rubygems-update 3.4.10 → 3.5.22

data/bundler/lib/bundler/rubygems_ext.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
-require "pathname"
-
-require "rubygems/specification"
+require "rubygems" unless defined?(Gem)
 
 # We can't let `Gem::Source` be autoloaded in the `Gem::Specification#source`
 # redefinition below, so we need to load it upfront. The reason is that if
@@ -15,10 +13,6 @@ require "rubygems/specification"
 # `Gem::Source` from the redefined `Gem::Specification#source`.
 require "rubygems/source"
 
-require_relative "match_metadata"
-require_relative "force_platform"
-require_relative "match_platform"
-
 # Cherry-pick fixes to `Gem.ruby_version` to be useful for modern Bundler
 # versions and ignore patchlevels
 # (https://github.com/rubygems/rubygems/pull/5472,
@@ -29,7 +23,59 @@ unless Gem.ruby_version.to_s == RUBY_VERSION || RUBY_PATCHLEVEL == -1
 end
 
 module Gem
+  # Can be removed once RubyGems 3.5.11 support is dropped
+  unless Gem.respond_to?(:freebsd_platform?)
+    def self.freebsd_platform?
+      RbConfig::CONFIG["host_os"].to_s.include?("bsd")
+    end
+  end
+
+  # Can be removed once RubyGems 3.5.18 support is dropped
+  unless Gem.respond_to?(:open_file_with_lock)
+    class << self
+      remove_method :open_file_with_flock if Gem.respond_to?(:open_file_with_flock)
+
+      def open_file_with_flock(path, &block)
+        # read-write mode is used rather than read-only in order to support NFS
+        mode = IO::RDWR | IO::APPEND | IO::CREAT | IO::BINARY
+        mode |= IO::SHARE_DELETE if IO.const_defined?(:SHARE_DELETE)
+
+        File.open(path, mode) do |io|
+          begin
+            io.flock(File::LOCK_EX)
+          rescue Errno::ENOSYS, Errno::ENOTSUP
+          end
+          yield io
+        end
+      end
+
+      def open_file_with_lock(path, &block)
+        file_lock = "#{path}.lock"
+        open_file_with_flock(file_lock, &block)
+      ensure
+        FileUtils.rm_f file_lock
+      end
+    end
+  end
+
+  require "rubygems/specification"
+
+  # Can be removed once RubyGems 3.5.14 support is dropped
+  VALIDATES_FOR_RESOLUTION = Specification.new.respond_to?(:validate_for_resolution).freeze
+
+  # Can be removed once RubyGems 3.3.15 support is dropped
+  FLATTENS_REQUIRED_PATHS = Specification.new.respond_to?(:flatten_require_paths).freeze
+
   class Specification
+    # Can be removed once RubyGems 3.5.15 support is dropped
+    correct_array_attributes = @@default_value.select {|_k,v| v.is_a?(Array) }.keys
+    unless @@array_attributes == correct_array_attributes
+      @@array_attributes = correct_array_attributes # rubocop:disable Style/ClassVars
+    end
+
+    require_relative "match_metadata"
+    require_relative "match_platform"
+
     include ::Bundler::MatchMetadata
     include ::Bundler::MatchPlatform
 
@@ -46,7 +92,7 @@ module Gem
 
     def full_gem_path
       if source.respond_to?(:root)
-        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s.tap {|x| x.untaint if RUBY_VERSION < "2.7" }
+        File.expand_path(File.dirname(loaded_from), source.root)
       else
         rg_full_gem_path
       end
@@ -66,7 +112,9 @@ module Gem
 
     alias_method :rg_extension_dir, :extension_dir
     def extension_dir
-      @bundler_extension_dir ||= if source.respond_to?(:extension_dir_name)
+      # following instance variable is already used in original method
+      # and that is the reason to prefix it with bundler_ and add rubocop exception
+      @bundler_extension_dir ||= if source.respond_to?(:extension_dir_name) # rubocop:disable Naming/MemoizedInstanceVariableName
         unique_extension_dir = [source.extension_dir_name, File.basename(full_gem_path)].uniq.join("-")
         File.expand_path(File.join(extensions_dir, unique_extension_dir))
       else
@@ -74,7 +122,7 @@ module Gem
       end
     end
 
-    remove_method :gem_dir if instance_methods(false).include?(:gem_dir)
+    remove_method :gem_dir
     def gem_dir
       full_gem_path
     end
@@ -115,17 +163,6 @@ module Gem
       gemfile
     end
 
