rubygems-update 3.4.10 → 3.5.22

data/bundler/lib/bundler/source/rubygems.rb

@@ -7,12 +7,10 @@ module Bundler
     class Rubygems < Source
       autoload :Remote, File.expand_path("rubygems/remote", __dir__)
 
-      # Use the API when installing less than X gems
-      API_REQUEST_LIMIT = 500
       # Ask for X gems per API request
       API_REQUEST_SIZE = 50
 
-      attr_reader :remotes, :caches
+      attr_accessor :remotes
 
       def initialize(options = {})
         @options = options
@@ -21,9 +19,15 @@ module Bundler
         @allow_remote = false
         @allow_cached = false
         @allow_local = options["allow_local"] || false
-        @caches = [cache_path, *Bundler.rubygems.gem_cache]
+        @checksum_store = Checksum::Store.new
 
         Array(options["remotes"]).reverse_each {|r| add_remote(r) }
+
+        @lockfile_remotes = @remotes if options["from_lockfile"]
+      end
+
+      def caches
+        @caches ||= [cache_path, *Bundler.rubygems.gem_cache]
       end
 
       def local_only!
@@ -48,10 +52,11 @@ module Bundler
       end
 
       def cached!
+        return unless File.exist?(cache_path)
+
         return if @allow_cached
 
         @specs = nil
-        @allow_local = true
         @allow_cached = true
       end
 
@@ -87,13 +92,14 @@ module Bundler
       end
 
       def self.from_lock(options)
-        new(options)
+        options["remotes"] = Array(options.delete("remote")).reverse
+        new(options.merge("from_lockfile" => true))
       end
 
       def to_lock
         out = String.new("GEM\n")
-        remotes.reverse_each do |remote|
-          out << "  remote: #{suppress_configured_credentials remote}\n"
+        lockfile_remotes.reverse_each do |remote|
+          out << "  remote: #{remote}\n"
         end
         out << "  specs:\n"
       end
@@ -122,29 +128,27 @@ module Bundler
         end
       end
       alias_method :name, :identifier
+      alias_method :to_gemfile, :identifier
 
       def specs
         @specs ||= begin
           # remote_specs usually generates a way larger Index than the other
-          # sources, and large_idx.use small_idx is way faster than
-          # small_idx.use large_idx.
-          idx = @allow_remote ? remote_specs.dup : Index.new
-          idx.use(cached_specs, :override_dupes) if @allow_cached || @allow_remote
-          idx.use(installed_specs, :override_dupes) if @allow_local
-          idx
-        end
-      end
+          # sources, and large_idx.merge! small_idx is way faster than
+          # small_idx.merge! large_idx.
+          index = @allow_remote ? remote_specs.dup : Index.new
+          index.merge!(cached_specs) if @allow_cached
+          index.merge!(installed_specs) if @allow_local
 
-      def install(spec, options = {})
-        force = options[:force]
-        ensure_builtin_gems_cached = options[:ensure_builtin_gems_cached]
+          # complete with default specs, only if not already available in the
+          # index through remote, cached, or installed specs
+          index.use(default_specs) if @allow_local
 
-        if ensure_builtin_gems_cached && spec.default_gem? && !cached_path(spec)
-          cached_built_in_gem(spec) unless spec.remote
-          force = true
+          index
         end
+      end
 
-        if installed?(spec) && !force
+      def install(spec, options = {})
+        if (spec.default_gem? && !cached_built_in_gem(spec, local: options[:local])) || (installed?(spec) && !options[:force])
           print_using_message "Using #{version_message(spec, options[:previous_spec])}"
           return nil # no post-install message
         end
@@ -167,15 +171,14 @@ module Bundler
 
