rubygems-update 3.3.18 → 3.6.2

data/lib/rubygems/specification_policy.rb

@@ -1,22 +1,25 @@
-require_relative 'user_interaction'
+# frozen_string_literal: true
+
+require_relative "user_interaction"
 
 class Gem::SpecificationPolicy
   include Gem::UserInteraction
 
-  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/.freeze # :nodoc:
+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:
 
-  SPECIAL_CHARACTERS = /\A[#{Regexp.escape('.-_')}]+/.freeze # :nodoc:
+  SPECIAL_CHARACTERS = /\A[#{Regexp.escape(".-_")}]+/ # :nodoc:
 
-  VALID_URI_PATTERN = %r{\Ahttps?:\/\/([^\s:@]+:[^\s:@]*@)?[A-Za-z\d\-]+(\.[A-Za-z\d\-]+)+\.?(:\d{1,5})?([\/?]\S*)?\z}.freeze # :nodoc:
+  VALID_URI_PATTERN = %r{\Ahttps?:\/\/([^\s:@]+:[^\s:@]*@)?[A-Za-z\d\-]+(\.[A-Za-z\d\-]+)+\.?(:\d{1,5})?([\/?]\S*)?\z} # :nodoc:
 
   METADATA_LINK_KEYS = %w[
-    bug_tracker_uri
-    changelog_uri
-    documentation_uri
     homepage_uri
-    mailing_list_uri
+    changelog_uri
     source_code_uri
+    documentation_uri
     wiki_uri
+    mailing_list_uri
+    bug_tracker_uri
+    download_uri
     funding_uri
   ].freeze # :nodoc:
 
@@ -42,6 +45,7 @@ class Gem::SpecificationPolicy
 
   def validate(strict = false)
     validate_required!
+    validate_required_metadata!
 
     validate_optional(strict) if packaging || strict
 
@@ -82,15 +86,17 @@ class Gem::SpecificationPolicy
 
     validate_authors_field
 
-    validate_metadata
-
     validate_licenses_length
 
-    validate_lazy_metadata
-
     validate_duplicate_dependencies
   end
 
+  def validate_required_metadata!
+    validate_metadata
+
+    validate_lazy_metadata
+  end
+
   def validate_optional(strict)
     validate_licenses
 
@@ -100,10 +106,14 @@ class Gem::SpecificationPolicy
 
     validate_dependencies
 
+    validate_required_ruby_version
+
     validate_extensions
 
     validate_removed_attributes
 
+    validate_unique_links
+
     if @warnings > 0
       if strict
         error "specification has warnings"
@@ -113,6 +123,13 @@ class Gem::SpecificationPolicy
     end
   end
 
+  ##
+  # Implementation for Specification#validate_for_resolution
+
+  def validate_for_resolution
+    validate_required!
+  end
+
   ##
   # Implementation for Specification#validate_metadata
 
@@ -120,12 +137,12 @@ class Gem::SpecificationPolicy
     metadata = @specification.metadata
 
     unless Hash === metadata
-      error 'metadata must be a hash'
+      error "metadata must be a hash"
     end
 
     metadata.each do |key, value|
       entry = "metadata['#{key}']"
-      if !key.kind_of?(String)
+      unless key.is_a?(String)
         error "metadata keys must be a String"
       end
 
@@ -133,7 +150,7 @@ class Gem::SpecificationPolicy
         error "metadata key is too large (#{key.size} > 128)"
       end
 
-      if !value.kind_of?(String)
+      unless value.is_a?(String)
         error "#{entry} value must be a String"
       end
 
@@ -141,10 +158,9 @@ class Gem::SpecificationPolicy
         error "#{entry} value is too large (#{value.size} > 1024)"
       end
 
-      if METADATA_LINK_KEYS.include? key
-        if value !~ VALID_URI_PATTERN
-          error "#{entry} has invalid link: #{value.inspect}"
-        end
+      next unless METADATA_LINK_KEYS.include? key
+      unless VALID_URI_PATTERN.match?(value)
+        error "#{entry} has invalid link: #{value.inspect}"
       end
     end
   end
@@ -161,7 +177,7 @@ class Gem::SpecificationPolicy
       if prev = seen[dep.type][dep.name]
         error_messages << <<-MESSAGE
 duplicate dependency on #{dep}, (#{prev.requirement}) use:
-    add_#{dep.type}_dependency '#{dep.name}', '#{dep.requirement}', '#{prev.requirement}'
+    add_#{dep.type}_dependency \"#{dep.name}\", \"#{dep.requirement}\", \"#{prev.requirement}\"
         MESSAGE
       end
 
