rubygems-update 3.3.18 → 3.6.2

data/doc/rubygems/POLICIES.md

@@ -0,0 +1,204 @@
+## Pull Requests
+
+Contributions to RubyGems are made via GitHub pull requests, which must be
+approved by a project committer other than the author. To approve a PR, a
+maintainer can use GitHubs PR review feature. After that, if the original author
+is happy to merge the PR, she can press the merge button.
+
+## Long-Term Support
+
+RubyGems will support Ruby versions for as long as the Ruby team supports that
+Ruby version. That means that the latest RubyGems release will always support
+the currently-supported Ruby versions, and RubyGems security fixes will be
+released for any RubyGems version that shipped inside a currently-supported
+Ruby version.
+
+### Bugfix Releases
+
+RubyGems generally releases bugfixes from the master branch. We may mix bug
+fixes and new features in the same release. RubyGems does not guarantee it
+will ship bugfix releases for previous minor or major versions.
+
+For example, after RubyGems 2.5 is released, the RubyGems team will not
+provide non-security fixes for RubyGems 2.4, or any earlier versions.
+
+### Security Releases
+
+Security releases will be made for RubyGems minor versions that were included
+in a currently-supported Ruby release.
+
+For example, since RubyGems 2.0 was shipped in Ruby 2.0, RubyGems 2.0 will
+receive security fixes until Ruby 2.0 reaches end-of-life.
+
+### Ruby Version Support
+
+When a Ruby version reaches end-of-life the following minor release of
+RubyGems will drop backwards compatibility with that Ruby version.
+
+For example, since Ruby 2.2 has reached end-of-life, future RubyGems minor
+releases will only support Ruby 2.3 and above. As of this writing RubyGems is
+at version 2.7, so when RubyGems 2.8 is released, it will only support Ruby
+2.3 and later.
+
+## Release Process
+
+### Permissions
+
+You'll need the following environment variables set to release RubyGems &
+Bundler:
+
+* AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY: to be able to push RubyGems zip
+  files to s3 so that they appear at RubyGems [download page].
+
+* GITHUB_RELEASE_PAT: A [GitHub PAT] with repo permissions, in order to push
+  GitHub releases and to use the GitHub API for changelog generation.
+
+[download page]: https://rubygems.org/pages/download
+[GitHub PAT]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token
+
+### Recommendations for security releases
+
+*   Obtain CVE numbers as needed from HackerOne or Red Hat.
+*   Agree on a release date with ruby-core, so patches can be backported to
+    older Ruby versions as needed.
+*   Avoid releasing security updates on Fridays, so platform services don't
+    have to work on weekends.
+*   Continue with the regular release process below.
+
+### Branching
+
+Bundler releases are synchronized with rubygems releases at the moment. That
+means that releases for both share the same stable branch, and they should
+generally happen together.
+
+The current conventional naming for stable branches is `x+1.y`, where `x.y` is
+the version of `bundler` that will be released. This is because `rubygems-x+1.y`
+will be released at the same time.
+
+For example, `rubygems-3.2.0` and `bundler-2.2.0` were both released from the
+`3.2` stable branch.
+
+Once a stable branch has been cut from `master`, changes for that minor release
+series are only made _intentionally_, via patch releases. That is to say,
+changes to `master` by default _won't_ make their way into the current stable
+branch, and development on `master` will be targeting the next minor
+or major release.
+
+There is a `bin/rake prepare_release[<target_rubygems_version>]` rake task
+that helps with creating a release. It takes a single argument, the _exact
+rubygems release_ being made (e.g.  `3.2.3` when releasing bundler `2.2.3`).
+This task checks out the appropriate stable branch (`3.2`, for example), grabs
+all merged but unreleased PRs from both bundler & rubygems from GitHub that are
+compatible with the target release level, and then cherry-picks those changes
+(and only those changes) to a new branch based off the stable branch. Then bumps
+the version in all version files, synchronizes both changelogs to include all
+backported changes and commits that change on top of the cherry-picks.
+
+Note that this task requires all user facing pull requests to be tagged with
+specific labels. See [Merging a PR](/bundler/doc/playbooks/MERGING_A_PR.md) for details.
+
+Also note that when this task cherry-picks, it cherry-picks the merge commits
+using the following command:
+
+```bash
+$ git cherry-pick -m 1 MERGE_COMMIT_SHAS
+```
+
+For example, for PR [#5029](https://github.com/rubygems/bundler/pull/5029), we
+cherry picked commit [dd6aef9](https://github.com/rubygems/bundler/commit/dd6aef97a5f2e7173f406267256a8c319d6134ab),