         installer = Bundler::RubyGemsGemInstaller.at(
           path,
-          :security_policy => Bundler.rubygems.security_policies[Bundler.settings["trust-policy"]],
-          :install_dir => install_path.to_s,
-          :bin_dir => bin_path.to_s,
-          :ignore_dependencies => true,
-          :wrappers => true,
-          :env_shebang => true,
-          :build_args => options[:build_args],
-          :bundler_expected_checksum => spec.respond_to?(:checksum) && spec.checksum,
-          :bundler_extension_cache_path => extension_cache_path(spec)
+          security_policy: Bundler.rubygems.security_policies[Bundler.settings["trust-policy"]],
+          install_dir: install_path.to_s,
+          bin_dir: bin_path.to_s,
+          ignore_dependencies: true,
+          wrappers: true,
+          env_shebang: true,
+          build_args: options[:build_args],
+          bundler_extension_cache_path: extension_cache_path(spec)
         )
 
         if spec.remote
@@ -193,6 +196,8 @@ module Bundler
           spec.__swap__(s)
         end
 
+        spec.source.checksum_store.register(spec, installer.gem_checksum)
+
         message = "Installing #{version_message(spec, options[:previous_spec])}"
         message += " with native extensions" if spec.extensions.any?
         Bundler.ui.confirm message
@@ -201,6 +206,7 @@ module Bundler
 
         spec.full_gem_path = installed_spec.full_gem_path
         spec.loaded_from = installed_spec.loaded_from
+        spec.base_dir = installed_spec.base_dir
 
         spec.post_install_message
       end
@@ -216,12 +222,13 @@ module Bundler
         raise InstallError, e.message
       end
 
-      def cached_built_in_gem(spec)
-        cached_path = cached_path(spec)
-        if cached_path.nil?
+      def cached_built_in_gem(spec, local: false)
+        cached_path = cached_gem(spec)
+        if cached_path.nil? && !local
           remote_spec = remote_specs.search(spec).first
           if remote_spec
             cached_path = fetch_gem(remote_spec)
+            spec.remote = remote_spec.remote
           else
             Bundler.ui.warn "#{spec.full_name} is built in to Ruby, and can't be cached because your Gemfile doesn't have any sources that contain it."
           end
@@ -235,7 +242,7 @@ module Bundler
       end
 
       def spec_names
-        if @allow_remote && dependency_api_available?
+        if dependency_api_available?
           remote_specs.spec_names
         else
           []
@@ -243,22 +250,25 @@ module Bundler
       end
 
       def unmet_deps
-        if @allow_remote && dependency_api_available?
+        if dependency_api_available?
           remote_specs.unmet_dependency_names
         else
           []
         end
       end
 
-      def fetchers
-        @fetchers ||= remotes.map do |uri|
+      def remote_fetchers
+        @remote_fetchers ||= remotes.to_h do |uri|
           remote = Source::Rubygems::Remote.new(uri)
-          Bundler::Fetcher.new(remote)
-        end
+          [remote, Bundler::Fetcher.new(remote)]
+        end.freeze
+      end
+
+      def fetchers
+        @fetchers ||= remote_fetchers.values.freeze
       end
 
       def double_check_for(unmet_dependency_names)
-        return unless @allow_remote
         return unless dependency_api_available?
 
         unmet_dependency_names = unmet_dependency_names.call
@@ -273,7 +283,9 @@ module Bundler
 
         Bundler.ui.debug "Double checking for #{unmet_dependency_names || "all specs (due to the size of the request)"} in #{self}"
 
-        fetch_names(api_fetchers, unmet_dependency_names, specs, false)
+        fetch_names(api_fetchers, unmet_dependency_names, remote_specs)
+
+        specs.use remote_specs
       end
 
       def dependency_names_to_double_check
@@ -302,11 +314,7 @@ module Bundler
       end
 
       def credless_remotes
-        if Bundler.settings[:allow_deployment_source_credential_changes]
-          remotes.map(&method(:remove_auth))
-        else
-          remotes.map(&method(:suppress_configured_credentials))
-        end
+        remotes.map(&method(:remove_auth))
       end
 
       def remotes_for_spec(spec)
@@ -317,18 +325,10 @@ module Bundler
       end
 
       def cached_gem(spec)
-        if spec.default_gem?
-          cached_built_in_gem(spec)
-        else
-          cached_path(spec)
-        end
-      end
-
-      def cached_path(spec)
         global_cache_path = download_cache_path(spec)
-        @caches << global_cache_path if global_cache_path
+        caches << global_cache_path if global_cache_path
 
