rubygems-update 3.4.10 → 3.5.22

data/bundler/lib/bundler/build_metadata.rb

@@ -4,8 +4,8 @@ module Bundler
   # Represents metadata from when the Bundler gem was built.
   module BuildMetadata
     # begin ivars
-    @built_at = "2023-03-27".freeze
-    @git_commit_sha = "7ffdec80d0".freeze
+    @built_at = "2024-10-16".freeze
+    @git_commit_sha = "342d4542fda".freeze
     @release = true
     # end ivars
 
@@ -31,7 +31,7 @@ module Bundler
       # commit instance variable then we can't determine its commits SHA.
       git_dir = File.expand_path("../../../.git", __dir__)
       if File.directory?(git_dir)
-        return @git_commit_sha = Dir.chdir(git_dir) { `git rev-parse --short HEAD`.strip.freeze }
+        return @git_commit_sha = IO.popen(%w[git rev-parse --short HEAD], { chdir: git_dir }, &:read).strip.freeze
       end
 
       @git_commit_sha ||= "unknown"

data/bundler/lib/bundler/capistrano.rb

@@ -17,6 +17,6 @@ end
 
 Capistrano::Configuration.instance(:must_exist).load do
   before "deploy:finalize_update", "bundle:install"
-  Bundler::Deployment.define_task(self, :task, :except => { :no_release => true })
+  Bundler::Deployment.define_task(self, :task, except: { no_release: true })
   set :rake, lambda { "#{fetch(:bundle_cmd, "bundle")} exec rake" }
 end