+not [4fe9291](https://github.com/rubygems/bundler/commit/4fe92919f51e3463f0aad6fa833ab68044311f03)
+using:
+
+```bash
+$ git cherry-pick -m 1 dd6aef9
+```
+
+After running the task, you'll have a release branch ready to be merged into the
+stable branch. You'll want to open a PR from this branch into the stable branch
+and provided CI is green, you can go ahead, merge the PR and run release tasks
+as specified below from the updated stable branch.
+
+### Automatic changelog and backport generation
+
+PR labels and titles are used to automatically generate changelogs for patch and
+minor releases.
+
+When releasing, a changelog generation script goes through all PRs that have
+never made it into a release, and selects only the ones with specific labels as
+detailed in the `.changelog.yml` and `bundler/.changelog.yml` files. Those
+particular PRs get backported to the stable branch and included in the release
+changelog.
+
+If PRs don't have a proper label, they won't be backported to patch releases.
+
+If you want a PR to be backported to a patch level release, but don't want to
+include it in the changelog, you can use the special `rubygems: skip changelog`
+and `bundler: skip changelog` labels. For example, this is useful when
+backporting a PR generates conflicts that are solved by backporting another PR
+with no user visible changes. You can use these special labels to also backport
+the other PR and not get any conflicts.
+
+### Breaking changes
+
+Bundler cares a lot about preserving compatibility. As a result, changes that
+break backwards compatibility should (whenever this is possible) include a feature
+release that is backwards compatible, and issue warnings for all options and
+behaviors that will change.
+
+We only release major breaking changes when incrementing the _major_ version of
+Bundler and RubyGems. However, experience shows that almost every single part of
+Bundler and RubyGems is depended on by someone in ways hard to anticipate. So if
+we were strict about breaking changes we'd need to hold on from making progress
+a lot, or continuously increment the major version, emptying "really major"
+versions from their meaning. Because of this, we also may release "small"
+breaking changes in minor releases. "Small" here means that we expect them to
+affect only very few users in rare cases.
+
+### Steps for patch releases
+
+*   Confirm all PRs that you want backported are properly tagged with `rubygems:
+    <type>` or `bundler: <type>` labels at GitHub.
+*   Run `bin/rake prepare_release[<target_rubygems_version>]`. This will create
+    a PR to the stable branch with the backports included in the release, and
+    proper changelogs and version bumps. It will also create a PR to merge
+    release changelogs into master.
+*   Once CI passes, merge the release PR, switch to the stable branch and pull
+    the PR just merged.
+*   Release `bundler` with `bin/rake bundler:release`.
+*   Release `rubygems` with `bin/rake release`.
+
+### Steps for minor and major releases
+
+*   Confirm all PRs that you want listed in changelogs are properly tagged with
+    `rubygems: <type>` or `bundler: <type>` labels at GitHub.
+*   Run `bin/rake prepare_release[<target_rubygems_version>]`. This will create
+    a new stable branch off the master branch, and create a PR to it with the
+    proper version bumps and changelogs. It will also create a PR to merge
+    release changelogs into master.
+*   Replace the stable branch in the workflows with the new stable branch, and
+    push that change to the release PR.
+*   Replace version numbers with the next ".dev" version, and push that change
+    to the master PR.
+*   Once CI passes, merge the release PR, switch to  the stable branch and pull
+    the PR just merged.
+*   Release `bundler` with `bin/rake bundler:release`.
+*   Release `rubygems` with `bin/rake release`.
+
+## Committer Access
+
+RubyGems committers may lose their commit privileges if they are inactive for
+longer than 12 months. Committer permission may be restored upon request by
+having a pull request merged.
+
+This is designed to improve the maintainability of RubyGems by requiring
+committers to maintain familiarity with RubyGems activity and to improve the
+security of RubyGems by preventing idle committers from having their commit
+permissions compromised or exposed.
+
+## Changing These Policies
+
+These policies were set in order to reduce the burden of maintenance and to keep
+committers current with existing development and policies. RubyGems work is
+primarily volunteer-driven which limits the ability to provide long-term
+support. By joining [Ruby Central](https://rubycentral.org/#/portal/signup) you
+can help extend support for older RubyGems versions.

