rubygems-update 3.4.10 → 3.5.22

data/lib/rubygems/errors.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # This file contains all the various exceptions and other errors that are used
 # inside of RubyGems.
@@ -29,6 +30,7 @@ module Gem
       @name        = name
       @requirement = requirement
       @extra_message = extra_message
+      super(message)
     end
 
     def message # :nodoc:
@@ -52,15 +54,15 @@ module Gem
     attr_reader :specs
 
     def initialize(name, requirement, specs)
-      super(name, requirement)
       @specs = specs
+      super(name, requirement)
     end
 
     private
 
     def build_message
       names = specs.map(&:full_name)
-      "Could not find '#{name}' (#{requirement}) - did find: [#{names.join ','}]\n"
+      "Could not find '#{name}' (#{requirement}) - did find: [#{names.join ","}]\n"
     end
   end
 
@@ -133,11 +135,7 @@ module Gem
     ##
     # A wordy description of the error.
     def wordy
-      "Found %s (%s), but was for platform%s %s" %
-        [@name,
-         @version,
-         @platforms.size == 1 ? "" : "s",
-         @platforms.join(" ,")]
+      format("Found %s (%s), but was for platform%s %s", @name, @version, @platforms.size == 1 ? "" : "s", @platforms.join(" ,"))
     end
   end
 
@@ -174,6 +172,6 @@ module Gem
     ##
     # The "exception" alias allows you to call raise on a SourceFetchProblem.
 
-    alias exception error
+    alias_method :exception, :error
   end
 end

data/lib/rubygems/exceptions.rb

@@ -104,9 +104,6 @@ end
 
 class Gem::GemNotFoundException < Gem::Exception; end
 
-##
-# Raised by the DependencyInstaller when a specific gem cannot be found
-
 class Gem::SpecificGemNotFoundException < Gem::GemNotFoundException
   ##
   # Creates a new SpecificGemNotFoundException for a gem with the given +name+
@@ -137,6 +134,8 @@ class Gem::SpecificGemNotFoundException < Gem::GemNotFoundException
   attr_reader :errors
 end
 
+Gem.deprecate_constant :SpecificGemNotFoundException
+
 ##
 # Raised by Gem::Resolver when dependencies conflict and create the
 # inability to find a valid possible spec for a request.
@@ -172,6 +171,7 @@ class Gem::ImpossibleDependenciesError < Gem::Exception
 end
 
 class Gem::InstallError < Gem::Exception; end
+
 class Gem::RuntimeRequirementNotMetError < Gem::InstallError
   attr_accessor :suggestion
   def message
@@ -213,6 +213,16 @@ class Gem::RubyVersionMismatch < Gem::Exception; end
 
 class Gem::VerificationError < Gem::Exception; end
 
+##
+# Raised by Gem::WebauthnListener when an error occurs during security
+# device verification.
+
+class Gem::WebauthnVerificationError < Gem::Exception
+  def initialize(message)
+    super "Security device verification failed: #{message}"
+  end
+end
+
 ##
 # Raised to indicate that a system exit should occur with the specified
 # exit_code
@@ -221,7 +231,7 @@ class Gem::SystemExitException < SystemExit
   ##
   # The exit code for the process
 
-  alias exit_code status
+  alias_method :exit_code, :status
 
   ##
   # Creates a new SystemExitException with the given +exit_code+
@@ -254,7 +264,7 @@ class Gem::UnsatisfiableDependencyError < Gem::DependencyError
   def initialize(dep, platform_mismatch=nil)
     if platform_mismatch && !platform_mismatch.empty?
       plats = platform_mismatch.map {|x| x.platform.to_s }.sort.uniq
-      super "Unable to resolve dependency: No match for '#{dep}' on this platform. Found: #{plats.join(', ')}"
+      super "Unable to resolve dependency: No match for '#{dep}' on this platform. Found: #{plats.join(", ")}"
     else
       if dep.explicit?
         super "Unable to resolve dependency: user requested '#{dep}'"

data/lib/rubygems/ext/build_error.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Raised when there is an error while building extensions.
 

