rubygems-update 3.3.18 → 3.4.19

data/lib/rubygems/package.rb

@@ -1,12 +1,13 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
 #++
 
 require_relative "../rubygems"
-require_relative 'security'
-require_relative 'user_interaction'
+require_relative "security"
+require_relative "user_interaction"
 
 ##
 # Example using a Gem::Package
@@ -68,14 +69,14 @@ class Gem::Package
   class PathError < Error
     def initialize(destination, destination_dir)
       super "installing into parent path %s of %s is not allowed" %
-              [destination, destination_dir]
+        [destination, destination_dir]
     end
   end
 
   class SymlinkError < Error
     def initialize(name, destination, destination_dir)
       super "installing symlink '%s' pointing to parent path %s of %s is not allowed" %
-              [name, destination, destination_dir]
+        [name, destination, destination_dir]
     end
   end
 
@@ -158,7 +159,7 @@ class Gem::Package
     return super unless gem.present?
 
     return super unless gem.start
-    return super unless gem.start.include? 'MD5SUM ='
+    return super unless gem.start.include? "MD5SUM ="
 
     Gem::Package::Old.new gem
   end
@@ -178,9 +179,9 @@ class Gem::Package
       tar = Gem::Package::TarReader.new io
       tar.each_entry do |entry|
         case entry.full_name
-        when 'metadata' then
+        when "metadata" then
           metadata = entry.read
-        when 'metadata.gz' then
+        when "metadata.gz" then
           metadata = Gem::Util.gunzip entry.read
         end
       end
@@ -193,7 +194,7 @@ class Gem::Package
   # Creates a new package that will read or write to the file +gem+.
 
   def initialize(gem, security_policy) # :notnew:
-    require 'zlib'
+    require "zlib"
 
     @gem = gem
 
@@ -229,7 +230,7 @@ class Gem::Package
       end
     end
 
-    tar.add_file_signed 'checksums.yaml.gz', 0444, @signer do |io|
+    tar.add_file_signed "checksums.yaml.gz", 0444, @signer do |io|
       gzip_to io do |gz_io|
         Psych.dump checksums_by_algorithm, gz_io
       end
@@ -241,7 +242,7 @@ class Gem::Package
   # and adds this file to the +tar+.
 
   def add_contents(tar) # :nodoc:
-    digests = tar.add_file_signed 'data.tar.gz', 0444, @signer do |io|
+    digests = tar.add_file_signed "data.tar.gz", 0444, @signer do |io|
       gzip_to io do |gz_io|
         Gem::Package::TarWriter.new gz_io do |data_tar|
           add_files data_tar
@@ -249,7 +250,7 @@ class Gem::Package
       end
     end
 
-    @checksums['data.tar.gz'] = digests
+    @checksums["data.tar.gz"] = digests
   end
 
   ##
@@ -266,7 +267,7 @@ class Gem::Package
       next unless stat.file?
 
       tar.add_file_simple file, stat.mode, stat.size do |dst_io|
-        File.open file, 'rb' do |src_io|
+        File.open file, "rb" do |src_io|
           dst_io.write src_io.read 16384 until src_io.eof?
         end
       end
@@ -277,13 +278,13 @@ class Gem::Package
   # Adds the package's Gem::Specification to the +tar+ file
 
   def add_metadata(tar) # :nodoc:
-    digests = tar.add_file_signed 'metadata.gz', 0444, @signer do |io|
+    digests = tar.add_file_signed "metadata.gz", 0444, @signer do |io|
       gzip_to io do |gz_io|
         gz_io.write @spec.to_yaml
       end
     end
 
-    @checksums['metadata.gz'] = digests
+    @checksums["metadata.gz"] = digests
   end
 