data/bundler/lib/bundler/checksum.rb

@@ -0,0 +1,254 @@
+# frozen_string_literal: true
+
+module Bundler
+  class Checksum
+    ALGO_SEPARATOR = "="
+    DEFAULT_ALGORITHM = "sha256"
+    private_constant :DEFAULT_ALGORITHM
+    DEFAULT_BLOCK_SIZE = 16_384
+    private_constant :DEFAULT_BLOCK_SIZE
+
+    class << self
+      def from_gem_package(gem_package, algo = DEFAULT_ALGORITHM)
+        return if Bundler.settings[:disable_checksum_validation]
+        return unless source = gem_package.instance_variable_get(:@gem)
+        return unless source.respond_to?(:with_read_io)
+
+        source.with_read_io do |io|
+          from_gem(io, source.path)
+        ensure
+          io.rewind
+        end
+      end
+
+      def from_gem(io, pathname, algo = DEFAULT_ALGORITHM)
+        digest = Bundler::SharedHelpers.digest(algo.upcase).new
+        buf = String.new(capacity: DEFAULT_BLOCK_SIZE)
+        digest << io.readpartial(DEFAULT_BLOCK_SIZE, buf) until io.eof?
+        Checksum.new(algo, digest.hexdigest!, Source.new(:gem, pathname))
+      end
+
+      def from_api(digest, source_uri, algo = DEFAULT_ALGORITHM)
+        return if Bundler.settings[:disable_checksum_validation]
+
+        Checksum.new(algo, to_hexdigest(digest, algo), Source.new(:api, source_uri))
+      end
+
+      def from_lock(lock_checksum, lockfile_location)
+        algo, digest = lock_checksum.strip.split(ALGO_SEPARATOR, 2)
+        Checksum.new(algo, to_hexdigest(digest, algo), Source.new(:lock, lockfile_location))
+      end
+
+      def to_hexdigest(digest, algo = DEFAULT_ALGORITHM)
+        return digest unless algo == DEFAULT_ALGORITHM
+        return digest if digest.match?(/\A[0-9a-f]{64}\z/i)
+
+        if digest.match?(%r{\A[-0-9a-z_+/]{43}={0,2}\z}i)
+          digest = digest.tr("-_", "+/") # fix urlsafe base64
+          digest.unpack1("m0").unpack1("H*")
+        else
+          raise ArgumentError, "#{digest.inspect} is not a valid SHA256 hex or base64 digest"
+        end
+      end
+    end
+
+    attr_reader :algo, :digest, :sources
+
+    def initialize(algo, digest, source)
+      @algo = algo
+      @digest = digest
+      @sources = [source]
+    end
+
+    def ==(other)
+      match?(other) && other.sources == sources
+    end
+
+    alias_method :eql?, :==
+
+    def same_source?(other)
+      sources.include?(other.sources.first)
+    end
+
+    def match?(other)
+      other.is_a?(self.class) && other.digest == digest && other.algo == algo
+    end
+
+    def hash
+      digest.hash
+    end
+
+    def to_s
+      "#{to_lock} (from #{sources.first}#{", ..." if sources.size > 1})"
+    end
+
+    def to_lock
+      "#{algo}#{ALGO_SEPARATOR}#{digest}"
+    end
+
+    def merge!(other)
+      return nil unless match?(other)
+
+      @sources.concat(other.sources).uniq!
+      self
+    end
+
+    def formatted_sources
+      sources.join("\n    and ").concat("\n")
+    end
+
+    def removable?
+      sources.all?(&:removable?)
+    end
+
+    def removal_instructions
+      msg = +""
+      i = 1
+      sources.each do |source|
+        msg << "  #{i}. #{source.removal}\n"
+        i += 1
+      end
+      msg << "  #{i}. run `bundle install`\n"
+    end
+
+    def inspect
+      abbr = "#{algo}#{ALGO_SEPARATOR}#{digest[0, 8]}"
+      from = "from #{sources.join(" and ")}"
+      "#<#{self.class}:#{object_id} #{abbr} #{from}>"
+    end
+
+    class Source
+      attr_reader :type, :location
+
+      def initialize(type, location)
+        @type = type
+        @location = location
+      end
+
+      def removable?
+        type == :lock || type == :gem
+      end
+
+      def ==(other)
+        other.is_a?(self.class) && other.type == type && other.location == location
+      end
+
+      # phrased so that the usual string format is grammatically correct
+      #   rake (10.3.2) sha256=abc123 from #{to_s}
+      def to_s
+        case type
+        when :lock
+          "the lockfile CHECKSUMS at #{location}"
+        when :gem
+          "the gem at #{location}"
+        when :api
+          "the API at #{location}"
+        else
+          "#{location} (#{type})"
+        end
+      end
+
+      # A full sentence describing how to remove the checksum
+      def removal
+        case type
+        when :lock
+          "remove the matching checksum in #{location}"
+        when :gem
+          "remove the gem at #{location}"
+        when :api
+          "checksums from #{location} cannot be locally modified, you may need to update your sources"
+        else
+          "remove #{location} (#{type})"
+        end
+      end
+    end
+
+    class Store
+      attr_reader :store
+      protected :store
+
+      def initialize
+        @store = {}
+        @store_mutex = Mutex.new
+      end
+
+      def inspect
+        "#<#{self.class}:#{object_id} size=#{store.size}>"
+      end
+
+      # Replace when the new checksum is from the same source.
+      # The primary purpose is registering checksums from gems where there are
+      # duplicates of the same gem (according to full_name) in the index.
+      #
+      # In particular, this is when 2 gems have two similar platforms, e.g.
+      # "darwin20" and "darwin-20", both of which resolve to darwin-20.
+      # In the Index, the later gem replaces the former, so we do that here.
+      #
+      # However, if the new checksum is from a different source, we register like normal.
+      # This ensures a mismatch error where there are multiple top level sources
+      # that contain the same gem with different checksums.
+      def replace(spec, checksum)
+        return unless checksum
+
+        lock_name = spec.name_tuple.lock_name
+        @store_mutex.synchronize do
+          existing = fetch_checksum(lock_name, checksum.algo)
+          if !existing || existing.same_source?(checksum)
+            store_checksum(lock_name, checksum)
+          else
+            merge_checksum(lock_name, checksum, existing)
+          end
+        end
+      end
+
+      def register(spec, checksum)
+        return unless checksum
+
+        register_checksum(spec.name_tuple.lock_name, checksum)
+      end
+
+      def merge!(other)
+        other.store.each do |lock_name, checksums|
+          checksums.each do |_algo, checksum|
+            register_checksum(lock_name, checksum)
+          end
+        end
+      end
+
+      def to_lock(spec)
+        lock_name = spec.name_tuple.lock_name
+        checksums = @store[lock_name]
+        if checksums
+          "#{lock_name} #{checksums.values.map(&:to_lock).sort.join(",")}"
+        else
+          lock_name
+        end
+      end
+
+      private
+
+      def register_checksum(lock_name, checksum)
+        @store_mutex.synchronize do
+          existing = fetch_checksum(lock_name, checksum.algo)
+          if existing
+            merge_checksum(lock_name, checksum, existing)
+          else
+            store_checksum(lock_name, checksum)
+          end
+        end
+      end
+
+      def merge_checksum(lock_name, checksum, existing)
+        existing.merge!(checksum) || raise(ChecksumMismatchError.new(lock_name, existing, checksum))
+      end
+
+      def store_checksum(lock_name, checksum)
+        (@store[lock_name] ||= {})[checksum.algo] = checksum
+      end
+
+      def fetch_checksum(lock_name, algo)
+        @store[lock_name]&.fetch(algo, nil)
+      end
+    end
+  end
+end