data/lib/rubygems/ext/builder.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
@@ -6,6 +7,7 @@
 #++
 
 require_relative "../user_interaction"
+require_relative "../shellwords"
 
 class Gem::Ext::Builder
   include Gem::UserInteraction
@@ -25,19 +27,17 @@ class Gem::Ext::Builder
     # try to find make program from Ruby configure arguments first
     RbConfig::CONFIG["configure_args"] =~ /with-make-prog\=(\w+)/
     make_program_name = ENV["MAKE"] || ENV["make"] || $1
-    unless make_program_name
-      make_program_name = (RUBY_PLATFORM.include?("mswin")) ? "nmake" : "make"
-    end
+    make_program_name ||= RUBY_PLATFORM.include?("mswin") ? "nmake" : "make"
     make_program = Shellwords.split(make_program_name)
 
     # The installation of the bundled gems is failed when DESTDIR is empty in mswin platform.
-    destdir = (/\bnmake/i !~ make_program_name || ENV["DESTDIR"] && ENV["DESTDIR"] != "") ? "DESTDIR=%s" % ENV["DESTDIR"] : ""
+    destdir = /\bnmake/i !~ make_program_name || ENV["DESTDIR"] && ENV["DESTDIR"] != "" ? format("DESTDIR=%s", ENV["DESTDIR"]) : ""
 
     env = [destdir]
 
     if sitedir
-      env << "sitearchdir=%s" % sitedir
-      env << "sitelibdir=%s" % sitedir
+      env << format("sitearchdir=%s", sitedir)
+      env << format("sitelibdir=%s", sitedir)
     end
 
     targets.each do |target|
@@ -56,9 +56,8 @@ class Gem::Ext::Builder
   end
 
   def self.ruby
-    require "shellwords"
     # Gem.ruby is quoted if it contains whitespace
-    cmd = Gem.ruby.shellsplit
+    cmd = Shellwords.split(Gem.ruby)
 
     # This load_path is only needed when running rubygems test without a proper installation.
     # Prepending it in a normal installation will cause problem with order of $LOAD_PATH.
@@ -76,26 +75,33 @@ class Gem::Ext::Builder
     verbose = Gem.configuration.really_verbose
 
     begin
-      rubygems_gemdeps, ENV["RUBYGEMS_GEMDEPS"] = ENV["RUBYGEMS_GEMDEPS"], nil
+      rubygems_gemdeps = ENV["RUBYGEMS_GEMDEPS"]
+      ENV["RUBYGEMS_GEMDEPS"] = nil
       if verbose
         puts("current directory: #{dir}")
         p(command)
       end
       results << "current directory: #{dir}"
-      require "shellwords"
-      results << command.shelljoin
+      results << Shellwords.join(command)
 
       require "open3"
       # Set $SOURCE_DATE_EPOCH for the subprocess.
       build_env = { "SOURCE_DATE_EPOCH" => Gem.source_date_epoch_string }.merge(env)
       output, status = begin
-                         Open3.capture2e(build_env, *command, :chdir => dir)
-                       rescue => error
+                         Open3.popen2e(build_env, *command, chdir: dir) do |_stdin, stdouterr, wait_thread|
+                           output = String.new
+                           while line = stdouterr.gets
+                             output << line
+                             if verbose
+                               print line
+                             end
+                           end
+                           [output, wait_thread.value]
+                         end
+                       rescue StandardError => error
                          raise Gem::InstallError, "#{command_name || class_name} failed#{error.message}"
                        end
-      if verbose
-        puts output
-      else
+      unless verbose
         results << output
       end
     ensure
@@ -190,7 +196,7 @@ EOF
       verbose { results.join("\n") }
 
       write_gem_make_out results.join "\n"
-    rescue => e
+    rescue StandardError => e
       results << e.message
       build_error(results.join("\n"), $@)
     end
@@ -206,7 +212,7 @@ EOF
     if @build_args.empty?
       say "Building native extensions. This could take a while..."
     else
-      say "Building native extensions with: '#{@build_args.join ' '}'"
+      say "Building native extensions with: '#{@build_args.join " "}'"
       say "This could take a while..."
     end
 

data/lib/rubygems/ext/cargo_builder.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../shellwords"
+
 # This class is used by rubygems to build Rust extensions. It is a thin-wrapper
 # over the `cargo rustc` command which takes care of building Rust code in a way
 # that Ruby can use.
@@ -73,8 +75,6 @@ class Gem::Ext::CargoBuilder < Gem::Ext::Builder
   end
 
