(tar),
       },
       'SHA256' => {
         'metadata.gz' => metadata_sha256,
-        'data.tar.gz' => Digest::SHA256.hexdigest(tar),
+        'data.tar.gz' => OpenSSL::Digest::SHA256.hexdigest(tar),
       },
     }
 
@@ -574,18 +574,19 @@ class TestGemPackage < Gem::Package::TarTestCase
     destination_subdir = File.join @destination, 'subdir'
     FileUtils.mkdir_p destination_subdir
 
-    e = assert_raise(Gem::Package::PathError, Errno::EACCES) do
+    expected_exceptions = win_platform? ? [Gem::Package::SymlinkError, Errno::EACCES] : [Gem::Package::SymlinkError]
+
+    e = assert_raise(*expected_exceptions) do
       package.extract_tar_gz tgz_io, destination_subdir
     end
 
-    if Gem::Package::PathError === e
-      assert_equal("installing into parent path lib/link/outside.txt of " +
-                  "#{destination_subdir} is not allowed", e.message)
-    elsif win_platform?
-      pend "symlink - must be admin with no UAC on Windows"
-    else
-      raise e
-    end
+    pend "symlink - must be admin with no UAC on Windows" if Errno::EACCES === e
+
+    assert_equal("installing symlink 'lib/link' pointing to parent path #{@destination} of " +
+                "#{destination_subdir} is not allowed", e.message)
+
+    assert_path_not_exist File.join(@destination, "outside.txt")
+    assert_path_not_exist File.join(destination_subdir, "lib/link")
   end
 
   def test_extract_symlink_parent_doesnt_delete_user_dir
@@ -608,20 +609,20 @@ class TestGemPackage < Gem::Package::TarTestCase
       tar.add_symlink 'link/dir', '.', 16877
     end
 
-    e = assert_raise(Gem::Package::PathError, Errno::EACCES) do
+    expected_exceptions = win_platform? ? [Gem::Package::SymlinkError, Errno::EACCES] : [Gem::Package::SymlinkError]
+
+    e = assert_raise(*expected_exceptions) do
       package.extract_tar_gz tgz_io, destination_subdir
     end
 
-    assert_path_exist destination_user_subdir
+    pend "symlink - must be admin with no UAC on Windows" if Errno::EACCES === e
 
-    if Gem::Package::PathError === e
-      assert_equal("installing into parent path #{destination_user_subdir} of " +
-                  "#{destination_subdir} is not allowed", e.message)
-    elsif win_platform?
-      pend "symlink - must be admin with no UAC on Windows"
-    else
-      raise e
-    end
+    assert_equal("installing symlink 'link' pointing to parent path #{destination_user_dir} of " +
+                "#{destination_subdir} is not allowed", e.message)
+
+    assert_path_exist destination_user_subdir
+    assert_path_not_exist File.join(destination_subdir, "link/dir")
+    assert_path_not_exist File.join(destination_subdir, "link")
   end
 
   def test_extract_tar_gz_directory
@@ -856,7 +857,7 @@ class TestGemPackage < Gem::Package::TarTestCase
         io.write metadata_gz
       end
 
-      digest = Digest::SHA1.new
+      digest = OpenSSL::Digest::SHA1.new
       digest << metadata_gz
 
       checksums = {
@@ -1015,7 +1016,7 @@ class TestGemPackage < Gem::Package::TarTestCase
         bogus_data = Gem::Util.gzip 'hello'
         fake_signer = Class.new do
           def digest_name; 'SHA512'; end
-          def digest_algorithm; Digest(:SHA512).new; end
+          def digest_algorithm; OpenSSL::Digest(:SHA512).new; end
           def key; 'key'; end
           def sign(*); 'fake_sig'; end
         end

data/test/rubygems/test_gem_platform.rb

@@ -122,6 +122,7 @@ class TestGemPlatform < Gem::TestCase
       'i586-linux-gnu'         => ['x86',       'linux',     nil],
       'i386-linux-gnu'         => ['x86',       'linux',     nil],
       'i386-mingw32'           => ['x86',       'mingw32',   nil],
+      'x64-mingw-ucrt'         => ['x64',       'mingw',     'ucrt'],
       'i386-mswin32'           => ['x86',       'mswin32',   nil],
       'i386-mswin32_80'        => ['x86',       'mswin32',   '80'],
       'i386-mswin32-80'        => ['x86',       'mswin32',   '80'],

data/test/rubygems/test_gem_remote_fetcher.rb

@@ -241,6 +241,36 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     assert File.exist?(a1_cache_gem)
   end
 
+  def test_download_with_token
+    a1_data = nil
+    File.open @a1_gem, 'rb' do |fp|
+      a1_data = fp.read
+    end
+
+    fetcher = util_fuck_with_fetcher a1_data
+
+    a1_cache_gem = @a1.cache_file
+    assert_equal a1_cache_gem, fetcher.download(@a1, 'http://token@gems.example.com')
+    assert_equal("http://token@gems.example.com/gems/a-1.gem",
+                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert File.exist?(a1_cache_gem)
+  end
+
+  def test_download_with_x_oauth_basic
+    a1_data = nil
+    File.open @a1_gem, 'rb' do |fp|
+      a1_data = fp.read
+    end
+
+    fetcher = util_fuck_with_fetcher a1_data
+
+    a1_cache_gem = @a1.cache_file
+    assert_equal a1_cache_gem, fetcher.download(@a1, 'http://token:x-oauth-basic@gems.example.com')
+    assert_equal("http://token:x-oauth-basic@gems.example.com/gems/a-1.gem",
+                 fetcher.instance_variable_get(:@test_arg).to_s)
+    assert File.exist?(a1_cache_gem)
+  end
+
   def test_download_with_encoded_auth
     a1_data = nil
     File.open @a1_gem, 'rb' do |fp|