   ##
@@ -335,7 +336,7 @@ EOM
       gem_tar = Gem::Package::TarReader.new io
 
       gem_tar.each do |entry|
-        next unless entry.full_name == 'data.tar.gz'
+        next unless entry.full_name == "data.tar.gz"
 
         open_tar_gz entry do |pkg_tar|
           pkg_tar.each do |contents_entry|
@@ -387,7 +388,7 @@ EOM
       reader = Gem::Package::TarReader.new io
 
       reader.each do |entry|
-        next unless entry.full_name == 'data.tar.gz'
+        next unless entry.full_name == "data.tar.gz"
 
         extract_tar_gz entry, destination_dir, pattern
 
@@ -409,18 +410,23 @@ EOM
 
   def extract_tar_gz(io, destination_dir, pattern = "*") # :nodoc:
     directories = []
+    symlinks = []
+
     open_tar_gz io do |tar|
       tar.each do |entry|
-        next unless File.fnmatch pattern, entry.full_name, File::FNM_DOTMATCH
+        full_name = entry.full_name
+        next unless File.fnmatch pattern, full_name, File::FNM_DOTMATCH
 
-        destination = install_location entry.full_name, destination_dir
+        destination = install_location full_name, destination_dir
 
         if entry.symlink?
           link_target = entry.header.linkname
           real_destination = link_target.start_with?("/") ? link_target : File.expand_path(link_target, File.dirname(destination))
 
-          raise Gem::Package::SymlinkError.new(entry.full_name, real_destination, destination_dir) unless
-            normalize_path(real_destination).start_with? normalize_path(destination_dir + '/')
+          raise Gem::Package::SymlinkError.new(full_name, real_destination, destination_dir) unless
+            normalize_path(real_destination).start_with? normalize_path(destination_dir + "/")
+
+          symlinks << [full_name, link_target, destination, real_destination]
         end
 
         FileUtils.rm_rf destination
@@ -439,24 +445,35 @@ EOM
           directories << mkdir
         end
 
-        File.open destination, 'wb' do |out|
-          out.write entry.read
+        if entry.file?
+          File.open(destination, "wb") {|out| out.write entry.read }
           FileUtils.chmod file_mode(entry.header.mode), destination
-        end if entry.file?
-
-        File.symlink(entry.header.linkname, destination) if entry.symlink?
+        end
 
         verbose destination
       end
     end
 
+    symlinks.each do |name, target, destination, real_destination|
+      if File.exist?(real_destination)
+        File.symlink(target, destination)
+      else
+        alert_warning "#{@spec.full_name} ships with a dangling symlink named #{name} pointing to missing #{target} file. Ignoring"
+      end
+    end
+
     if dir_mode
       File.chmod(dir_mode, *directories)
     end
   end
 
   def file_mode(mode) # :nodoc:
-    ((mode & 0111).zero? ? data_mode : prog_mode) || mode
+    ((mode & 0111).zero? ? data_mode : prog_mode) ||
+      # If we're not using one of the default modes, then we're going to fall
+      # back to the mode from the tarball. In this case we need to mask it down
+      # to fit into 2^16 bits (the maximum value for a mode in CRuby since it
+      # gets put into an unsigned short).
+      (mode & ((1 << 16) - 1))
   end
 
   ##
@@ -481,13 +498,13 @@ EOM
 
   def install_location(filename, destination_dir) # :nodoc:
     raise Gem::Package::PathError.new(filename, destination_dir) if
-      filename.start_with? '/'
+      filename.start_with? "/"
 
     destination_dir = File.realpath(destination_dir)
     destination = File.expand_path(filename, destination_dir)
 
     raise Gem::Package::PathError.new(destination, destination_dir) unless
-      normalize_path(destination).start_with? normalize_path(destination_dir + '/')
+      normalize_path(destination).start_with? normalize_path(destination_dir + "/")
 
     destination.tap(&Gem::UNTAINT)
     destination
@@ -506,9 +523,9 @@ EOM
 
   def load_spec(entry) # :nodoc:
     case entry.full_name
-    when 'metadata' then
+    when "metadata" then
       @spec = Gem::Specification.from_yaml entry.read
-    when 'metadata.gz' then
+    when "metadata.gz" then
       Zlib::GzipReader.wrap(entry, external_encoding: Encoding::UTF_8) do |gzio|
         @spec = Gem::Specification.from_yaml gzio.read
       end
@@ -532,7 +549,7 @@ EOM
   def read_checksums(gem)
     Gem.load_yaml
 