data/bundler/lib/bundler/ci_detector.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Bundler
+  module CIDetector
+    # NOTE: Any changes made here will need to be made to both lib/rubygems/ci_detector.rb and
+    # bundler/lib/bundler/ci_detector.rb (which are enforced duplicates).
+    # TODO: Drop that duplication once bundler drops support for RubyGems 3.4
+    #
+    # ## Recognized CI providers, their signifiers, and the relevant docs ##
+    #
+    # Travis CI   - CI, TRAVIS            https://docs.travis-ci.com/user/environment-variables/#default-environment-variables
+    # Cirrus CI   - CI, CIRRUS_CI         https://cirrus-ci.org/guide/writing-tasks/#environment-variables
+    # Circle CI   - CI, CIRCLECI          https://circleci.com/docs/variables/#built-in-environment-variables
+    # Gitlab CI   - CI, GITLAB_CI         https://docs.gitlab.com/ee/ci/variables/
+    # AppVeyor    - CI, APPVEYOR          https://www.appveyor.com/docs/environment-variables/
+    # CodeShip    - CI_NAME               https://docs.cloudbees.com/docs/cloudbees-codeship/latest/pro-builds-and-configuration/environment-variables#_default_environment_variables
+    # dsari       - CI, DSARI             https://github.com/rfinnie/dsari#running
+    # Jenkins     - BUILD_NUMBER          https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#using-environment-variables
+    # TeamCity    - TEAMCITY_VERSION      https://www.jetbrains.com/help/teamcity/predefined-build-parameters.html#Predefined+Server+Build+Parameters
+    # Appflow     - CI_BUILD_ID           https://ionic.io/docs/appflow/automation/environments#predefined-environments
+    # TaskCluster - TASKCLUSTER_ROOT_URL  https://docs.taskcluster.net/docs/manual/design/env-vars
+    # Semaphore   - CI, SEMAPHORE         https://docs.semaphoreci.com/ci-cd-environment/environment-variables/
+    # BuildKite   - CI, BUILDKITE         https://buildkite.com/docs/pipelines/environment-variables
+    # GoCD        - GO_SERVER_URL         https://docs.gocd.org/current/faq/dev_use_current_revision_in_build.html
+    # GH Actions  - CI, GITHUB_ACTIONS    https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables
+    #
+    # ### Some "standard" ENVs that multiple providers may set ###
+    #
+    # * CI - this is set by _most_ (but not all) CI providers now; it's approaching a standard.
+    # * CI_NAME - Not as frequently used, but some providers set this to specify their own name
+
+    # Any of these being set is a reasonably reliable indicator that we are
+    # executing in a CI environment.
+    ENV_INDICATORS = [
+      "CI",
+      "CI_NAME",
+      "CONTINUOUS_INTEGRATION",
+      "BUILD_NUMBER",
+      "CI_APP_ID",
+      "CI_BUILD_ID",
+      "CI_BUILD_NUMBER",
+      "RUN_ID",
+      "TASKCLUSTER_ROOT_URL",
+    ].freeze
+
+    # For each CI, this env suffices to indicate that we're on _that_ CI's
+    # containers. (A few of them only supply a CI_NAME variable, which is also
+    # nice). And if they set "CI" but we can't tell which one they are, we also
+    # want to know that - a bare "ci" without another token tells us as much.
+    ENV_DESCRIPTORS = {
+      "TRAVIS" => "travis",
+      "CIRCLECI" => "circle",
+      "CIRRUS_CI" => "cirrus",
+      "DSARI" => "dsari",
+      "SEMAPHORE" => "semaphore",
+      "JENKINS_URL" => "jenkins",
+      "BUILDKITE" => "buildkite",
+      "GO_SERVER_URL" => "go",
+      "GITLAB_CI" => "gitlab",
+      "GITHUB_ACTIONS" => "github",
+      "TASKCLUSTER_ROOT_URL" => "taskcluster",
+      "CI" => "ci",
+    }.freeze
+
+    def self.ci?
+      ENV_INDICATORS.any? {|var| ENV.include?(var) }
+    end
+
+    def self.ci_strings
+      matching_names = ENV_DESCRIPTORS.select {|env, _| ENV[env] }.values
+      matching_names << ENV["CI_NAME"].downcase if ENV["CI_NAME"]
+      matching_names.reject(&:empty?).sort.uniq
+    end
+  end
+end

data/bundler/lib/bundler/cli/add.rb

@@ -28,13 +28,13 @@ module Bundler
       dependencies = gems.map {|g| Bundler::Dependency.new(g, version, options) }
 