   def cargo_command(cargo_toml, dest_path, args = [], crate_name = nil)
-    require "shellwords"
-
     cmd = []
     cmd += [cargo, "rustc"]
     cmd += ["--crate-type", "cdylib"]
@@ -185,6 +185,7 @@ class Gem::Ext::CargoBuilder < Gem::Ext::Builder
   end
 
   def cargo_dylib_path(dest_path, crate_name)
+    so_ext = RbConfig::CONFIG["SOEXT"]
     prefix = so_ext == "dll" ? "" : "lib"
     path_parts = [dest_path]
     path_parts << ENV["CARGO_BUILD_TARGET"] if ENV["CARGO_BUILD_TARGET"]
@@ -198,8 +199,8 @@ class Gem::Ext::CargoBuilder < Gem::Ext::Builder
 
     output, status =
       begin
-        Open3.capture2e(cargo, "metadata", "--no-deps", "--format-version", "1", :chdir => cargo_dir)
-      rescue => error
+        Open3.capture2e(cargo, "metadata", "--no-deps", "--format-version", "1", chdir: cargo_dir)
+      rescue StandardError => error
         raise Gem::InstallError, "cargo metadata failed #{error.message}"
       end
 
@@ -246,10 +247,10 @@ EOF
   end
 
   def rustc_dynamic_linker_flags(dest_dir, crate_name)
-    split_flags("DLDFLAGS")
-      .map {|arg| maybe_resolve_ldflag_variable(arg, dest_dir, crate_name) }
-      .compact
-      .flat_map {|arg| ldflag_to_link_modifier(arg) }
+    split_flags("DLDFLAGS").
+      map {|arg| maybe_resolve_ldflag_variable(arg, dest_dir, crate_name) }.
+      compact.
+      flat_map {|arg| ldflag_to_link_modifier(arg) }
   end
 
   def rustc_lib_flags(dest_dir)
@@ -293,7 +294,7 @@ EOF
 
     case var_name
     # On windows, it is assumed that mkmf has setup an exports file for the
-    # extension, so we have to to create one ourselves.
+    # extension, so we have to create one ourselves.
     when "DEFFILE"
       write_deffile(dest_dir, crate_name)
     else
@@ -313,22 +314,6 @@ EOF
     deffile_path
   end
 
-  # We have to basically reimplement RbConfig::CONFIG['SOEXT'] here to support
-  # Ruby < 2.5
-  #
-  # @see https://github.com/ruby/ruby/blob/c87c027f18c005460746a74c07cd80ee355b16e4/configure.ac#L3185
-  def so_ext
-    return RbConfig::CONFIG["SOEXT"] if RbConfig::CONFIG.key?("SOEXT")
-
-    if win_target?
-      "dll"
-    elsif darwin_target?
-      "dylib"
-    else
-      "so"
-    end
-  end
-
   # Corresponds to $(LIBPATH) in mkmf
   def mkmf_libpath
     ["-L", "native=#{makefile_config("libdir")}"]

data/lib/rubygems/ext/configure_builder.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/ext/ext_conf_builder.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
@@ -42,12 +43,12 @@ class Gem::Ext::ExtConfBuilder < Gem::Ext::Builder
 
       full_tmp_dest = File.join(extension_dir, tmp_dest_relative)
 
-      # TODO remove in RubyGems 4
+      # TODO: remove in RubyGems 4
       if Gem.install_extension_in_lib && lib_dir
         FileUtils.mkdir_p lib_dir
         entries = Dir.entries(full_tmp_dest) - %w[. ..]
         entries = entries.map {|entry| File.join full_tmp_dest, entry }
-        FileUtils.cp_r entries, lib_dir, :remove_destination => true
+        FileUtils.cp_r entries, lib_dir, remove_destination: true
       end
 
       FileUtils::Entry_.new(full_tmp_dest).traverse do |ent|
@@ -65,8 +66,6 @@ class Gem::Ext::ExtConfBuilder < Gem::Ext::Builder
     FileUtils.rm_rf tmp_dest if tmp_dest
   end
 