-    @checksums = gem.seek 'checksums.yaml.gz' do |entry|
+    @checksums = gem.seek "checksums.yaml.gz" do |entry|
       Zlib::GzipReader.wrap entry do |gz_io|
         Gem::SafeYAML.safe_load gz_io.read
       end
@@ -544,7 +561,7 @@ EOM
   # certificate and key are not present only checksum generation is set up.
 
   def setup_signer(signer_options: {})
-    passphrase = ENV['GEM_PRIVATE_KEY_PASSPHRASE']
+    passphrase = ENV["GEM_PRIVATE_KEY_PASSPHRASE"]
     if @spec.signing_key
       @signer =
         Gem::Security::Signer.new(
@@ -600,8 +617,7 @@ EOM
 
     verify_checksums @digests, @checksums
 
-    @security_policy.verify_signatures @spec, @digests, @signatures if
-      @security_policy
+    @security_policy&.verify_signatures @spec, @digests, @signatures
 
     true
   rescue Gem::Security::Exception
@@ -651,7 +667,7 @@ EOM
     case file_name
     when "metadata", "metadata.gz" then
       load_spec entry
-    when 'data.tar.gz' then
+    when "data.tar.gz" then
       verify_gz entry
     end
   rescue
@@ -668,15 +684,15 @@ EOM
     end
 
     unless @spec
-      raise Gem::Package::FormatError.new 'package metadata is missing', @gem
+      raise Gem::Package::FormatError.new "package metadata is missing", @gem
     end
 
-    unless @files.include? 'data.tar.gz'
+    unless @files.include? "data.tar.gz"
       raise Gem::Package::FormatError.new \
-              'package content (data.tar.gz) is missing', @gem
+              "package content (data.tar.gz) is missing", @gem
     end
 
-    if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
+    if (duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first)) && duplicates.any?
       raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
     end
   end
@@ -693,12 +709,12 @@ EOM
   end
 end
 
-require_relative 'package/digest_io'
-require_relative 'package/source'
-require_relative 'package/file_source'
-require_relative 'package/io_source'
-require_relative 'package/old'
-require_relative 'package/tar_header'
-require_relative 'package/tar_reader'
-require_relative 'package/tar_reader/entry'
-require_relative 'package/tar_writer'
+require_relative "package/digest_io"
+require_relative "package/source"
+require_relative "package/file_source"
+require_relative "package/io_source"
+require_relative "package/old"
+require_relative "package/tar_header"
+require_relative "package/tar_reader"
+require_relative "package/tar_reader/entry"
+require_relative "package/tar_writer"

data/lib/rubygems/package_task.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Copyright (c) 2003, 2004 Jim Weirich, 2009 Eric Hodel
 #
 # Permission is hereby granted, free of charge, to any person obtaining
@@ -20,9 +21,9 @@
 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-require_relative '../rubygems'
-require_relative 'package'
-require 'rake/packagetask'
+require_relative "../rubygems"
+require_relative "package"
+require "rake/packagetask"
 
 ##
 # Create a package based upon a Gem::Specification.  Gem packages, as well as
@@ -113,7 +114,7 @@ class Gem::PackageTask < Rake::PackageTask
           Gem::Package.build gem_spec
 
           verbose trace do
-            mv gem_file, '..'
+            mv gem_file, ".."
           end
         end
       end

data/lib/rubygems/path_support.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 #
 # Gem::PathSupport facilitates the GEM_HOME and GEM_PATH environment settings

data/lib/rubygems/platform.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "deprecate"
 