       Injector.inject(dependencies,
-        :conservative_versioning => options[:version].nil?, # Perform conservative versioning only when version is not specified
-        :optimistic => options[:optimistic],
-        :strict => options[:strict])
+        conservative_versioning: options[:version].nil?, # Perform conservative versioning only when version is not specified
+        optimistic: options[:optimistic],
+        strict: options[:strict])
     end
 
     def validate_options!
-      raise InvalidOption, "You can not specify `--strict` and `--optimistic` at the same time." if options[:strict] && options[:optimistic]
+      raise InvalidOption, "You cannot specify `--strict` and `--optimistic` at the same time." if options[:strict] && options[:optimistic]
 
       # raise error when no gems are specified
       raise InvalidOption, "Please specify gems to add." if gems.empty?

data/bundler/lib/bundler/cli/binstubs.rb

@@ -11,15 +11,15 @@ module Bundler
     def run
       Bundler.definition.validate_runtime!
       path_option = options["path"]
-      path_option = nil if path_option && path_option.empty?
+      path_option = nil if path_option&.empty?
       Bundler.settings.set_command_option :bin, path_option if options["path"]
       Bundler.settings.set_command_option_if_given :shebang, options["shebang"]
       installer = Installer.new(Bundler.root, Bundler.definition)
 
       installer_opts = {
-        :force => options[:force],
-        :binstubs_cmd => true,
-        :all_platforms => options["all-platforms"],
+        force: options[:force],
+        binstubs_cmd: true,
+        all_platforms: options["all-platforms"],
       }
 
       if options[:all]
@@ -45,7 +45,7 @@ module Bundler
             next
           end
 
-          Bundler.settings.temporary(:path => (Bundler.settings[:path] || Bundler.root)) do
+          Bundler.settings.temporary(path: Bundler.settings[:path] || Bundler.root) do
             installer.generate_standalone_bundler_executable_stubs(spec, installer_opts)
           end
         else

data/bundler/lib/bundler/cli/cache.rb

@@ -19,7 +19,7 @@ module Bundler
       # TODO: move cache contents here now that all bundles are locked
       custom_path = Bundler.settings[:path] if options[:path]
 
-      Bundler.settings.temporary(:cache_all_platforms => options["all-platforms"]) do
+      Bundler.settings.temporary(cache_all_platforms: options["all-platforms"]) do
         Bundler.load.cache(custom_path)
       end
     end

data/bundler/lib/bundler/cli/check.rb

@@ -17,7 +17,7 @@ module Bundler
       begin
         definition.resolve_only_locally!
         not_installed = definition.missing_specs
-      rescue GemNotFound, SolveFailure
+      rescue GemNotFound, GitError, SolveFailure
         Bundler.ui.error "Bundler can't satisfy your Gemfile's dependencies."
         Bundler.ui.warn "Install missing gems with `bundle install`."
         exit 1
@@ -29,10 +29,10 @@ module Bundler
         Bundler.ui.warn "Install missing gems with `bundle install`"
         exit 1
       elsif !Bundler.default_lockfile.file? && Bundler.frozen_bundle?
-        Bundler.ui.error "This bundle has been frozen, but there is no #{Bundler.default_lockfile.relative_path_from(SharedHelpers.pwd)} present"
+        Bundler.ui.error "This bundle has been frozen, but there is no #{SharedHelpers.relative_lockfile_path} present"
         exit 1
       else
-        Bundler.load.lock(:preserve_unknown_sections => true) unless options[:"dry-run"]
+        Bundler.load.lock(preserve_unknown_sections: true) unless options[:"dry-run"]
         Bundler.ui.info "The Gemfile's dependencies are satisfied"
       end
     end

data/bundler/lib/bundler/cli/common.rb

@@ -54,9 +54,12 @@ module Bundler
 
       Bundler.definition.specs.each do |spec|
         return spec if spec.name == name
-        specs << spec if regexp && spec.name =~ regexp
+        specs << spec if regexp && spec.name.match?(regexp)
       end
 