-        possibilities = @caches.map {|p| package_path(p, spec) }
+        possibilities = caches.map {|p| package_path(p, spec) }
         possibilities.find {|p| File.exist?(p) }
       end
 
@@ -339,21 +339,12 @@ module Bundler
       def normalize_uri(uri)
         uri = URINormalizer.normalize_suffix(uri.to_s)
         require_relative "../vendored_uri"
-        uri = Bundler::URI(uri)
+        uri = Gem::URI(uri)
         raise ArgumentError, "The source must be an absolute URI. For example:\n" \
-          "source 'https://rubygems.org'" if !uri.absolute? || (uri.is_a?(Bundler::URI::HTTP) && uri.host.nil?)
+          "source 'https://rubygems.org'" if !uri.absolute? || (uri.is_a?(Gem::URI::HTTP) && uri.host.nil?)
         uri
       end
 
-      def suppress_configured_credentials(remote)
-        remote_nouser = remove_auth(remote)
-        if remote.userinfo && remote.userinfo == Bundler.settings[remote_nouser]
-          remote_nouser
-        else
-          remote
-        end
-      end
-
       def remove_auth(remote)
         if remote.user || remote.password
           remote.dup.tap {|uri| uri.user = uri.password = nil }.to_s
@@ -364,12 +355,18 @@ module Bundler
 
       def installed_specs
         @installed_specs ||= Index.build do |idx|
-          Bundler.rubygems.all_specs.reverse_each do |spec|
+          Bundler.rubygems.installed_specs.reverse_each do |spec|
+            spec.source = self
+            next if spec.ignored?
+            idx << spec
+          end
+        end
+      end
+
+      def default_specs
+        @default_specs ||= Index.build do |idx|
+          Bundler.rubygems.default_specs.each do |spec|
             spec.source = self
-            if Bundler.rubygems.spec_missing_extensions?(spec, false)
-              Bundler.ui.debug "Source #{self} is ignoring #{spec} because it is missing extensions"
-              next
-            end
             idx << spec
           end
         end
@@ -377,10 +374,9 @@ module Bundler
 
       def cached_specs
         @cached_specs ||= begin
-          idx = @allow_local ? installed_specs.dup : Index.new
+          idx = Index.new
 
           Dir["#{cache_path}/*.gem"].each do |gemfile|
-            next if /^bundler\-[\d\.]+?\.gem/.match?(gemfile)
             s ||= Bundler.rubygems.spec_from_gem(gemfile)
             s.source = self
             idx << s
@@ -391,36 +387,30 @@ module Bundler
       end
 
       def api_fetchers
-        fetchers.select {|f| f.use_api && f.fetchers.first.api_fetcher? }
+        fetchers.select(&:api_fetcher?)
       end
 
       def remote_specs
         @remote_specs ||= Index.build do |idx|
           index_fetchers = fetchers - api_fetchers
 
-          # gather lists from non-api sites
-          fetch_names(index_fetchers, nil, idx, false)
-
-          # because ensuring we have all the gems we need involves downloading
-          # the gemspecs of those gems, if the non-api sites contain more than
-          # about 500 gems, we treat all sites as non-api for speed.
-          allow_api = idx.size < API_REQUEST_LIMIT && dependency_names.size < API_REQUEST_LIMIT
-          Bundler.ui.debug "Need to query more than #{API_REQUEST_LIMIT} gems." \
-            " Downloading full index instead..." unless allow_api
-
-          fetch_names(api_fetchers, allow_api && dependency_names, idx, false)
+          if index_fetchers.empty?
+            fetch_names(api_fetchers, dependency_names, idx)
+          else
+            fetch_names(fetchers, nil, idx)
+          end
         end
       end
 