-    # Backfill missing YAML require when not defined. Fixed since 3.1.0.pre1.
-    module YamlBackfiller
-      def to_yaml(opts = {})
-        Gem.load_yaml unless defined?(::YAML)
-
-        super(opts)
-      end
-    end
-
-    prepend YamlBackfiller
-
     def nondevelopment_dependencies
       dependencies - development_dependencies
     end
@@ -134,6 +171,33 @@ module Gem
       !default_gem? && !File.directory?(full_gem_path)
     end
 
+    unless VALIDATES_FOR_RESOLUTION
+      def validate_for_resolution
+        SpecificationPolicy.new(self).validate_for_resolution
+      end
+    end
+
+    unless FLATTENS_REQUIRED_PATHS
+      def flatten_require_paths
+        return unless raw_require_paths.first.is_a?(Array)
+
+        warn "#{name} #{version} includes a gemspec with `require_paths` set to an array of arrays. Newer versions of this gem might've already fixed this"
+        raw_require_paths.flatten!
+      end
+
+      class << self
+        module RequirePathFlattener
+          def from_yaml(input)
+            spec = super(input)
+            spec.flatten_require_paths
+            spec
+          end
+        end
+
+        prepend RequirePathFlattener
+      end
+    end
+
     private
 
     def dependencies_to_gemfile(dependencies, group = nil)
@@ -153,29 +217,47 @@ module Gem
     end
   end
 
+  unless VALIDATES_FOR_RESOLUTION
+    class SpecificationPolicy
+      def validate_for_resolution
+        validate_required!
+      end
+    end
+  end
+
+  module BetterPermissionError
+    def data
+      super
+    rescue Errno::EACCES
+      raise Bundler::PermissionError.new(loaded_from, :read)
+    end
+  end
+
+  require "rubygems/stub_specification"
+
+  class StubSpecification
+    prepend BetterPermissionError
+  end
+
   class Dependency
+    require_relative "force_platform"
+
     include ::Bundler::ForcePlatform
 
+    attr_reader :force_ruby_platform
+
     attr_accessor :source, :groups
 
     alias_method :eql?, :==
 
-    def force_ruby_platform
-      return @force_ruby_platform if defined?(@force_ruby_platform) && !@force_ruby_platform.nil?
-
-      @force_ruby_platform = default_force_ruby_platform
-    end
-
-    def encode_with(coder)
-      to_yaml_properties.each do |ivar|
-        coder[ivar.to_s.sub(/^@/, "")] = instance_variable_get(ivar)
+    unless method_defined?(:encode_with, false)
+      def encode_with(coder)
+        [:@name, :@requirement, :@type, :@prerelease, :@version_requirements].each do |ivar|
+          coder[ivar.to_s.sub(/^@/, "")] = instance_variable_get(ivar)
+        end
       end
     end
 
-    def to_yaml_properties
-      instance_variables.reject {|p| ["@source", "@groups"].include?(p.to_s) }
-    end
-
     def to_lock
       out = String.new("  #{name}")
       unless requirement.none?
@@ -184,39 +266,19 @@ module Gem
       end
       out
     end
-  end
-
-  # comparison is done order independently since rubygems 3.2.0.rc.2
-  unless Gem::Requirement.new("> 1", "< 2") == Gem::Requirement.new("< 2", "> 1")
-    class Requirement
-      module OrderIndependentComparison
-        def ==(other)
-          return unless Gem::Requirement === other
 
-          if _requirements_sorted? && other._requirements_sorted?
-            super
-          else
-            _with_sorted_requirements == other._with_sorted_requirements
-          end
-        end
-
-        protected
-
-        def _requirements_sorted?
-          return @_are_requirements_sorted if defined?(@_are_requirements_sorted)
-          strings = as_list
-          @_are_requirements_sorted = strings == strings.sort
-        end
-
-        def _with_sorted_requirements
-          @_with_sorted_requirements ||= _requirements_sorted? ? self : self.class.new(as_list.sort)
+    if Gem.rubygems_version < Gem::Version.new("3.5.22")
+      module FilterIgnoredSpecs
+        def matching_specs(platform_only = false)
+          super.reject(&:ignored?)
         end
       end
 
-      prepend OrderIndependentComparison
+      prepend FilterIgnoredSpecs
     end
   end
 