 ##
@@ -12,7 +13,7 @@ class Gem::Platform
   attr_accessor :cpu, :os, :version
 
   def self.local
-    arch = RbConfig::CONFIG['arch']
+    arch = RbConfig::CONFIG["arch"]
     arch = "#{arch}_60" if arch =~ /mswin(?:32|64)$/
     @local ||= new(arch)
   end
@@ -22,10 +23,11 @@ class Gem::Platform
   end
 
   def self.match_platforms?(platform, platforms)
+    platform = Gem::Platform.new(platform) unless platform.is_a?(Gem::Platform)
     platforms.any? do |local_platform|
-      platform.nil? or
-        local_platform == platform or
-        (local_platform != Gem::Platform::RUBY and local_platform =~ platform)
+      platform.nil? ||
+        local_platform == platform ||
+        (local_platform != Gem::Platform::RUBY && platform =~ local_platform)
     end
   end
   private_class_method :match_platforms?
@@ -56,7 +58,7 @@ class Gem::Platform
     case arch
     when Gem::Platform::CURRENT then
       Gem::Platform.local
-    when Gem::Platform::RUBY, nil, '' then
+    when Gem::Platform::RUBY, nil, "" then
       Gem::Platform::RUBY
     else
       super
@@ -68,9 +70,9 @@ class Gem::Platform
     when Array then
       @cpu, @os, @version = arch
     when String then
-      arch = arch.split '-'
+      arch = arch.split "-"
 
-      if arch.length > 2 and arch.last !~ /\d/ # reassemble x86-linux-gnu
+      if arch.length > 2 && arch.last !~ /\d+(\.\d+)?$/ # reassemble x86-linux-{libc}
         extra = arch.pop
         arch.last << "-#{extra}"
       end
@@ -78,11 +80,11 @@ class Gem::Platform
       cpu = arch.shift
 
       @cpu = case cpu
-      when /i\d86/ then 'x86'
+      when /i\d86/ then "x86"
       else cpu
       end
 
-      if arch.length == 2 and arch.last =~ /^\d+(\.\d+)?$/ # for command-line
+      if arch.length == 2 && arch.last =~ /^\d+(\.\d+)?$/ # for command-line
         @os, @version = arch
         return
       end
@@ -91,31 +93,29 @@ class Gem::Platform
       @cpu, os = nil, cpu if os.nil? # legacy jruby
 
       @os, @version = case os
-      when /aix(\d+)?/ then             [ 'aix',       $1  ]
-      when /cygwin/ then                [ 'cygwin',    nil ]
-      when /darwin(\d+)?/ then          [ 'darwin',    $1  ]
-      when /^macruby$/ then             [ 'macruby',   nil ]
-      when /freebsd(\d+)?/ then         [ 'freebsd',   $1  ]
-      when /hpux(\d+)?/ then            [ 'hpux',      $1  ]
-      when /^java$/, /^jruby$/ then     [ 'java',      nil ]
-      when /^java([\d.]*)/ then         [ 'java',      $1  ]
-      when /^dalvik(\d+)?$/ then        [ 'dalvik',    $1  ]
-      when /^dotnet$/ then              [ 'dotnet',    nil ]
-      when /^dotnet([\d.]*)/ then       [ 'dotnet',    $1  ]
-      when /linux-?((?!gnu)\w+)?/ then  [ 'linux',     $1  ]
-      when /mingw32/ then               [ 'mingw32',   nil ]
-      when /mingw-?(\w+)?/ then         [ 'mingw',     $1  ]
+      when /aix(\d+)?/ then             [ "aix",       $1  ]
+      when /cygwin/ then                [ "cygwin",    nil ]
+      when /darwin(\d+)?/ then          [ "darwin",    $1  ]
+      when /^macruby$/ then             [ "macruby",   nil ]
+      when /freebsd(\d+)?/ then         [ "freebsd",   $1  ]
+      when /^java$/, /^jruby$/ then     [ "java",      nil ]
+      when /^java([\d.]*)/ then         [ "java",      $1  ]
+      when /^dalvik(\d+)?$/ then        [ "dalvik",    $1  ]
+      when /^dotnet$/ then              [ "dotnet",    nil ]
+      when /^dotnet([\d.]*)/ then       [ "dotnet",    $1  ]
+      when /linux-?(\w+)?/ then         [ "linux",     $1  ]
+      when /mingw32/ then               [ "mingw32",   nil ]
+      when /mingw-?(\w+)?/ then         [ "mingw",     $1  ]
       when /(mswin\d+)(\_(\d+))?/ then
         os, version = $1, $3
-        @cpu = 'x86' if @cpu.nil? and os =~ /32$/
+        @cpu = "x86" if @cpu.nil? && os =~ /32$/
         [os, version]
-      when /netbsdelf/ then             [ 'netbsdelf', nil ]
-      when /openbsd(\d+\.\d+)?/ then    [ 'openbsd',   $1  ]
-      when /bitrig(\d+\.\d+)?/ then     [ 'bitrig',    $1  ]
-      when /solaris(\d+\.\d+)?/ then    [ 'solaris',   $1  ]
+      when /netbsdelf/ then             [ "netbsdelf", nil ]
+      when /openbsd(\d+\.\d+)?/ then    [ "openbsd",   $1  ]
+      when /solaris(\d+\.\d+)?/ then    [ "solaris",   $1  ]
       # test
       when /^(\w+_platform)(\d+)?/ then [ $1,          $2  ]
-      else                              [ 'unknown',   nil ]
+      else                              [ "unknown",   nil ]
       end
     when Gem::Platform then
       @cpu = arch.cpu
@@ -131,7 +131,7 @@ class Gem::Platform
   end
 