data/{test/rubygems/fake_certlib/openssl.rb → exe/gem}

@@ -1,8 +1,12 @@
+#!/usr/bin/env ruby
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-raise LoadError, "no such file to load -- openssl"
+require "rubygems/gem_runner"
+
+Gem::GemRunner.new.run ARGV.clone

data/{bin → exe}/update_rubygems

@@ -1,26 +1,28 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems'
+require "rubygems"
 
-if ARGV.include? '-h' or ARGV.include? '--help'
-  $stderr.puts "rubygems_update [options]"
-  $stderr.puts
-  $stderr.puts "This will install the latest version of RubyGems."
-  $stderr.puts
-  $stderr.puts "\t--version=X.Y\tUpdate RubyGems from the X.Y version."
+if ARGV.include?("-h") || ARGV.include?("--help")
+  warn "rubygems_update [options]"
+  warn ""
+  warn "This will install the latest version of RubyGems."
+  warn ""
+  warn "\t--version=X.Y\tUpdate RubyGems from the X.Y version."
   exit
 end
 
 unless ARGV.grep(/--version=([\d\.]*)/).empty?
-  exec Gem.ruby, '-S', $PROGRAM_NAME, "_#{$1}_"
+  exec Gem.ruby, "-S", $PROGRAM_NAME, "_#{$1}_"
 end
 
-update_dir = $LOAD_PATH.find {|dir| dir =~ /rubygems-update/ }
+update_dir = $LOAD_PATH.find {|dir| dir.include?("rubygems-update") }
 
 if update_dir.nil?
   puts "Error: Cannot find RubyGems update path!"
@@ -32,5 +34,5 @@ else
   update_dir = File.dirname(update_dir)
   Dir.chdir update_dir
   ENV["GEM_PREV_VER"] = Gem::VERSION
-  abort unless system(Gem.ruby, 'setup.rb', *ARGV)
+  abort unless system(Gem.ruby, "--disable-gems", "setup.rb", *ARGV)
 end

data/lib/rubygems/available_set.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 class Gem::AvailableSet
   include Enumerable
 
@@ -26,7 +27,7 @@ class Gem::AvailableSet
       s = o.set
     when Array
       s = o.map do |sp,so|
-        if !sp.kind_of?(Gem::Specification) or !so.kind_of?(Gem::Source)
+        if !sp.is_a?(Gem::Specification) || !so.is_a?(Gem::Source)
           raise TypeError, "Array must be in [[spec, source], ...] form"
         end
 
@@ -69,7 +70,7 @@ class Gem::AvailableSet
   end
 
   def all_specs
-    @set.map {|t| t.spec }
+    @set.map(&:spec)
   end
 
   def match_platform!
@@ -104,14 +105,14 @@ class Gem::AvailableSet
 
   def to_request_set(development = :none)
     request_set = Gem::RequestSet.new
-    request_set.development = :all == development
+    request_set.development = development == :all
 
     each_spec do |spec|
       request_set.always_install << spec
 
       request_set.gem spec.name, spec.version
       request_set.import spec.development_dependencies if
-        :shallow == development
+        development == :shallow
     end
 
     request_set
@@ -146,11 +147,11 @@ class Gem::AvailableSet
   end
 
   def remove_installed!(dep)
-    @set.reject! do |t|
+    @set.reject! do |_t|
       # already locally installed
       Gem::Specification.any? do |installed_spec|
-        dep.name == installed_spec.name and
-          dep.requirement.satisfied_by? installed_spec.version
+        dep.name == installed_spec.name &&
+          dep.requirement.satisfied_by?(installed_spec.version)
       end
     end
 

data/lib/rubygems/basic_specification.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # BasicSpecification is an abstract class which implements some common code
 # used by both Specification and StubSpecification.
@@ -47,7 +48,7 @@ class Gem::BasicSpecification
   # directory.
 
   def gem_build_complete_path # :nodoc:
-    File.join extension_dir, 'gem.build_complete'
+    File.join extension_dir, "gem.build_complete"
   end
 
