rubygems-update 3.4.21 → 3.5.0

data/bundler/lib/bundler/man/gemfile.5.ronn

@@ -238,6 +238,10 @@ All operations involving groups ([`bundle install`](bundle-install.1.html), `Bun
 `Bundler.require`) behave exactly the same as if any groups not
 matching the current platform were explicitly excluded.
 
+The following platform values are deprecated and should be replaced with `windows`:
+
+  * `mswin`, `mswin64`, `mingw32`, `x64_mingw`
+
 ### FORCE_RUBY_PLATFORM
 
 If you always want the pure ruby variant of a gem to be chosen over platform

data/bundler/lib/bundler/match_metadata.rb

@@ -2,6 +2,10 @@
 
 module Bundler
   module MatchMetadata
+    def matches_current_metadata?
+      matches_current_ruby? && matches_current_rubygems?
+    end
+
     def matches_current_ruby?
       @required_ruby_version.satisfied_by?(Gem.ruby_version)
     end

data/bundler/lib/bundler/match_platform.rb

@@ -12,7 +12,7 @@ module Bundler
 
     def self.platforms_match?(gemspec_platform, local_platform)
       return true if gemspec_platform.nil?
-      return true if Gem::Platform::RUBY == gemspec_platform
+      return true if gemspec_platform == Gem::Platform::RUBY
       return true if local_platform == gemspec_platform
       gemspec_platform = Gem::Platform.new(gemspec_platform)
       return true if gemspec_platform === local_platform

data/bundler/lib/bundler/plugin/api/source.rb

@@ -39,7 +39,7 @@ module Bundler
       #     is present to be compatible with `Definition` and is used by
       #     rubygems source.
       module Source
-        attr_reader :uri, :options, :name
+        attr_reader :uri, :options, :name, :checksum_store
         attr_accessor :dependency_names
 
         def initialize(opts)
@@ -48,6 +48,7 @@ module Bundler
           @uri = opts["uri"]
           @type = opts["type"]
           @name = opts["name"] || "#{@type} at #{@uri}"
+          @checksum_store = Checksum::Store.new
         end
 
         # This is used by the default `spec` method to constructs the
@@ -95,7 +96,7 @@ module Bundler
         #
         # Note: Do not override if you don't know what you are doing.
         def post_install(spec, disable_exts = false)
-          opts = { :env_shebang => false, :disable_extensions => disable_exts }
+          opts = { env_shebang: false, disable_extensions: disable_exts }
           installer = Bundler::Source::Path::Installer.new(spec, opts)
           installer.post_install
         end

data/bundler/lib/bundler/plugin/index.rb

@@ -136,6 +136,14 @@ module Bundler
         @hooks[event] || []
       end
 
+      # This plugin is installed inside the .bundle/plugin directory,
+      # and thus is managed solely by Bundler
+      def installed_in_plugin_root?(name)
+        return false unless (path = installed?(name))
+
+        path.start_with?("#{Plugin.root}/")
+      end
+
       private
 
       # Reads the index file from the directory and initializes the instance

data/bundler/lib/bundler/plugin/installer.rb

@@ -83,7 +83,7 @@ module Bundler
 
         Bundler.configure_gem_home_and_path(Plugin.root)
 
-        Bundler.settings.temporary(:deployment => false, :frozen => false) do
+        Bundler.settings.temporary(deployment: false, frozen: false) do
           definition = Definition.new(nil, deps, source_list, true)
 
           install_definition(definition)

data/bundler/lib/bundler/plugin.rb

@@ -62,7 +62,8 @@ module Bundler
       if names.any?
         names.each do |name|
           if index.installed?(name)
-            Bundler.rm_rf(index.plugin_path(name))
+            path = index.plugin_path(name).to_s
+            Bundler.rm_rf(path) if index.installed_in_plugin_root?(name)
             index.unregister_plugin(name)
             Bundler.ui.info "Uninstalled plugin #{name}"
           else
@@ -100,7 +101,7 @@ module Bundler
     # @param [Pathname] gemfile path
     # @param [Proc] block that can be evaluated for (inline) Gemfile
     def gemfile_install(gemfile = nil, &inline)
-      Bundler.settings.temporary(:frozen => false, :deployment => false) do
+      Bundler.settings.temporary(frozen: false, deployment: false) do
         builder = DSL.new
         if block_given?
           builder.instance_eval(&inline)
@@ -227,7 +228,7 @@ module Bundler
       plugins = index.hook_plugins(event)
       return unless plugins.any?
 