+  # Requirements using lambda operator differentiate trailing zeros since rubygems 3.2.6
   if Gem::Requirement.new("~> 2.0").hash == Gem::Requirement.new("~> 2.0.0").hash
     class Requirement
       module CorrectHashForLambdaOperator
@@ -258,7 +320,7 @@ module Gem
 
         # cpu
         ([nil,"universal"].include?(@cpu) || [nil, "universal"].include?(other.cpu) || @cpu == other.cpu ||
-        (@cpu == "arm" && other.cpu.start_with?("arm"))) &&
+        (@cpu == "arm" && other.cpu.start_with?("armv"))) &&
 
           # os
           @os == other.os &&
@@ -318,7 +380,7 @@ module Gem
   end
 
   # On universal Rubies, resolve the "universal" arch to the real CPU arch, without changing the extension directory.
-  class Specification
+  class BasicSpecification
     if /^universal\.(?<arch>.*?)-/ =~ (CROSS_COMPILING || RUBY_PLATFORM)
       local_platform = Platform.local
       if local_platform.cpu == "universal"
@@ -331,23 +393,63 @@ module Gem
         end
 
         def extensions_dir
-          Gem.default_ext_dir_for(base_dir) ||
-            File.join(base_dir, "extensions", ORIGINAL_LOCAL_PLATFORM,
-                      Gem.extension_api_version)
+          @extensions_dir ||=
+            Gem.default_ext_dir_for(base_dir) || File.join(base_dir, "extensions", ORIGINAL_LOCAL_PLATFORM, Gem.extension_api_version)
         end
       end
     end
+
+    # Can be removed once RubyGems 3.5.22 support is dropped
+    unless new.respond_to?(:ignored?)
+      def ignored?
+        return @ignored unless @ignored.nil?
+
+        @ignored = missing_extensions?
+      end
+    end
   end
 
-  require "rubygems/util"
+  require "rubygems/name_tuple"
 
-  Util.singleton_class.module_eval do
-    if Util.singleton_methods.include?(:glob_files_in_dir) # since 3.0.0.beta.2
-      remove_method :glob_files_in_dir
+  class NameTuple
+    # Versions of RubyGems before about 3.5.0 don't to_s the platform.
+    unless Gem::NameTuple.new("a", Gem::Version.new("1"), Gem::Platform.new("x86_64-linux")).platform.is_a?(String)
+      alias_method :initialize_with_platform, :initialize
+
+      def initialize(name, version, platform=Gem::Platform::RUBY)
+        if Gem::Platform === platform
+          initialize_with_platform(name, version, platform.to_s)
+        else
+          initialize_with_platform(name, version, platform)
+        end
+      end
     end
 
-    def glob_files_in_dir(glob, base_path)
-      Dir.glob(glob, :base => base_path).map! {|f| File.expand_path(f, base_path) }
+    def lock_name
+      if platform == Gem::Platform::RUBY
+        "#{name} (#{version})"
+      else
+        "#{name} (#{version}-#{platform})"
+      end
+    end
+  end
+
+  unless Gem.rubygems_version >= Gem::Version.new("3.5.19")
+    class Resolver::ActivationRequest
+      remove_method :installed?
+
+      def installed?
+        case @spec
+        when Gem::Resolver::VendorSpecification then
+          true
+        else
+          this_spec = full_spec
+
+          Gem::Specification.any? do |s|
+            s == this_spec && s.base_dir == this_spec.base_dir
+          end
+        end
+      end
     end
   end
 end

data/bundler/lib/bundler/rubygems_gem_installer.rb

@@ -20,7 +20,7 @@ module Bundler
       strict_rm_rf spec.extension_dir
 
       SharedHelpers.filesystem_access(gem_dir, :create) do
-        FileUtils.mkdir_p gem_dir, :mode => 0o755
+        FileUtils.mkdir_p gem_dir, mode: 0o755
       end
 
       extract_files
@@ -29,7 +29,10 @@ module Bundler
       write_build_info_file
       run_post_build_hooks
 
-      generate_bin
+      SharedHelpers.filesystem_access(bin_dir, :write) do
+        generate_bin
+      end
+
       generate_plugins
 
       write_spec
@@ -45,6 +48,24 @@ module Bundler
       spec
     end
 
+    if Bundler.rubygems.provides?("< 3.5")
+      def pre_install_checks
+        super
+      rescue Gem::FilePermissionError
+        # Ignore permission checks in RubyGems. Instead, go on, and try to write
+        # for real. We properly handle permission errors when they happen.
+        nil
+      end
+    end
+
+    def ensure_writable_dir(dir)
+      super
+    rescue Gem::FilePermissionError
+      # Ignore permission checks in RubyGems. Instead, go on, and try to write
+      # for real. We properly handle permission errors when they happen.
+      nil
+    end
+
     def generate_plugins
       return unless Gem::Installer.instance_methods(false).include?(:generate_plugins)
 