   def to_s
-    to_a.compact.join '-'
+    to_a.compact.join "-"
   end
 
   ##
@@ -139,7 +139,7 @@ class Gem::Platform
   # the same CPU, OS and version.
 
   def ==(other)
-    self.class === other and to_a == other.to_a
+    self.class === other && to_a == other.to_a
   end
 
   alias :eql? :==
@@ -151,27 +151,53 @@ class Gem::Platform
   ##
   # Does +other+ match this platform?  Two platforms match if they have the
   # same CPU, or either has a CPU of 'universal', they have the same OS, and
-  # they have the same version, or either has no version.
+  # they have the same version, or either one has no version
   #
   # Additionally, the platform will match if the local CPU is 'arm' and the
   # other CPU starts with "arm" (for generic ARM family support).
+  #
+  # Of note, this method is not commutative. Indeed the OS 'linux' has a
+  # special case: the version is the libc name, yet while "no version" stands
+  # as a wildcard for a binary gem platform (as for other OSes), for the
+  # runtime platform "no version" stands for 'gnu'. To be able to distinguish
+  # these, the method receiver is the gem platform, while the argument is
+  # the runtime platform.
+  #
+  #--
+  # NOTE: Until it can be removed, changes to this method must also be reflected in `bundler/lib/bundler/rubygems_ext.rb`
 
   def ===(other)
     return nil unless Gem::Platform === other
 
     # universal-mingw32 matches x64-mingw-ucrt
-    return true if (@cpu == 'universal' or other.cpu == 'universal') and
-                   @os.start_with?('mingw') and other.os.start_with?('mingw')
+    return true if (@cpu == "universal" || other.cpu == "universal") &&
+                   @os.start_with?("mingw") && other.os.start_with?("mingw")
 
     # cpu
-    ([nil,'universal'].include?(@cpu) or [nil, 'universal'].include?(other.cpu) or @cpu == other.cpu or
-    (@cpu == 'arm' and other.cpu.start_with?("arm"))) and
+    ([nil,"universal"].include?(@cpu) || [nil, "universal"].include?(other.cpu) || @cpu == other.cpu ||
+    (@cpu == "arm" && other.cpu.start_with?("arm"))) &&
+
+      # os
+      @os == other.os &&
+
+      # version
+      (
+        (@os != "linux" && (@version.nil? || other.version.nil?)) ||
+        (@os == "linux" && (normalized_linux_version == other.normalized_linux_version || ["musl#{@version}", "musleabi#{@version}", "musleabihf#{@version}"].include?(other.version))) ||
+        @version == other.version
+      )
+  end
+
+  #--
+  # NOTE: Until it can be removed, changes to this method must also be reflected in `bundler/lib/bundler/rubygems_ext.rb`
+
+  def normalized_linux_version
+    return nil unless @version
 