-      (plugins - @loaded_plugin_names).each {|name| load_plugin(name) }
+      plugins.each {|name| load_plugin(name) }
 
       @hooks_by_event[event].each {|blk| blk.call(*args, &arg_blk) }
     end
@@ -239,6 +240,11 @@ module Bundler
       Index.new.installed?(plugin)
     end
 
+    # @return [true, false] whether the plugin is loaded
+    def loaded?(plugin)
+      @loaded_plugin_names.include?(plugin)
+    end
+
     # Post installation processing and registering with index
     #
     # @param [Array<String>] plugins list to be installed
@@ -301,7 +307,7 @@ module Bundler
       @hooks_by_event = Hash.new {|h, k| h[k] = [] }
 
       load_paths = spec.load_paths
-      Bundler.rubygems.add_to_load_path(load_paths)
+      Gem.add_to_load_path(*load_paths)
       path = Pathname.new spec.full_gem_path
 
       begin
@@ -329,13 +335,14 @@ module Bundler
     # @param [String] name of the plugin
     def load_plugin(name)
       return unless name && !name.empty?
+      return if loaded?(name)
 
       # Need to ensure before this that plugin root where the rest of gems
       # are installed to be on load path to support plugin deps. Currently not
       # done to avoid conflicts
       path = index.plugin_path(name)
 
-      Bundler.rubygems.add_to_load_path(index.load_paths(name))
+      Gem.add_to_load_path(*index.load_paths(name))
 
       load path.join(PLUGIN_FILE_NAME)
 

data/bundler/lib/bundler/resolver/base.rb

@@ -24,7 +24,7 @@ module Bundler
 
           name = dep.name
 
-          @packages[name] = Package.new(name, dep_platforms, **options.merge(:dependency => dep))
+          @packages[name] = Package.new(name, dep_platforms, **options.merge(dependency: dep))
 
           dep
         end.compact

data/bundler/lib/bundler/resolver/incompatibility.rb

@@ -8,7 +8,7 @@ module Bundler
       def initialize(terms, cause:, custom_explanation: nil, extended_explanation: nil)
         @extended_explanation = extended_explanation
 
-        super(terms, :cause => cause, :custom_explanation => custom_explanation)
+        super(terms, cause: cause, custom_explanation: custom_explanation)
       end
     end
   end

data/bundler/lib/bundler/resolver/spec_group.rb

@@ -25,9 +25,8 @@ module Bundler
 
       def to_specs(force_ruby_platform)
         @specs.map do |s|
-          lazy_spec = LazySpecification.new(name, version, s.platform, source)
+          lazy_spec = LazySpecification.from_spec(s)
           lazy_spec.force_ruby_platform = force_ruby_platform
-          lazy_spec.dependencies.replace s.dependencies
           lazy_spec
         end
       end
@@ -64,8 +63,6 @@ module Bundler
       end
 
       def metadata_dependencies(spec)
-        return [] if spec.is_a?(LazySpecification)
-
         [
           metadata_dependency("Ruby", spec.required_ruby_version),
           metadata_dependency("RubyGems", spec.required_rubygems_version),

data/bundler/lib/bundler/resolver.rb

@@ -29,7 +29,7 @@ module Bundler
 
       Bundler.ui.info "Resolving dependencies...", true
 
-      solve_versions(:root => root, :logger => logger)
+      solve_versions(root: root, logger: logger)
     end
 
     def setup_solver
@@ -77,7 +77,7 @@ module Bundler
     end
 
     def solve_versions(root:, logger:)
-      solver = PubGrub::VersionSolver.new(:source => self, :root => root, :logger => logger)
+      solver = PubGrub::VersionSolver.new(source: self, root: root, logger: logger)
       result = solver.solve
       result.map {|package, version| version.to_specs(package) }.flatten.uniq
     rescue PubGrub::SolveFailure => e
@@ -152,7 +152,7 @@ module Bundler
         requirement_to_range(dependency)
       end
 