@@ -173,6 +189,7 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
   end
 
   ##
+  # Checks that the gem does not depend on itself.
   # Checks that dependencies use requirements as we recommend.  Warnings are
   # issued when dependencies are open-ended or overly strict for semantic
   # versioning.
@@ -180,6 +197,10 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
   def validate_dependencies # :nodoc:
     warning_messages = []
     @specification.dependencies.each do |dep|
+      if dep.name == @specification.name # warn on self reference
+        warning_messages << "Self referencing dependency is unnecessary and strongly discouraged."
+      end
+
       prerelease_dep = dep.requirements_list.any? do |req|
         Gem::Requirement.new(req).prerelease?
       end
@@ -188,37 +209,42 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
           prerelease_dep && !@specification.version.prerelease?
 
       open_ended = dep.requirement.requirements.all? do |op, version|
-        not version.prerelease? and (op == '>' or op == '>=')
+        !version.prerelease? && [">", ">="].include?(op)
       end
 
-      if open_ended
-        op, dep_version = dep.requirement.requirements.first
-
-        segments = dep_version.segments
+      next unless open_ended
+      op, dep_version = dep.requirement.requirements.first
 
-        base = segments.first 2
+      segments = dep_version.segments
 
-        recommendation = if (op == '>' || op == '>=') && segments == [0]
-          "  use a bounded requirement, such as '~> x.y'"
-        else
-          bugfix = if op == '>'
-            ", '> #{dep_version}'"
-          elsif op == '>=' and base != segments
-            ", '>= #{dep_version}'"
-          end
+      base = segments.first 2
 
-          "  if #{dep.name} is semantically versioned, use:\n" \
-          "    add_#{dep.type}_dependency '#{dep.name}', '~> #{base.join '.'}'#{bugfix}"
+      recommendation = if [">", ">="].include?(op) && segments == [0]
+        "  use a bounded requirement, such as \"~> x.y\""
+      else
+        bugfix = if op == ">"
+          ", \"> #{dep_version}\""
+        elsif op == ">=" && base != segments
+          ", \">= #{dep_version}\""
         end
 
-        warning_messages << ["open-ended dependency on #{dep} is not recommended", recommendation].join("\n") + "\n"
+        "  if #{dep.name} is semantically versioned, use:\n" \
+        "    add_#{dep.type}_dependency \"#{dep.name}\", \"~> #{base.join "."}\"#{bugfix}"
       end
+
+      warning_messages << ["open-ended dependency on #{dep} is not recommended", recommendation].join("\n") + "\n"
     end
     if warning_messages.any?
       warning_messages.each {|warning_message| warning warning_message }
     end
   end
 
+  def validate_required_ruby_version
+    if @specification.required_ruby_version.requirements == [Gem::Requirement::DefaultRequirement]
+      warning "make sure you specify the oldest ruby version constraint (like \">= 3.0\") that you want your gem to support by setting the `required_ruby_version` gemspec attribute"
+    end
+  end
+
   ##
   # Issues a warning for each file to be packaged which is world-readable.
   #
@@ -229,7 +255,7 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
 
     @specification.files.each do |file|
       next unless File.file?(file)
-      next if File.stat(file).mode & 0444 == 0444
+      next if File.stat(file).mode & 0o444 == 0o444
       warning "#{file} is not world-readable"
     end
 
@@ -248,7 +274,7 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
       @specification.instance_variable_get("@#{attrname}").nil?
     end
     return if nil_attributes.empty?
-    error "#{nil_attributes.join ', '} must not be nil"
+    error "#{nil_attributes.join ", "} must not be nil"
   end
 
   def validate_rubygems_version
@@ -258,7 +284,9 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
 
     return if rubygems_version == Gem::VERSION
 
-    error "expected RubyGems version #{Gem::VERSION}, was #{rubygems_version}"
+    warning "expected RubyGems version #{Gem::VERSION}, was #{rubygems_version}"
+
+    @specification.rubygems_version = Gem::VERSION
   end
 
   def validate_required_attributes
@@ -274,19 +302,19 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
 
     if !name.is_a?(String)
       error "invalid value for attribute name: \"#{name.inspect}\" must be a string"
-    elsif name !~ /[a-zA-Z]/
+    elsif !/[a-zA-Z]/.match?(name)
       error "invalid value for attribute name: #{name.dump} must include at least one letter"
-    elsif name !~ VALID_NAME_PATTERN
+    elsif !VALID_NAME_PATTERN.match?(name)
       error "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"
-    elsif name =~ SPECIAL_CHARACTERS
-      error "invalid value for attribute name: #{name.dump} can not begin with a period, dash, or underscore"
+    elsif SPECIAL_CHARACTERS.match?(name)
+      error "invalid value for attribute name: #{name.dump} cannot begin with a period, dash, or underscore"
     end
   end
 
   def validate_require_paths
     return unless @specification.raw_require_paths.empty?
 