-  private
-
   def self.get_relative_path(path, base)
     path[0..base.length - 1] = "." if path.start_with?(base)
     path

data/lib/rubygems/ext/rake_builder.rb

@@ -1,4 +1,7 @@
 # frozen_string_literal: true
+
+require_relative "../shellwords"
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
@@ -7,15 +10,14 @@
 
 class Gem::Ext::RakeBuilder < Gem::Ext::Builder
   def self.build(extension, dest_path, results, args=[], lib_dir=nil, extension_dir=Dir.pwd)
-    if File.basename(extension) =~ /mkrf_conf/i
+    if /mkrf_conf/i.match?(File.basename(extension))
       run([Gem.ruby, File.basename(extension), *args], results, class_name, extension_dir)
     end
 
     rake = ENV["rake"]
 
     if rake
-      require "shellwords"
-      rake = rake.shellsplit
+      rake = Shellwords.split(rake)
     else
       begin
         rake = ruby << "-rrubygems" << Gem.bin_path("rake", "rake")

data/lib/rubygems/ext.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/gem_runner.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
@@ -32,7 +33,11 @@ class Gem::GemRunner
 
     do_configuration args
 
-    Gem.load_env_plugins rescue nil
+    begin
+      Gem.load_env_plugins
+    rescue StandardError
+      nil
+    end
     Gem.load_plugins
 
     cmd = @command_manager_class.instance
@@ -40,10 +45,10 @@ class Gem::GemRunner
     cmd.command_names.each do |command_name|
       config_args = Gem.configuration[command_name]
       config_args = case config_args
-      when String
-        config_args.split " "
-      else
-        Array(config_args)
+                    when String
+                      config_args.split " "
+                    else
+                      Array(config_args)
       end
       Gem::Command.add_specific_extra_args command_name, config_args
     end

data/lib/rubygems/gemcutter_utilities/webauthn_listener/response.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+##
+# The WebauthnListener Response class is used by the WebauthnListener to create
+# responses to be sent to the Gem host. It creates a Gem::Net::HTTPResponse instance
+# when initialized and can be converted to the appropriate format to be sent by a socket using `to_s`.
+# Gem::Net::HTTPResponse instances cannot be directly sent over a socket.
+#
+# Types of response classes:
+#   - OkResponse
+#   - NoContentResponse
+#   - BadRequestResponse
+#   - NotFoundResponse
+#   - MethodNotAllowedResponse
+#
+# Example usage:
+#
+#   server = TCPServer.new(0)
+#   socket = server.accept
+#
+#   response = OkResponse.for("https://rubygems.example")
+#   socket.print response.to_s
+#   socket.close
+#
+
+module Gem::GemcutterUtilities
+  class WebauthnListener
+    class Response
+      attr_reader :http_response
+
+      def self.for(host)
+        new(host)
+      end
+
+      def initialize(host)
+        @host = host
+
+        build_http_response
+      end
+
+      def to_s
+        status_line = "HTTP/#{@http_response.http_version} #{@http_response.code} #{@http_response.message}\r\n"
+        headers = @http_response.to_hash.map {|header, value| "#{header}: #{value.join(", ")}\r\n" }.join + "\r\n"
+        body = @http_response.body ? "#{@http_response.body}\n" : ""
+
+        status_line + headers + body
+      end
+
+      private
+
+      # Must be implemented in subclasses
+      def code
+        raise NotImplementedError
+      end
+
+      def reason_phrase
+        raise NotImplementedError
+      end
+
+      def body; end
+
+      def build_http_response
+        response_class = Gem::Net::HTTPResponse::CODE_TO_OBJ[code.to_s]
+        @http_response = response_class.new("1.1", code, reason_phrase)
+        @http_response.instance_variable_set(:@read, true)
+
+        add_connection_header
+        add_access_control_headers
+        add_body
+      end
+
+      def add_connection_header
+        @http_response["connection"] = "close"
+      end
+
+      def add_access_control_headers
+        @http_response["access-control-allow-origin"] = @host
+        @http_response["access-control-allow-methods"] = "POST"
+        @http_response["access-control-allow-headers"] = %w[Content-Type Authorization x-csrf-token]
+      end
+
+      def add_body
+        return unless body
+        @http_response["content-type"] = "text/plain; charset=utf-8"
+        @http_response["content-length"] = body.bytesize
+        @http_response.instance_variable_set(:@body, body)
+      end
+    end
+
+    class OkResponse < Response
+      private
+
+      def code
+        200
+      end
+
+      def reason_phrase
+        "OK"
+      end
+
+      def body
+        "success"
+      end
+    end
+
+    class NoContentResponse < Response
+      private
+
+      def code
+        204
+      end
+
+      def reason_phrase
+        "No Content"
+      end
+    end
+
+    class BadRequestResponse < Response
+      private
+
+      def code
+        400
+      end
+
+      def reason_phrase
+        "Bad Request"
+      end
+
+      def body
+        "missing code parameter"
+      end
+    end
+
+    class NotFoundResponse < Response
+      private
+
+      def code
+        404
+      end
+
+      def reason_phrase
+        "Not Found"
+      end
+    end
+
+    class MethodNotAllowedResponse < Response
+      private
+
+      def code
+        405
+      end
+
+      def reason_phrase
+        "Method Not Allowed"
+      end
+
+      def add_access_control_headers
+        super
+        @http_response["allow"] = %w[GET OPTIONS]
+      end
+    end
+  end
+end