-      PubGrub::VersionConstraint.new(package, :range => range)
+      PubGrub::VersionConstraint.new(package, range: range)
     end
 
     def versions_for(package, range=VersionRange.any)
@@ -181,7 +181,7 @@ module Bundler
         extended_explanation = other_specs_matching_message(specs_matching_other_platforms, label) if specs_matching_other_platforms.any?
       end
 
-      Incompatibility.new([unsatisfied_term], :cause => cause, :custom_explanation => custom_explanation, :extended_explanation => extended_explanation)
+      Incompatibility.new([unsatisfied_term], cause: cause, custom_explanation: custom_explanation, extended_explanation: extended_explanation)
     end
 
     def debug?
@@ -220,9 +220,9 @@ module Bundler
             sorted_versions[high]
           end
 
-        range = PubGrub::VersionRange.new(:min => low, :max => high, :include_min => true)
+        range = PubGrub::VersionRange.new(min: low, max: high, include_min: true)
 
-        self_constraint = PubGrub::VersionConstraint.new(package, :range => range)
+        self_constraint = PubGrub::VersionConstraint.new(package, range: range)
 
         dep_term = PubGrub::Term.new(dep_constraint, false)
         self_term = PubGrub::Term.new(self_constraint, true)
@@ -231,7 +231,7 @@ module Bundler
           "current #{dep_package} version is #{dep_constraint.constraint_string}"
         end
 
-        PubGrub::Incompatibility.new([self_term, dep_term], :cause => :dependency, :custom_explanation => custom_explanation)
+        PubGrub::Incompatibility.new([self_term, dep_term], cause: :dependency, custom_explanation: custom_explanation)
       end
     end
 
@@ -266,11 +266,11 @@ module Bundler
         platform_specs.flatten!
 
         ruby_specs = select_best_platform_match(specs, Gem::Platform::RUBY)
-        groups << Resolver::Candidate.new(version, :specs => ruby_specs) if ruby_specs.any?
+        groups << Resolver::Candidate.new(version, specs: ruby_specs) if ruby_specs.any?
 
         next groups if platform_specs == ruby_specs || package.force_ruby_platform?
 
-        groups << Resolver::Candidate.new(version, :specs => platform_specs)
+        groups << Resolver::Candidate.new(version, specs: platform_specs)
 
         groups
       end
@@ -408,19 +408,19 @@ module Bundler
         when "~>"
           name = "~> #{ver}"
           bump = Resolver::Candidate.new(version.bump.to_s + ".A")
-          PubGrub::VersionRange.new(:name => name, :min => ver, :max => bump, :include_min => true)
+          PubGrub::VersionRange.new(name: name, min: ver, max: bump, include_min: true)
         when ">"
-          PubGrub::VersionRange.new(:min => platform_ver)
+          PubGrub::VersionRange.new(min: platform_ver)
         when ">="
-          PubGrub::VersionRange.new(:min => ver, :include_min => true)
+          PubGrub::VersionRange.new(min: ver, include_min: true)
         when "<"
-          PubGrub::VersionRange.new(:max => ver)
+          PubGrub::VersionRange.new(max: ver)
         when "<="
-          PubGrub::VersionRange.new(:max => platform_ver, :include_max => true)
+          PubGrub::VersionRange.new(max: platform_ver, include_max: true)
         when "="
-          PubGrub::VersionRange.new(:min => ver, :max => platform_ver, :include_min => true, :include_max => true)
+          PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true)
         when "!="
-          PubGrub::VersionRange.new(:min => ver, :max => platform_ver, :include_min => true, :include_max => true).invert
+          PubGrub::VersionRange.new(min: ver, max: platform_ver, include_min: true, include_max: true).invert
         else
           raise "bad version specifier: #{op}"
         end

data/bundler/lib/bundler/ruby_dsl.rb

@@ -3,22 +3,28 @@
 module Bundler
   module RubyDsl
     def ruby(*ruby_version)
-      options = ruby_version.last.is_a?(Hash) ? ruby_version.pop : {}
+      options = ruby_version.pop if ruby_version.last.is_a?(Hash)
       ruby_version.flatten!
 