-    # os
-    @os == other.os and
+    without_gnu_nor_abi_modifiers = @version.sub(/\Agnu/, "").sub(/eabi(hf)?\Z/, "")
+    return nil if without_gnu_nor_abi_modifiers.empty?
 
-    # version
-    (@version.nil? or other.version.nil? or @version == other.version)
+    without_gnu_nor_abi_modifiers
   end
 
   ##
@@ -184,17 +210,17 @@ class Gem::Platform
     when String then
       # This data is from http://gems.rubyforge.org/gems/yaml on 19 Aug 2007
       other = case other
-      when /^i686-darwin(\d)/     then ['x86',       'darwin',  $1    ]
-      when /^i\d86-linux/         then ['x86',       'linux',   nil   ]
-      when 'java', 'jruby'        then [nil,         'java',    nil   ]
-      when /^dalvik(\d+)?$/       then [nil,         'dalvik',  $1    ]
-      when /dotnet(\-(\d+\.\d+))?/ then ['universal','dotnet',  $2    ]
-      when /mswin32(\_(\d+))?/    then ['x86',       'mswin32', $2    ]
-      when /mswin64(\_(\d+))?/    then ['x64',       'mswin64', $2    ]
-      when 'powerpc-darwin'       then ['powerpc',   'darwin',  nil   ]
-      when /powerpc-darwin(\d)/   then ['powerpc',   'darwin',  $1    ]
-      when /sparc-solaris2.8/     then ['sparc',     'solaris', '2.8' ]
-      when /universal-darwin(\d)/ then ['universal', 'darwin',  $1    ]
+      when /^i686-darwin(\d)/     then ["x86",       "darwin",  $1    ]
+      when /^i\d86-linux/         then ["x86",       "linux",   nil   ]
+      when "java", "jruby"        then [nil,         "java",    nil   ]
+      when /^dalvik(\d+)?$/       then [nil,         "dalvik",  $1    ]
+      when /dotnet(\-(\d+\.\d+))?/ then ["universal","dotnet",  $2    ]
+      when /mswin32(\_(\d+))?/    then ["x86",       "mswin32", $2    ]
+      when /mswin64(\_(\d+))?/    then ["x64",       "mswin64", $2    ]
+      when "powerpc-darwin"       then ["powerpc",   "darwin",  nil   ]
+      when /powerpc-darwin(\d)/   then ["powerpc",   "darwin",  $1    ]
+      when /sparc-solaris2.8/     then ["sparc",     "solaris", "2.8" ]
+      when /universal-darwin(\d)/ then ["universal", "darwin",  $1    ]
       else                             other
       end
 
@@ -210,11 +236,11 @@ class Gem::Platform
   # A pure-Ruby gem that may use Gem::Specification#extensions to build
   # binary files.
 
-  RUBY = 'ruby'.freeze
+  RUBY = "ruby"
 
   ##
   # A platform-specific gem that is built for the packaging Ruby's platform.
   # This will be replaced with Gem::Platform::local.
 
-  CURRENT = 'current'.freeze
+  CURRENT = "current"
 end

data/lib/rubygems/psych_tree.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 module Gem
   if defined? ::Psych::Visitors
     class NoAliasYAMLTree < Psych::Visitors::YAMLTree
@@ -7,7 +8,7 @@ module Gem
       end unless respond_to? :create
 
       def visit_String(str)
-        return super unless str == '=' # or whatever you want
+        return super unless str == "=" # or whatever you want
 
         quote = Psych::Nodes::Scalar::SINGLE_QUOTED
         @emitter.scalar str, nil, nil, false, true, quote