data/lib/rubygems/gemcutter_utilities/webauthn_listener.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require_relative "webauthn_listener/response"
+
+##
+# The WebauthnListener class retrieves an OTP after a user successfully WebAuthns with the Gem host.
+# An instance opens a socket using the TCPServer instance given and listens for a request from the Gem host.
+# The request should be a GET request to the root path and contains the OTP code in the form
+# of a query parameter `code`. The listener will return the code which will be used as the OTP for
+# API requests.
+#
+# Types of responses sent by the listener after receiving a request:
+#   - 200 OK: OTP code was successfully retrieved
+#   - 204 No Content: If the request was an OPTIONS request
+#   - 400 Bad Request: If the request did not contain a query parameter `code`
+#   - 404 Not Found: The request was not to the root path
+#   - 405 Method Not Allowed: OTP code was not retrieved because the request was not a GET/OPTIONS request
+#
+# Example usage:
+#
+#   thread = Gem::WebauthnListener.listener_thread("https://rubygems.example", server)
+#   thread.join
+#   otp = thread[:otp]
+#   error = thread[:error]
+#
+
+module Gem::GemcutterUtilities
+  class WebauthnListener
+    attr_reader :host
+
+    def initialize(host)
+      @host = host
+    end
+
+    def self.listener_thread(host, server)
+      Thread.new do
+        thread = Thread.current
+        thread.abort_on_exception = true
+        thread.report_on_exception = false
+        thread[:otp] = new(host).wait_for_otp_code(server)
+      rescue Gem::WebauthnVerificationError => e
+        thread[:error] = e
+      ensure
+        server.close
+      end
+    end
+
+    def wait_for_otp_code(server)
+      loop do
+        socket = server.accept
+        request_line = socket.gets
+
+        method, req_uri, _protocol = request_line.split(" ")
+        req_uri = Gem::URI.parse(req_uri)
+
+        responder = SocketResponder.new(socket)
+
+        unless root_path?(req_uri)
+          responder.send(NotFoundResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Page at #{req_uri.path} not found."
+        end
+
+        case method.upcase
+        when "OPTIONS"
+          responder.send(NoContentResponse.for(host))
+          next # will be GET
+        when "GET"
+          if otp = parse_otp_from_uri(req_uri)
+            responder.send(OkResponse.for(host))
+            return otp
+          end
+          responder.send(BadRequestResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Did not receive OTP from #{host}."
+        else
+          responder.send(MethodNotAllowedResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
+        end
+      end
+    end
+
+    private
+
+    def root_path?(uri)
+      uri.path == "/"
+    end
+
+    def parse_otp_from_uri(uri)
+      require "cgi"
+
+      return if uri.query.nil?
+      CGI.parse(uri.query).dig("code", 0)
+    end
+
+    class SocketResponder
+      def initialize(socket)
+        @socket = socket
+      end
+
+      def send(response)
+        @socket.print response.to_s
+        @socket.close
+      end
+    end
+  end
+end