-      raise GemfileError, "Please define :engine_version" if options[:engine] && options[:engine_version].nil?
-      raise GemfileError, "Please define :engine" if options[:engine_version] && options[:engine].nil?
+      if options
+        patchlevel = options[:patchlevel]
+        engine = options[:engine]
+        engine_version = options[:engine_version]
 
-      if options[:file]
-        raise GemfileError, "Do not pass version argument when using :file option" unless ruby_version.empty?
-        ruby_version << normalize_ruby_file(options[:file])
-      end
+        raise GemfileError, "Please define :engine_version" if engine && engine_version.nil?
+        raise GemfileError, "Please define :engine" if engine_version && engine.nil?
+
+        if options[:file]
+          raise GemfileError, "Do not pass version argument when using :file option" unless ruby_version.empty?
+          ruby_version << normalize_ruby_file(options[:file])
+        end
 
-      if options[:engine] == "ruby" && options[:engine_version] &&
-         ruby_version != Array(options[:engine_version])
-        raise GemfileEvalError, "ruby_version must match the :engine_version for MRI"
+        if engine == "ruby" && engine_version && ruby_version != Array(engine_version)
+          raise GemfileEvalError, "ruby_version must match the :engine_version for MRI"
+        end
       end
-      @ruby_version = RubyVersion.new(ruby_version, options[:patchlevel], options[:engine], options[:engine_version])
+
+      @ruby_version = RubyVersion.new(ruby_version, patchlevel, engine, engine_version)
     end
 
     # Support the various file formats found in .ruby-version files.
@@ -32,8 +38,10 @@ module Bundler
     #     ruby   2.5.1# close comment and extra spaces doesn't confuse
     #
     # Intentionally does not support `3.2.1@gemset` since rvm recommends using .ruby-gemset instead
+    #
+    # Loads the file relative to the dirname of the Gemfile itself.
     def normalize_ruby_file(filename)
-      file_content = Bundler.read_file(Bundler.root.join(filename))
+      file_content = Bundler.read_file(gemfile.dirname.join(filename))
       # match "ruby-3.2.2" or "ruby   3.2.2" capturing version string up to the first space or comment
       if /^ruby(-|\s+)([^\s#]+)/.match(file_content)
         $2

data/bundler/lib/bundler/ruby_version.rb

@@ -49,7 +49,7 @@ module Bundler
       (\d+\.\d+\.\d+(?:\.\S+)?) # ruby version
       (?:p(-?\d+))? # optional patchlevel
       (?:\s\((\S+)\s(.+)\))? # optional engine info
-    /xo.freeze
+    /xo
 
     # Returns a RubyVersion from the given string.
     # @param [String] the version string to match.

data/bundler/lib/bundler/rubygems_ext.rb

@@ -2,6 +2,8 @@
 
 require "pathname"
 
+require "rubygems" unless defined?(Gem)
+
 require "rubygems/specification"
 
 # We can't let `Gem::Source` be autoloaded in the `Gem::Specification#source`
@@ -46,7 +48,7 @@ module Gem
 
     def full_gem_path
       if source.respond_to?(:root)
-        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s.tap {|x| x.untaint if RUBY_VERSION < "2.7" }
+        Pathname.new(loaded_from).dirname.expand_path(source.root).to_s
       else
         rg_full_gem_path
       end
@@ -76,7 +78,7 @@ module Gem
       end
     end
 
-    remove_method :gem_dir if instance_methods(false).include?(:gem_dir)
+    remove_method :gem_dir
     def gem_dir
       full_gem_path
     end
@@ -117,17 +119,6 @@ module Gem
       gemfile
     end
 