+      default_spec = default_gem_spec(name)
+      specs << default_spec if default_spec
+
       case specs.count
       when 0
         dep_in_other_group = Bundler.definition.current_dependencies.find {|dep|dep.name == name }
@@ -75,6 +78,11 @@ module Bundler
       raise GemNotFound, gem_not_found_message(name, Bundler.definition.dependencies)
     end
 
+    def self.default_gem_spec(name)
+      gem_spec = Gem::Specification.find_all_by_name(name).last
+      gem_spec if gem_spec&.default_gem?
+    end
+
     def self.ask_for_spec_from(specs)
       specs.each_with_index do |spec, index|
         Bundler.ui.info "#{index.succ} : #{spec.name}", true

data/bundler/lib/bundler/cli/config.rb

@@ -2,17 +2,17 @@
 
 module Bundler
   class CLI::Config < Thor
-    class_option :parseable, :type => :boolean, :banner => "Use minimal formatting for more parseable output"
+    class_option :parseable, type: :boolean, banner: "Use minimal formatting for more parseable output"
 
     def self.scope_options
-      method_option :global, :type => :boolean, :banner => "Only change the global config"
-      method_option :local, :type => :boolean, :banner => "Only change the local config"
+      method_option :global, type: :boolean, banner: "Only change the global config"
+      method_option :local, type: :boolean, banner: "Only change the local config"
     end
     private_class_method :scope_options
 
-    desc "base NAME [VALUE]", "The Bundler 1 config interface", :hide => true
+    desc "base NAME [VALUE]", "The Bundler 1 config interface", hide: true
     scope_options
-    method_option :delete, :type => :boolean, :banner => "delete"
+    method_option :delete, type: :boolean, banner: "delete"
     def base(name = nil, *value)
       new_args =
         if ARGV.size == 1
@@ -25,8 +25,9 @@ module Bundler
           ["config", "get", ARGV[1]]
         end
 
-      SharedHelpers.major_deprecation 3,
-        "Using the `config` command without a subcommand [list, get, set, unset] is deprecated and will be removed in the future. Use `bundle #{new_args.join(" ")}` instead."
+      message = "Using the `config` command without a subcommand [list, get, set, unset] is deprecated and will be removed in the future. Use `bundle #{new_args.join(" ")}` instead."
+      removed_message = "Using the `config` command without a subcommand [list, get, set, unset] is has been removed. Use `bundle #{new_args.join(" ")}` instead."
+      SharedHelpers.major_deprecation 3, message, removed_message: removed_message
 
       Base.new(options, name, value, self).run
     end

data/bundler/lib/bundler/cli/console.rb

@@ -9,8 +9,9 @@ module Bundler
     end
 
     def run
-      Bundler::SharedHelpers.major_deprecation 2, "bundle console will be replaced " \
-                           "by `bin/console` generated by `bundle gem <name>`"
+      message = "bundle console will be replaced by `bin/console` generated by `bundle gem <name>`"
+      removed_message = "bundle console has been replaced by `bin/console` generated by `bundle gem <name>`"
+      Bundler::SharedHelpers.major_deprecation 2, message, removed_message: removed_message
 
       group ? Bundler.require(:default, *group.split(" ").map!(&:to_sym)) : Bundler.require
       ARGV.clear

data/bundler/lib/bundler/cli/doctor.rb

@@ -6,8 +6,8 @@ require "fiddle"
 
 module Bundler
   class CLI::Doctor
-    DARWIN_REGEX = /\s+(.+) \(compatibility /.freeze
-    LDD_REGEX = /\t\S+ => (\S+) \(\S+\)/.freeze
+    DARWIN_REGEX = /\s+(.+) \(compatibility /
+    LDD_REGEX = /\t\S+ => (\S+) \(\S+\)/
 
     attr_reader :options
 

data/bundler/lib/bundler/cli/exec.rb

@@ -12,7 +12,7 @@ module Bundler
       @options = options
       @cmd = args.shift
       @args = args
-      @args << { :close_others => !options.keep_file_descriptors? } unless Bundler.current_ruby.jruby?
+      @args << { close_others: !options.keep_file_descriptors? } unless Bundler.current_ruby.jruby?
     end
 
     def run

data/bundler/lib/bundler/cli/fund.rb

@@ -16,7 +16,7 @@ module Bundler
       deps = if groups.any?
         Bundler.definition.dependencies_for(groups)
       else
-        Bundler.definition.current_dependencies
+        Bundler.definition.requested_dependencies
       end
 
       fund_info = deps.each_with_object([]) do |dep, arr|