-      def fetch_names(fetchers, dependency_names, index, override_dupes)
+      def fetch_names(fetchers, dependency_names, index)
         fetchers.each do |f|
           if dependency_names
             Bundler.ui.info "Fetching gem metadata from #{URICredentialsFilter.credential_filtered_uri(f.uri)}", Bundler.ui.debug?
-            index.use f.specs_with_retry(dependency_names, self), override_dupes
+            index.use f.specs_with_retry(dependency_names, self)
             Bundler.ui.info "" unless Bundler.ui.debug? # new line now that the dots are over
           else
             Bundler.ui.info "Fetching source index from #{URICredentialsFilter.credential_filtered_uri(f.uri)}"
-            index.use f.specs_with_retry(nil, self), override_dupes
+            index.use f.specs_with_retry(nil, self)
           end
         end
       end
@@ -466,6 +456,10 @@ module Bundler
 
       private
 
+      def lockfile_remotes
+        @lockfile_remotes || credless_remotes
+      end
+
       # Checks if the requested spec exists in the global cache. If it does,
       # we copy it to the download path, and if it does not, we download it.
       #
@@ -481,7 +475,8 @@ module Bundler
       def download_gem(spec, download_cache_path, previous_spec = nil)
         uri = spec.remote.uri
         Bundler.ui.confirm("Fetching #{version_message(spec, previous_spec)}")
-        Bundler.rubygems.download_gem(spec, uri, download_cache_path)
+        gem_remote_fetcher = remote_fetchers.fetch(spec.remote).gem_remote_fetcher
+        Bundler.rubygems.download_gem(spec, uri, download_cache_path, gem_remote_fetcher)
       end
 
       # Returns the global cache path of the calling Rubygems::Source object.

data/bundler/lib/bundler/source.rb

@@ -11,6 +11,8 @@ module Bundler
 
     attr_accessor :dependency_names
 
+    attr_reader :checksum_store
+
     def unmet_deps
       specs.unmet_dependency_names
     end
@@ -100,7 +102,7 @@ module Bundler
     end
 
     def print_using_message(message)
-      if !message.include?("(was ") && Bundler.feature_flag.suppress_install_using_messages?
+      if !message.include?("(was ")
         Bundler.ui.debug message
       else
         Bundler.ui.info message

data/bundler/lib/bundler/source_list.rb

@@ -22,6 +22,7 @@ module Bundler
       @metadata_source        = Source::Metadata.new
 
       @merged_gem_lockfile_sections = false
+      @local_mode = true
     end
 
     def merged_gem_lockfile_sections?
@@ -73,6 +74,10 @@ module Bundler
       global_rubygems_source
     end
 
+    def local_mode?
+      @local_mode
+    end
+
     def default_source
       global_path_source || global_rubygems_source
     end
@@ -101,10 +106,6 @@ module Bundler
       source_list_for(source).find {|s| equivalent_source?(source, s) }
     end
 
-    def get_with_fallback(source)
-      get(source) || default_source
-    end
-
     def lock_sources
       lock_other_sources + lock_rubygems_sources
     end
@@ -144,11 +145,17 @@ module Bundler
       all_sources.each(&:local_only!)
     end
 
+    def local!
+      all_sources.each(&:local!)
+    end
+
     def cached!
       all_sources.each(&:cached!)
     end
 
     def remote!
+      @local_mode = false
+
       all_sources.each(&:remote!)
     end
 