-    # Backfill missing YAML require when not defined. Fixed since 3.1.0.pre1.
-    module YamlBackfiller
-      def to_yaml(opts = {})
-        Gem.load_yaml unless defined?(::YAML)
-
-        super(opts)
-      end
-    end
-
-    prepend YamlBackfiller
-
     def nondevelopment_dependencies
       dependencies - development_dependencies
     end
@@ -188,37 +179,7 @@ module Gem
     end
   end
 
-  # comparison is done order independently since rubygems 3.2.0.rc.2
-  unless Gem::Requirement.new("> 1", "< 2") == Gem::Requirement.new("< 2", "> 1")
-    class Requirement
-      module OrderIndependentComparison
-        def ==(other)
-          return unless Gem::Requirement === other
-
-          if _requirements_sorted? && other._requirements_sorted?
-            super
-          else
-            _with_sorted_requirements == other._with_sorted_requirements
-          end
-        end
-
-        protected
-
-        def _requirements_sorted?
-          return @_requirements_sorted if defined?(@_requirements_sorted)
-          strings = as_list
-          @_requirements_sorted = strings == strings.sort
-        end
-
-        def _with_sorted_requirements
-          @_with_sorted_requirements ||= _requirements_sorted? ? self : self.class.new(as_list.sort)
-        end
-      end
-
-      prepend OrderIndependentComparison
-    end
-  end
-
+  # Requirements using lambda operator differentiate trailing zeros since rubygems 3.2.6
   if Gem::Requirement.new("~> 2.0").hash == Gem::Requirement.new("~> 2.0.0").hash
     class Requirement
       module CorrectHashForLambdaOperator
@@ -320,7 +281,7 @@ module Gem
   end
 
   # On universal Rubies, resolve the "universal" arch to the real CPU arch, without changing the extension directory.
-  class Specification
+  class BasicSpecification
     if /^universal\.(?<arch>.*?)-/ =~ (CROSS_COMPILING || RUBY_PLATFORM)
       local_platform = Platform.local
       if local_platform.cpu == "universal"
@@ -333,23 +294,35 @@ module Gem
         end
 
         def extensions_dir
-          Gem.default_ext_dir_for(base_dir) ||
-            File.join(base_dir, "extensions", ORIGINAL_LOCAL_PLATFORM,
-                      Gem.extension_api_version)
+          @extensions_dir ||=
+            Gem.default_ext_dir_for(base_dir) || File.join(base_dir, "extensions", ORIGINAL_LOCAL_PLATFORM, Gem.extension_api_version)
         end
       end
     end
   end
 
-  require "rubygems/util"
+  require "rubygems/name_tuple"
+
+  class NameTuple
+    # Versions of RubyGems before about 3.5.0 don't to_s the platform.
+    unless Gem::NameTuple.new("a", Gem::Version.new("1"), Gem::Platform.new("x86_64-linux")).platform.is_a?(String)
+      alias_method :initialize_with_platform, :initialize
 
-  Util.singleton_class.module_eval do
-    if Util.singleton_methods.include?(:glob_files_in_dir) # since 3.0.0.beta.2
-      remove_method :glob_files_in_dir
+      def initialize(name, version, platform=Gem::Platform::RUBY)
+        if Gem::Platform === platform
+          initialize_with_platform(name, version, platform.to_s)
+        else
+          initialize_with_platform(name, version, platform)
+        end
+      end
     end
 