   ##
@@ -70,32 +71,57 @@ class Gem::BasicSpecification
   # Return true if this spec can require +file+.
 
   def contains_requirable_file?(file)
-    if @ignored
-      return false
-    elsif missing_extensions?
-      @ignored = true
-
-      if Gem::Platform::RUBY == platform || Gem::Platform.local === platform
-        warn "Ignoring #{full_name} because its extensions are not built. " +
-          "Try: gem pristine #{name} --version #{version}"
+    if ignored?
+      if platform == Gem::Platform::RUBY || Gem::Platform.local === platform
+        warn "Ignoring #{full_name} because its extensions are not built. " \
+             "Try: gem pristine #{name} --version #{version}"
       end
 
       return false
     end
 
-    have_file? file, Gem.suffixes
+    is_soext = file.end_with?(".so", ".o")
+
+    if is_soext
+      have_file? file.delete_suffix(File.extname(file)), Gem.dynamic_library_suffixes
+    else
+      have_file? file, Gem.suffixes
+    end
+  end
+
+  ##
+  # Return true if this spec should be ignored because it's missing extensions.
+
+  def ignored?
+    return @ignored unless @ignored.nil?
+
+    @ignored = missing_extensions?
   end
 
   def default_gem?
-    loaded_from &&
+    !loaded_from.nil? &&
       File.dirname(loaded_from) == Gem.default_specifications_dir
   end
 
+  ##
+  # Regular gems take precedence over default gems
+
+  def default_gem_priority
+    default_gem? ? 1 : -1
+  end
+
+  ##
+  # Gems higher up in +gem_path+ take precedence
+
+  def base_dir_priority(gem_path)
+    gem_path.index(base_dir) || gem_path.size
+  end
+
   ##
   # Returns full path to the directory where gem's extensions are installed.
 
   def extension_dir
-    @extension_dir ||= File.expand_path(File.join(extensions_dir, full_name)).tap(&Gem::UNTAINT)
+    @extension_dir ||= File.expand_path(File.join(extensions_dir, full_name))
   end
 
   ##
@@ -103,25 +129,22 @@ class Gem::BasicSpecification
 
   def extensions_dir
     Gem.default_ext_dir_for(base_dir) ||
-      File.join(base_dir, 'extensions', Gem::Platform.local.to_s,
+      File.join(base_dir, "extensions", Gem::Platform.local.to_s,
                 Gem.extension_api_version)
   end
 
   def find_full_gem_path # :nodoc:
-    # TODO: also, shouldn't it default to full_name if it hasn't been written?
-    path = File.expand_path File.join(gems_dir, full_name)
-    path.tap(&Gem::UNTAINT)
-    path
+    File.expand_path File.join(gems_dir, full_name)
   end
 
   private :find_full_gem_path
 
   ##
   # The full path to the gem (install path + full name).
+  #
+  # TODO: This is duplicated with #gem_dir. Eventually either of them should be deprecated.
 
   def full_gem_path
-    # TODO: This is a heavily used method by gems, so we'll need
-    # to aleast just alias it to #gem_dir rather than remove it.
     @full_gem_path ||= find_full_gem_path
   end
 
@@ -131,10 +154,23 @@ class Gem::BasicSpecification
   # default Ruby platform.
 
   def full_name
-    if platform == Gem::Platform::RUBY or platform.nil?
-      "#{name}-#{version}".dup.tap(&Gem::UNTAINT)
+    if platform == Gem::Platform::RUBY || platform.nil?
+      "#{name}-#{version}"
     else
-      "#{name}-#{version}-#{platform}".dup.tap(&Gem::UNTAINT)
+      "#{name}-#{version}-#{platform}"
+    end
+  end
+
+  ##
+  # Returns the full name of this Gem (see `Gem::BasicSpecification#full_name`).
+  # Information about where the gem is installed is also included if not
+  # installed in the default GEM_HOME.
+
+  def full_name_with_location
+    if base_dir != Gem.dir
+      "#{full_name} in #{base_dir}"
+    else
+      full_name
     end
   end
 
@@ -144,15 +180,15 @@ class Gem::BasicSpecification
 
   def full_require_paths
     @full_require_paths ||=
-    begin
-      full_paths = raw_require_paths.map do |path|
-        File.join full_gem_path, path.tap(&Gem::UNTAINT)
-      end
+      begin
+        full_paths = raw_require_paths.map do |path|
+          File.join full_gem_path, path
+        end
 
-      full_paths << extension_dir if have_extensions?
+        full_paths << extension_dir if have_extensions?
 