-    error 'specification must have at least one require_path'
+    error "specification must have at least one require_path"
   end
 
   def validate_non_files
@@ -310,7 +338,7 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
   def validate_specification_version
     return if @specification.specification_version.is_a?(Integer)
 
-    error 'specification_version must be an Integer (did you mean version?)'
+    error "specification_version must be an Integer (did you mean version?)"
   end
 
   def validate_platform
@@ -332,13 +360,13 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
   def validate_array_attribute(field)
     val = @specification.send(field)
     klass = case field
-    when :dependencies then
-      Gem::Dependency
-    else
-      String
+            when :dependencies then
+              Gem::Dependency
+            else
+              String
     end
 
-    unless Array === val and val.all? {|x| x.kind_of?(klass) }
+    unless Array === val && val.all? {|x| x.is_a?(klass) || (field == :licenses && x.nil?) }
       error "#{field} must be an Array of #{klass}"
     end
   end
@@ -353,6 +381,8 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
     licenses = @specification.licenses
 
     licenses.each do |license|
+      next if license.nil?
+
       if license.length > 64
         error "each license must be 64 characters or less"
       end
@@ -363,26 +393,38 @@ duplicate dependency on #{dep}, (#{prev.requirement}) use:
     licenses = @specification.licenses
 
     licenses.each do |license|
-      if !Gem::Licenses.match?(license)
-        suggestions = Gem::Licenses.suggestions(license)
-        message = <<-WARNING
-license value '#{license}' is invalid.  Use a license identifier from
-http://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license.
-        WARNING
-        message += "Did you mean #{suggestions.map {|s| "'#{s}'" }.join(', ')}?\n" unless suggestions.nil?
-        warning(message)
+      next if Gem::Licenses.match?(license) || license.nil?
+      license_id_deprecated = Gem::Licenses.deprecated_license_id?(license)
+      exception_id_deprecated = Gem::Licenses.deprecated_exception_id?(license)
+      suggestions = Gem::Licenses.suggestions(license)
+
+      if license_id_deprecated
+        main_message = "License identifier '#{license}' is deprecated"
+      elsif exception_id_deprecated
+        main_message = "Exception identifier at '#{license}' is deprecated"
+      else
+        main_message = "License identifier '#{license}' is invalid"
       end
+
+      message = <<-WARNING
+#{main_message}. Use an identifier from
+https://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license,
+or set it to nil if you don't want to specify a license.
+      WARNING
+      message += "Did you mean #{suggestions.map {|s| "'#{s}'" }.join(", ")}?\n" unless suggestions.nil?
+      warning(message)
     end
 
     warning <<-WARNING if licenses.empty?
-licenses is empty, but is recommended.  Use a license identifier from
-http://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license.
+licenses is empty, but is recommended. Use an license identifier from
+https://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard license,
+or set it to nil if you don't want to specify a license.
     WARNING
   end
 
-  LAZY = '"FIxxxXME" or "TOxxxDO"'.gsub(/xxx/, '')
-  LAZY_PATTERN = /\AFI XME|\ATO DO/x.freeze
-  HOMEPAGE_URI_PATTERN = /\A[a-z][a-z\d+.-]*:/i.freeze
+  LAZY = '"FIxxxXME" or "TOxxxDO"'.gsub(/xxx/, "")
+  LAZY_PATTERN = /\AFI XME|\ATO DO/x
+  HOMEPAGE_URI_PATTERN = /\A[a-z][a-z\d+.-]*:/i
 
   def validate_lazy_metadata
     unless @specification.authors.grep(LAZY_PATTERN).empty?
@@ -393,25 +435,25 @@ http://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard li
       error "#{LAZY} is not an email"
     end
 
-    if @specification.description =~ LAZY_PATTERN
+    if LAZY_PATTERN.match?(@specification.description)
       error "#{LAZY} is not a description"
     end
 