-    def glob_files_in_dir(glob, base_path)
-      Dir.glob(glob, :base => base_path).map! {|f| File.expand_path(f, base_path) }
+    def lock_name
+      if platform == Gem::Platform::RUBY
+        "#{name} (#{version})"
+      else
+        "#{name} (#{version}-#{platform})"
+      end
     end
   end
 end

data/bundler/lib/bundler/rubygems_gem_installer.rb

@@ -20,7 +20,7 @@ module Bundler
       strict_rm_rf spec.extension_dir
 
       SharedHelpers.filesystem_access(gem_dir, :create) do
-        FileUtils.mkdir_p gem_dir, :mode => 0o755
+        FileUtils.mkdir_p gem_dir, mode: 0o755
       end
 
       extract_files
@@ -45,6 +45,14 @@ module Bundler
       spec
     end
 
+    def pre_install_checks
+      super
+    rescue Gem::FilePermissionError
+      # Ignore permission checks in RubyGems. Instead, go on, and try to write
+      # for real. We properly handle permission errors when they happen.
+      nil
+    end
+
     def generate_plugins
       return unless Gem::Installer.instance_methods(false).include?(:generate_plugins)
 
@@ -60,10 +68,6 @@ module Bundler
       end
     end
 
-    def pre_install_checks
-      super && validate_bundler_checksum(options[:bundler_expected_checksum])
-    end
-
     def build_extensions
       extension_cache_path = options[:bundler_extension_cache_path]
       extension_dir = spec.extension_dir
@@ -98,6 +102,10 @@ module Bundler
       end
     end
 
+    def gem_checksum
+      Checksum.from_gem_package(@package)
+    end
+
     private
 
     def prepare_extension_build(extension_dir)
@@ -108,64 +116,21 @@ module Bundler
     end
 
     def strict_rm_rf(dir)
-      Bundler.rm_rf dir
-    rescue StandardError => e
-      raise unless File.exist?(dir)
+      return unless File.exist?(dir)
 
-      raise DirectoryRemovalError.new(e, "Could not delete previous installation of `#{dir}`")
-    end
-
-    def validate_bundler_checksum(checksum)
-      return true if Bundler.settings[:disable_checksum_validation]
-      return true unless checksum
-      return true unless source = @package.instance_variable_get(:@gem)
-      return true unless source.respond_to?(:with_read_io)
-      digest = source.with_read_io do |io|
-        digest = SharedHelpers.digest(:SHA256).new
-        digest << io.read(16_384) until io.eof?
-        io.rewind
-        send(checksum_type(checksum), digest)
-      end
-      unless digest == checksum
-        raise SecurityError, <<-MESSAGE
-          Bundler cannot continue installing #{spec.name} (#{spec.version}).
-          The checksum for the downloaded `#{spec.full_name}.gem` does not match \
-          the checksum given by the server. This means the contents of the downloaded \
-          gem is different from what was uploaded to the server, and could be a potential security issue.
-
-          To resolve this issue:
-          1. delete the downloaded gem located at: `#{spec.gem_dir}/#{spec.full_name}.gem`
-          2. run `bundle install`
-
-          If you wish to continue installing the downloaded gem, and are certain it does not pose a \
-          security issue despite the mismatching checksum, do the following:
-          1. run `bundle config set --local disable_checksum_validation true` to turn off checksum verification
-          2. run `bundle install`
-
-          (More info: The expected SHA256 checksum was #{checksum.inspect}, but the \
-          checksum for the downloaded gem was #{digest.inspect}.)
-          MESSAGE
-      end
-      true
-    end
+      parent = File.dirname(dir)
+      parent_st = File.stat(parent)
 
-    def checksum_type(checksum)
-      case checksum.length
-      when 64 then :hexdigest!
-      when 44 then :base64digest!
-      else raise InstallError, "The given checksum for #{spec.full_name} (#{checksum.inspect}) is not a valid SHA256 hexdigest nor base64digest"
+      if parent_st.world_writable? && !parent_st.sticky?
+        raise InsecureInstallPathError.new(parent)
       end
-    end
 
-    def hexdigest!(digest)
-      digest.hexdigest!
-    end
+      begin
+        FileUtils.remove_entry_secure(dir)
+      rescue StandardError => e
+        raise unless File.exist?(dir)
 
-    def base64digest!(digest)
-      if digest.respond_to?(:base64digest!)
-        digest.base64digest!
-      else
-        [digest.digest!].pack("m0")
+        raise DirectoryRemovalError.new(e, "Could not delete previous installation of `#{dir}`")
       end
     end
   end