@@ -60,8 +81,24 @@ module Bundler
       end
     end
 
-    def pre_install_checks
-      super && validate_bundler_checksum(options[:bundler_expected_checksum])
+    if Bundler.rubygems.provides?("< 3.5.19")
+      def generate_bin_script(filename, bindir)
+        bin_script_path = File.join bindir, formatted_program_filename(filename)
+
+        Gem.open_file_with_lock(bin_script_path) do
+          require "fileutils"
+          FileUtils.rm_f bin_script_path # prior install may have been --no-wrappers
+
+          File.open(bin_script_path, "wb", 0o755) do |file|
+            file.write app_script_text(filename)
+            file.chmod(options[:prog_mode] || 0o755)
+          end
+        end
+
+        verbose bin_script_path
+
+        generate_windows_script filename, bindir
+      end
     end
 
     def build_extensions
@@ -98,6 +135,10 @@ module Bundler
       end
     end
 
+    def gem_checksum
+      Checksum.from_gem_package(@package)
+    end
+
     private
 
     def prepare_extension_build(extension_dir)
@@ -108,64 +149,22 @@ module Bundler
     end
 
     def strict_rm_rf(dir)
-      Bundler.rm_rf dir
-    rescue StandardError => e
-      raise unless File.exist?(dir)
-
-      raise DirectoryRemovalError.new(e, "Could not delete previous installation of `#{dir}`")
-    end
+      return unless File.exist?(dir)
+      return if Dir.empty?(dir)
 
-    def validate_bundler_checksum(checksum)
-      return true if Bundler.settings[:disable_checksum_validation]
-      return true unless checksum
-      return true unless source = @package.instance_variable_get(:@gem)
-      return true unless source.respond_to?(:with_read_io)
-      digest = source.with_read_io do |io|
-        digest = SharedHelpers.digest(:SHA256).new
-        digest << io.read(16_384) until io.eof?
-        io.rewind
-        send(checksum_type(checksum), digest)
-      end
-      unless digest == checksum
-        raise SecurityError, <<-MESSAGE
-          Bundler cannot continue installing #{spec.name} (#{spec.version}).
-          The checksum for the downloaded `#{spec.full_name}.gem` does not match \
-          the checksum given by the server. This means the contents of the downloaded \
-          gem is different from what was uploaded to the server, and could be a potential security issue.
-
-          To resolve this issue:
-          1. delete the downloaded gem located at: `#{spec.gem_dir}/#{spec.full_name}.gem`
-          2. run `bundle install`
-
-          If you wish to continue installing the downloaded gem, and are certain it does not pose a \
-          security issue despite the mismatching checksum, do the following:
-          1. run `bundle config set --local disable_checksum_validation true` to turn off checksum verification
-          2. run `bundle install`
-
-          (More info: The expected SHA256 checksum was #{checksum.inspect}, but the \
-          checksum for the downloaded gem was #{digest.inspect}.)
-          MESSAGE
-      end
-      true
-    end
+      parent = File.dirname(dir)
+      parent_st = File.stat(parent)
 
-    def checksum_type(checksum)
-      case checksum.length
-      when 64 then :hexdigest!
-      when 44 then :base64digest!
-      else raise InstallError, "The given checksum for #{spec.full_name} (#{checksum.inspect}) is not a valid SHA256 hexdigest nor base64digest"
+      if parent_st.world_writable? && !parent_st.sticky?
+        raise InsecureInstallPathError.new(spec.full_name, dir)
       end
-    end
 
-    def hexdigest!(digest)
-      digest.hexdigest!
-    end
+      begin
+        FileUtils.remove_entry_secure(dir)
+      rescue StandardError => e
+        raise unless File.exist?(dir)
 
-    def base64digest!(digest)
-      if digest.respond_to?(:base64digest!)
-        digest.base64digest!
-      else
-        [digest.digest!].pack("m0")
+        raise DirectoryRemovalError.new(e, "Could not delete previous installation of `#{dir}`")
       end
     end
   end