-    if @specification.summary =~ LAZY_PATTERN
+    if LAZY_PATTERN.match?(@specification.summary)
       error "#{LAZY} is not a summary"
     end
 
     homepage = @specification.homepage
 
     # Make sure a homepage is valid HTTP/HTTPS URI
-    if homepage and not homepage.empty?
-      require 'uri'
+    if homepage && !homepage.empty?
+      require_relative "vendor/uri/lib/uri"
       begin
-        homepage_uri = URI.parse(homepage)
-        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+        homepage_uri = Gem::URI.parse(homepage)
+        unless [Gem::URI::HTTP, Gem::URI::HTTPS].member? homepage_uri.class
           error "\"#{homepage}\" is not a valid HTTP URI"
         end
-      rescue URI::InvalidURIError
+      rescue Gem::URI::InvalidURIError
         error "\"#{homepage}\" is not a valid HTTP URI"
       end
     end
@@ -445,7 +487,7 @@ http://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard li
 
   def validate_shebang_line_in(executable)
     executable_path = File.join(@specification.bindir, executable)
-    return if File.read(executable_path, 2) == '#!'
+    return if File.read(executable_path, 2) == "#!"
 
     warning "#{executable_path} is missing #! line"
   end
@@ -457,17 +499,47 @@ http://spdx.org/licenses or '#{Gem::Licenses::NONSTANDARD}' for a nonstandard li
   end
 
   def validate_extensions # :nodoc:
-    require_relative 'ext'
+    require_relative "ext"
     builder = Gem::Ext::Builder.new(@specification)
 
+    validate_rake_extensions(builder)
+    validate_rust_extensions(builder)
+  end
+
+  def validate_rust_extensions(builder) # :nodoc:
+    rust_extension = @specification.extensions.any? {|s| builder.builder_for(s).is_a? Gem::Ext::CargoBuilder }
+    missing_cargo_lock = !@specification.files.any? {|f| f.end_with?("Cargo.lock") }
+
+    error <<-ERROR if rust_extension && missing_cargo_lock
+You have specified rust based extension, but Cargo.lock is not part of the gem files. Please run `cargo generate-lockfile` or any other command to generate Cargo.lock and ensure it is added to your gem files section in gemspec.
+    ERROR
+  end
+
+  def validate_rake_extensions(builder) # :nodoc:
     rake_extension = @specification.extensions.any? {|s| builder.builder_for(s) == Gem::Ext::RakeBuilder }
-    rake_dependency = @specification.dependencies.any? {|d| d.name == 'rake' }
+    rake_dependency = @specification.dependencies.any? {|d| d.name == "rake" && d.type == :runtime }
 
     warning <<-WARNING if rake_extension && !rake_dependency
-You have specified rake based extension, but rake is not added as dependency. It is recommended to add rake as a dependency in gemspec since there's no guarantee rake will be already installed.
+You have specified rake based extension, but rake is not added as runtime dependency. It is recommended to add rake as a runtime dependency in gemspec since there's no guarantee rake will be already installed.
     WARNING
   end
 
+  def validate_unique_links
+    links = @specification.metadata.slice(*METADATA_LINK_KEYS)
+    grouped = links.group_by {|_key, uri| uri }
+    grouped.each do |uri, copies|
+      next unless copies.length > 1
+      keys = copies.map(&:first).join("\n  ")
+      warning <<~WARNING
+        You have specified the uri:
+          #{uri}
+        for all of the following keys:
+          #{keys}
+        Only the first one will be shown on rubygems.org
+      WARNING
+    end
+  end
+
   def warning(statement) # :nodoc:
     @warnings += 1
 