@@ -161,7 +168,11 @@ module Bundler
     end
 
     def map_sources(replacement_sources)
-      rubygems, git, plugin = [@rubygems_sources, @git_sources, @plugin_sources].map do |sources|
+      rubygems = @rubygems_sources.map do |source|
+        replace_rubygems_source(replacement_sources, source) || source
+      end
+
+      git, plugin = [@git_sources, @plugin_sources].map do |sources|
         sources.map do |source|
           replacement_sources.find {|s| s == source } || source
         end
@@ -175,13 +186,22 @@ module Bundler
     end
 
     def global_replacement_source(replacement_sources)
-      replacement_source = replacement_sources.find {|s| s == global_rubygems_source }
+      replacement_source = replace_rubygems_source(replacement_sources, global_rubygems_source)
       return global_rubygems_source unless replacement_source
 
       replacement_source.local!
       replacement_source
     end
 
+    def replace_rubygems_source(replacement_sources, gemfile_source)
+      replacement_source = replacement_sources.find {|s| s == gemfile_source }
+      return unless replacement_source
+
+      # locked sources never include credentials so always prefer remotes from the gemfile
+      replacement_source.remotes = gemfile_source.remotes
+      replacement_source
+    end
+
     def different_sources?(lock_sources, replacement_sources)
       !equivalent_sources?(lock_sources, replacement_sources)
     end

data/bundler/lib/bundler/spec_set.rb

@@ -37,7 +37,7 @@ module Bundler
 
           specs_for_dep.first.dependencies.each do |d|
             next if d.type == :development
-            incomplete = true if d.name != "bundler" && lookup[d.name].empty?
+            incomplete = true if d.name != "bundler" && lookup[d.name].nil?
             deps << [d, dep[1]]
           end
         else
@@ -45,28 +45,58 @@ module Bundler
         end
 
         if incomplete && check
-          @incomplete_specs += lookup[name].any? ? lookup[name] : [LazySpecification.new(name, nil, nil)]
+          @incomplete_specs += lookup[name] || [LazySpecification.new(name, nil, nil)]
         end
       end
 
       specs.uniq
     end
 
+    def add_extra_platforms!(platforms)
+      return platforms.concat([Gem::Platform::RUBY]).uniq if @specs.empty?
+
+      new_platforms = all_platforms.select do |platform|
+        next if platforms.include?(platform)
+        next unless GemHelpers.generic(platform) == Gem::Platform::RUBY
+
+        complete_platform(platform)
+      end
+      return platforms if new_platforms.empty?
+
+      platforms.concat(new_platforms)
+
+      less_specific_platform = new_platforms.find {|platform| platform != Gem::Platform::RUBY && Bundler.local_platform === platform && platform === Bundler.local_platform }
+      platforms.delete(Bundler.local_platform) if less_specific_platform
+
+      platforms
+    end
+
+    def validate_deps(s)
+      s.runtime_dependencies.each do |dep|
+        next if dep.name == "bundler"
+
+        return :missing unless names.include?(dep.name)
+        return :invalid if none? {|spec| dep.matches_spec?(spec) }
+      end
+
+      :valid
+    end
+
     def [](key)
       key = key.name if key.respond_to?(:name)
-      lookup[key].reverse
+      lookup[key]&.reverse || []
     end
 
     def []=(key, value)
       @specs << value
-      @lookup = nil
-      @sorted = nil
+
+      reset!
     end
 
-    def delete(spec)
-      @specs.delete(spec)
-      @lookup = nil
-      @sorted = nil
+    def delete(specs)
+      Array(specs).each {|spec| @specs.delete(spec) }
+
+      reset!
     end
 
     def sort!
@@ -100,12 +130,12 @@ module Bundler
       end
     end
 
-    def incomplete_ruby_specs?(deps)
+    def incomplete_for_platform?(deps, platform)
       return false if @specs.empty?
 