-      full_paths
-    end
+        full_paths
+      end
   end
 
   ##
@@ -160,7 +196,7 @@ class Gem::BasicSpecification
 
   def datadir
     # TODO: drop the extra ", gem_name" which is uselessly redundant
-    File.expand_path(File.join(gems_dir, full_name, "data", name)).tap(&Gem::UNTAINT)
+    File.expand_path(File.join(gems_dir, full_name, "data", name))
   end
 
   ##
@@ -170,27 +206,25 @@ class Gem::BasicSpecification
   def to_fullpath(path)
     if activated?
       @paths_map ||= {}
-      @paths_map[path] ||=
-      begin
-        fullpath = nil
-        suffixes = Gem.suffixes
-        suffixes.find do |suf|
-          full_require_paths.find do |dir|
-            File.file?(fullpath = "#{dir}/#{path}#{suf}")
-          end
-        end ? fullpath : nil
+      Gem.suffixes.each do |suf|
+        full_require_paths.each do |dir|
+          fullpath = "#{dir}/#{path}#{suf}"
+          next unless File.file?(fullpath)
+          @paths_map[path] ||= fullpath
+        end
       end
-    else
-      nil
+      @paths_map[path]
     end
   end
 
   ##
   # Returns the full path to this spec's gem directory.
   # eg: /usr/local/lib/ruby/1.8/gems/mygem-1.0
+  #
+  # TODO: This is duplicated with #full_gem_path. Eventually either of them should be deprecated.
 
   def gem_dir
-    @gem_dir ||= File.expand_path File.join(gems_dir, full_name)
+    @gem_dir ||= find_full_gem_path
   end
 
   ##
@@ -271,9 +305,9 @@ class Gem::BasicSpecification
   # Return all files in this gem that match for +glob+.
 
   def matches_for_glob(glob) # TODO: rename?
-    glob = File.join(self.lib_dirs_glob, glob)
+    glob = File.join(lib_dirs_glob, glob)
 
-    Dir[glob].map {|f| f.tap(&Gem::UNTAINT) } # FIX our tests are broken, run w/ SAFE=1
+    Dir[glob]
   end
 
   ##
@@ -288,17 +322,17 @@ class Gem::BasicSpecification
   # for this spec.
 
   def lib_dirs_glob
-    dirs = if self.raw_require_paths
-      if self.raw_require_paths.size > 1
-        "{#{self.raw_require_paths.join(',')}}"
+    dirs = if raw_require_paths
+      if raw_require_paths.size > 1
+        "{#{raw_require_paths.join(",")}}"
       else
-        self.raw_require_paths.first
+        raw_require_paths.first
       end
     else
       "lib" # default value for require_paths for bundler/inline
     end
 
-    "#{self.full_gem_path}/#{dirs}".dup.tap(&Gem::UNTAINT)
+    "#{full_gem_path}/#{dirs}"
   end
 
   ##
@@ -323,15 +357,19 @@ class Gem::BasicSpecification
     raise NotImplementedError
   end
 
-  def this; self; end
+  def this
+    self
+  end
 
   private
 
-  def have_extensions?; !extensions.empty?; end
+  def have_extensions?
+    !extensions.empty?
+  end
 
   def have_file?(file, suffixes)
     return true if raw_require_paths.any? do |path|
-      base = File.join(gems_dir, full_name, path.tap(&Gem::UNTAINT), file).tap(&Gem::UNTAINT)
+      base = File.join(gems_dir, full_name, path, file)
       suffixes.any? {|suf| File.file? base + suf }
     end
 

data/lib/rubygems/bundler_version_finder.rb

@@ -21,7 +21,7 @@ module Gem::BundlerVersionFinder
   end
 
   def self.bundle_update_bundler_version
-    return unless File.basename($0) == "bundle".freeze
+    return unless ["bundle", "bundler"].include? File.basename($0)
     return unless "update".start_with?(ARGV.first || " ")
     bundler_version = nil
     update_index = nil
@@ -47,12 +47,12 @@ module Gem::BundlerVersionFinder
 
   def self.lockfile_contents
     gemfile = ENV["BUNDLE_GEMFILE"]
-    gemfile = nil if gemfile && gemfile.empty?
+    gemfile = nil if gemfile&.empty?
 
     unless gemfile
       begin
         Gem::Util.traverse_parents(Dir.pwd) do |directory|
-          next unless gemfile = Gem::GEM_DEP_FILES.find {|f| File.file?(f.tap(&Gem::UNTAINT)) }
+          next unless gemfile = Gem::GEM_DEP_FILES.find {|f| File.file?(f) }
 
           gemfile = File.join directory, gemfile
           break
@@ -65,9 +65,9 @@ module Gem::BundlerVersionFinder
     return unless gemfile
 
     lockfile = case gemfile
-    when "gems.rb" then "gems.locked"
-    else "#{gemfile}.lock"
-    end.dup.tap(&Gem::UNTAINT)
+               when "gems.rb" then "gems.locked"
+               else "#{gemfile}.lock"
+    end
 
     return unless File.file?(lockfile)