data/lib/rubygems/specification_record.rb

@@ -0,0 +1,212 @@
+# frozen_string_literal: true
+
+module Gem
+  class SpecificationRecord
+    def self.dirs_from(paths)
+      paths.map do |path|
+        File.join(path, "specifications")
+      end
+    end
+
+    def self.from_path(path)
+      new(dirs_from([path]))
+    end
+
+    def initialize(dirs)
+      @all = nil
+      @stubs = nil
+      @stubs_by_name = {}
+      @spec_with_requirable_file = {}
+      @active_stub_with_requirable_file = {}
+
+      @dirs = dirs
+    end
+
+    # Sentinel object to represent "not found" stubs
+    NOT_FOUND = Struct.new(:to_spec, :this).new
+    private_constant :NOT_FOUND
+
+    ##
+    # Returns the list of all specifications in the record
+
+    def all
+      @all ||= stubs.map(&:to_spec)
+    end
+
+    ##
+    # Returns a Gem::StubSpecification for every specification in the record
+
+    def stubs
+      @stubs ||= begin
+        pattern = "*.gemspec"
+        stubs = stubs_for_pattern(pattern, false)
+
+        @stubs_by_name = stubs.select {|s| Gem::Platform.match_spec? s }.group_by(&:name)
+        stubs
+      end
+    end
+
+    ##
+    # Returns a Gem::StubSpecification for every specification in the record
+    # named +name+ only returns stubs that match Gem.platforms
+
+    def stubs_for(name)
+      if @stubs
+        @stubs_by_name[name] || []
+      else
+        @stubs_by_name[name] ||= stubs_for_pattern("#{name}-*.gemspec").select do |s|
+          s.name == name
+        end
+      end
+    end
+
+    ##
+    # Finds stub specifications matching a pattern in the record, optionally
+    # filtering out specs not matching the current platform
+
+    def stubs_for_pattern(pattern, match_platform = true)
+      installed_stubs = installed_stubs(pattern)
+      installed_stubs.select! {|s| Gem::Platform.match_spec? s } if match_platform
+      stubs = installed_stubs + Gem::Specification.default_stubs(pattern)
+      Gem::Specification._resort!(stubs)
+      stubs
+    end
+
+    ##
+    # Adds +spec+ to the the record, keeping the collection properly sorted.
+
+    def add_spec(spec)
+      return if all.include? spec
+
+      all << spec
+      stubs << spec
+      (@stubs_by_name[spec.name] ||= []) << spec
+
+      Gem::Specification._resort!(@stubs_by_name[spec.name])
+      Gem::Specification._resort!(stubs)
+    end
+
+    ##
+    # Removes +spec+ from the record.
+
+    def remove_spec(spec)
+      all.delete spec.to_spec
+      stubs.delete spec
+      (@stubs_by_name[spec.name] || []).delete spec
+    end
+
+    ##
+    # Sets the specs known by the record to +specs+.
+
+    def all=(specs)
+      @stubs_by_name = specs.group_by(&:name)
+      @all = @stubs = specs
+    end
+
+    ##
+    # Return full names of all specs in the record in sorted order.
+
+    def all_names
+      all.map(&:full_name)
+    end
+
+    include Enumerable
+
+    ##
+    # Enumerate every known spec.
+
+    def each
+      return enum_for(:each) unless block_given?
+
+      all.each do |x|
+        yield x
+      end
+    end
+
+    ##
+    # Returns every spec in the record that matches +name+ and optional +requirements+.
+
+    def find_all_by_name(name, *requirements)
+      req = Gem::Requirement.create(*requirements)
+      env_req = Gem.env_requirement(name)
+
+      matches = stubs_for(name).find_all do |spec|
+        req.satisfied_by?(spec.version) && env_req.satisfied_by?(spec.version)
+      end.map(&:to_spec)
+
+      if name == "bundler" && !req.specific?
+        require_relative "bundler_version_finder"
+        Gem::BundlerVersionFinder.prioritize!(matches)
+      end
+
+      matches
+    end
+
+    ##
+    # Return the best specification in the record that contains the file matching +path+.
+
+    def find_by_path(path)
+      path = path.dup.freeze
+      spec = @spec_with_requirable_file[path] ||= stubs.find do |s|
+        s.contains_requirable_file? path
+      end || NOT_FOUND
+
+      spec.to_spec
+    end
+
+    ##
+    # Return the best specification in the record that contains the file
+    # matching +path+ amongst the specs that are not activated.
+
+    def find_inactive_by_path(path)
+      stub = stubs.find do |s|
+        next if s.activated?
+        s.contains_requirable_file? path
+      end
+      stub&.to_spec
+    end
+
+    ##
+    # Return the best specification in the record that contains the file
+    # matching +path+, among those already activated.
+
+    def find_active_stub_by_path(path)
+      stub = @active_stub_with_requirable_file[path] ||= stubs.find do |s|
+        s.activated? && s.contains_requirable_file?(path)
+      end || NOT_FOUND
+
+      stub.this
+    end
+
+    ##
+    # Return the latest specs in the record, optionally including prerelease
+    # specs if +prerelease+ is true.
+
+    def latest_specs(prerelease)
+      Gem::Specification._latest_specs stubs, prerelease
+    end
+
+    ##
+    # Return the latest installed spec in the record for gem +name+.
+
+    def latest_spec_for(name)
+      latest_specs(true).find {|installed_spec| installed_spec.name == name }
+    end
+
+    private
+
+    def installed_stubs(pattern)
+      map_stubs(pattern) do |path, base_dir, gems_dir|
+        Gem::StubSpecification.gemspec_stub(path, base_dir, gems_dir)
+      end
+    end
+
+    def map_stubs(pattern)
+      @dirs.flat_map do |dir|
+        base_dir = File.dirname dir
+        gems_dir = File.join base_dir, "gems"
+        Gem::Specification.gemspec_stubs_in(dir, pattern) {|path| yield path, base_dir, gems_dir }
+      end
+    end
+  end
+end