       @incomplete_specs = []
 
-      self.for(deps, true, [Gem::Platform::RUBY])
+      self.for(deps, true, [platform])
 
       @incomplete_specs.any?
     end
@@ -114,16 +144,6 @@ module Bundler
       @specs.select {|s| s.is_a?(LazySpecification) }
     end
 
-    def merge(set)
-      arr = sorted.dup
-      set.each do |set_spec|
-        full_name = set_spec.full_name
-        next if arr.any? {|spec| spec.full_name == full_name }
-        arr << set_spec
-      end
-      SpecSet.new(arr)
-    end
-
     def -(other)
       SpecSet.new(to_a - other.to_a)
     end
@@ -132,14 +152,20 @@ module Bundler
       @specs.detect {|spec| spec.name == name && spec.match_platform(platform) }
     end
 
+    def specs_compatible_with(other)
+      select do |spec|
+        other.valid?(spec)
+      end
+    end
+
     def delete_by_name(name)
       @specs.reject! {|spec| spec.name == name }
-      @lookup = nil
-      @sorted = nil
+
+      reset!
     end
 
     def what_required(spec)
-      unless req = find {|s| s.dependencies.any? {|d| d.type == :runtime && d.name == spec.name } }
+      unless req = find {|s| s.runtime_dependencies.any? {|d| d.name == spec.name } }
         return [spec]
       end
       what_required(req) << spec
@@ -165,8 +191,56 @@ module Bundler
       sorted.each(&b)
     end
 
+    def names
+      lookup.keys
+    end
+
+    def valid?(s)
+      s.matches_current_metadata? && valid_dependencies?(s)
+    end
+
     private
 
+    def reset!
+      @sorted = nil
+      @lookup = nil
+    end
+
+    def complete_platform(platform)
+      new_specs = []
+
+      valid_platform = lookup.all? do |_, specs|
+        spec = specs.first
+        matching_specs = spec.source.specs.search([spec.name, spec.version])
+        platform_spec = GemHelpers.select_best_platform_match(matching_specs, platform).find do |s|
+          valid?(s)
+        end
+
+        if platform_spec
+          new_specs << LazySpecification.from_spec(platform_spec) unless specs.include?(platform_spec)
+          true
+        else
+          false
+        end
+      end
+
+      if valid_platform && new_specs.any?
+        @specs.concat(new_specs)
+
+        reset!
+      end
+
+      valid_platform
+    end
+
+    def all_platforms
+      @specs.flat_map {|spec| spec.source.specs.search([spec.name, spec.version]).map(&:platform) }.uniq
+    end
+
+    def valid_dependencies?(s)
+      validate_deps(s) == :valid
+    end
+
     def sorted
       rake = @specs.find {|s| s.name == "rake" }
       begin
@@ -185,8 +259,9 @@ module Bundler
 
     def lookup
       @lookup ||= begin
-        lookup = Hash.new {|h, k| h[k] = [] }
+        lookup = {}
         @specs.each do |s|
+          lookup[s.name] ||= []
           lookup[s.name] << s
         end
         lookup
@@ -200,16 +275,23 @@ module Bundler
 
     def specs_for_dependency(dep, platform)
       specs_for_name = lookup[dep.name]
-      target_platform = dep.force_ruby_platform ? Gem::Platform::RUBY : (platform || Bundler.local_platform)
-      matching_specs = GemHelpers.select_best_platform_match(specs_for_name, target_platform)
-      matching_specs.map!(&:materialize_for_installation).compact! if platform.nil?
-      matching_specs
+      return [] unless specs_for_name
+
+      if platform
+        GemHelpers.select_best_platform_match(specs_for_name, platform, force_ruby: dep.force_ruby_platform)
+      else
+        GemHelpers.select_best_local_platform_match(specs_for_name, force_ruby: dep.force_ruby_platform || dep.default_force_ruby_platform)
+      end
     end
 
     def tsort_each_child(s)
       s.dependencies.sort_by(&:name).each do |d|
         next if d.type == :development
-        lookup[d.name].each {|s2| yield s2 }
+
+        specs_for_name = lookup[d.name]
+        next unless specs_for_name
+
+        specs_for_name.each {|s2| yield s2 }
       end
     end
   end